NAT Deep Dive: Static, Dynamic, and PAT

Network Address Translation (NAT) is a fundamental technology that allows private networks to communicate with the internet while conserving public IP addresses. Understanding the three main types of NAT and how to configure them on Cisco routers is essential for any network engineer.

Understanding the Three NAT Types

Before diving into configurations, let's clarify what each NAT type accomplishes:

• Static NAT: One-to-one mapping between private and public IP addresses
• Dynamic NAT: Many private IPs share a pool of public IPs on a first-come, first-served basis
• PAT (Port Address Translation): Many private IPs share one or few public IPs using port numbers

Static NAT Configuration

Static NAT provides a permanent one-to-one mapping, ideal for servers that need consistent external access. Here's how to configure it:

Router(config)# ip nat inside source static 192.168.1.100 203.0.113.10
Router(config)# interface fastethernet0/0
Router(config-if)# ip nat inside
Router(config-if)# exit
Router(config)# interface fastethernet0/1
Router(config-if)# ip nat outside

This configuration maps internal host 192.168.1.100 to public IP 203.0.113.10. The ip nat inside and ip nat outside commands designate which interfaces connect to private and public networks respectively.

Dynamic NAT Configuration

Dynamic NAT uses a pool of public IP addresses, assigning them as needed:

Router(config)# ip nat pool PUBLIC_POOL 203.0.113.20 203.0.113.25 netmask 255.255.255.0
Router(config)# access-list 1 permit 192.168.1.0 0.0.0.255
Router(config)# ip nat inside source list 1 pool PUBLIC_POOL
Router(config)# interface fastethernet0/0
Router(config-if)# ip nat inside
Router(config-if)# interface fastethernet0/1
Router(config-if)# ip nat outside

This creates a pool of six public IPs (20-25) that can be dynamically assigned to any host in the 192.168.1.0/24 network.

PAT (Overload) Configuration

PAT is the most common NAT type, allowing hundreds of internal hosts to share a single public IP:

Router(config)# access-list 1 permit 192.168.1.0 0.0.0.255
Router(config)# ip nat inside source list 1 interface fastethernet0/1 overload
Router(config)# interface fastethernet0/0
Router(config-if)# ip nat inside
Router(config-if)# interface fastethernet0/1
Router(config-if)# ip nat outside

The overload keyword enables PAT, using the interface's IP address as the public address.

Monitoring NAT Translations

To view active NAT translations, use the show ip nat translations command:

Router# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
tcp 203.0.113.1:1024   192.168.1.10:1024  8.8.8.8:53       8.8.8.8:53
tcp 203.0.113.1:1025   192.168.1.20:2048  74.125.224.72:80 74.125.224.72:80

This output shows PAT in action, with different internal hosts using the same public IP but different port numbers.

Troubleshooting with Debug

When NAT isn't working as expected, enable debugging:

Router# debug ip nat
IP NAT debugging is on
Router# debug ip nat detailed
IP NAT detailed debugging is on

This reveals real-time NAT translation attempts and failures. You might see output like:

NAT: s=192.168.1.10->203.0.113.1, d=8.8.8.8 [0]
NAT: s=8.8.8.8, d=203.0.113.1->192.168.1.10 [0]

Remember to disable debugging when finished: no debug all

Common Troubleshooting Steps

If NAT isn't working, check these items systematically:

1. Verify ip nat inside and ip nat outside are configured on the correct interfaces
2. Confirm access lists permit the correct source networks
3. Check that NAT pool isn't exhausted with show ip nat statistics
4. Verify routing is correct for both directions

What's Next

Now that you understand NAT fundamentals and configuration, the next step is exploring advanced NAT scenarios like overlapping networks and NAT with VPNs. We'll also cover NAT64 for IPv6 transition scenarios in upcoming posts.