NAT & PAT Lab

Step 1 — NAT Overview

# NAT terminology:
# Inside Local    → private IP of internal device (e.g. 192.168.1.10)
# Inside Global   → public IP seen by internet (e.g. 203.0.113.5)
# Outside Local   → IP of external host as seen from inside
# Outside Global  → actual IP of external host

# Inside vs Outside interfaces:
# Inside  → connected to internal network (LAN side)
# Outside → connected to internet (WAN side)

Step 2 — Static NAT

# Mark interfaces as inside/outside
interface GigabitEthernet0/0
 ip nat inside

interface GigabitEthernet0/1
 ip nat outside

# Create static mapping: private → public
ip nat inside source static 192.168.1.10 203.0.113.10
ip nat inside source static 192.168.1.20 203.0.113.20

# Now:
# 192.168.1.10 always appears as 203.0.113.10 on the internet
# Inbound traffic to 203.0.113.10 → forwarded to 192.168.1.10

Step 3 — Dynamic NAT

# Mark interfaces
interface GigabitEthernet0/0
 ip nat inside
interface GigabitEthernet0/1
 ip nat outside

# Define a pool of public IPs
ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.10 netmask 255.255.255.0

# Create ACL to define which private IPs get translated
access-list 1 permit 192.168.1.0 0.0.0.255

# Link ACL to pool
ip nat inside source list 1 pool PUBLIC_POOL

# First 10 internal hosts get IPs from the pool
# 11th host gets NO translation (pool exhausted)
# This is why PAT is preferred

Step 4 — PAT (NAT Overload)

# PAT = Port Address Translation = NAT Overload
# Many internal IPs share ONE public IP, differentiated by port numbers
# This is what your home router does

# Method 1: Use the outside interface IP (most common)
interface GigabitEthernet0/0
 ip nat inside
interface GigabitEthernet0/1
 ip nat outside

access-list 1 permit 192.168.1.0 0.0.0.255

ip nat inside source list 1 interface GigabitEthernet0/1 overload
# "overload" keyword = PAT

# Method 2: Use a pool with overload
ip nat pool PAT_POOL 203.0.113.1 203.0.113.1 netmask 255.255.255.0
ip nat inside source list 1 pool PAT_POOL overload

Step 5 — Verify NAT

# Show NAT translation table
show ip nat translations

# Output example:
Pro  Inside global     Inside local      Outside local     Outside global
tcp  203.0.113.1:1024  192.168.1.10:1024 8.8.8.8:80       8.8.8.8:80
tcp  203.0.113.1:1025  192.168.1.20:3389 10.0.0.5:3389    10.0.0.5:3389

# Show NAT statistics
show ip nat statistics

# Clear the NAT translation table
clear ip nat translation *

# Debug NAT in real-time
debug ip nat
# Shows each translation as it happens
# NAT: s=192.168.1.10->203.0.113.1, d=8.8.8.8 [80]
undebug all

Step 6 — Port Forwarding (Static PAT)

# Forward specific port to internal server
# External port 80 → internal web server 192.168.1.100:80
ip nat inside source static tcp 192.168.1.100 80 203.0.113.1 80

# Forward RDP port
ip nat inside source static tcp 192.168.1.200 3389 203.0.113.1 3389

# Forward a different external port (security through obscurity)
# External port 2222 → internal SSH server port 22
ip nat inside source static tcp 192.168.1.100 22 203.0.113.1 2222

Step 7 — Troubleshooting NAT

# Issue: No translations in table
# Check:
# 1. Is ip nat inside set on the LAN interface?
# 2. Is ip nat outside set on the WAN interface?
# 3. Does the ACL match the source IP?
# 4. Is there a route to the internet from the router?

# Test: ping from an inside host to an outside IP
ping 8.8.8.8 source 192.168.1.1

# Check ACL matches
show access-lists 1

# Check routing table has a default route
show ip route | include 0.0.0.0

📋 NAT/PAT Cheat Sheet