Exam Objective 4.3: Configure NAT/PAT on IOS XE routers.
Network Address Translation is the mechanism that allows the private RFC 1918 address space covered back in objective 1.3 to actually reach the public internet, by translating private source addresses into one or more public addresses as traffic exits the network. Nearly every enterprise and home network edge router performs some form of NAT/PAT. This objective expects you to configure the three core NAT variants — static, dynamic, and PAT (NAT overload) — and to read and troubleshoot the resulting translation table.
NAT was originally developed to address IPv4 address exhaustion — since private RFC 1918 addresses (covered in objective 1.3) are not globally routable, a device using a private address cannot directly communicate across the public internet. NAT solves this by translating a private (inside) address into a public (outside) address as traffic crosses the boundary between the two, and translating the return traffic back, entirely transparently to the end hosts involved.
Additional benefits beyond address conservation:
Provides a layer of address-hiding/obscurity, since internal private addressing is never directly exposed to the outside network
Allows internal addressing schemes to remain stable and independent of whatever public address space is actually assigned by an ISP, simplifying renumbering if the public-facing addressing ever changes
Cisco NAT terminology is built around four specific terms, and precisely distinguishing them is essential, since exam questions frequently test the exact definitions:
Inside local address — a device's actual configured address on the inside (private) network, as it's known internally — typically an RFC 1918 private address
Inside global address — the translated address representing an inside device, as it appears to the outside (public) network — typically a public, routable address
Outside local address — the address of an outside (destination) device, as it appears to devices on the inside network (usually identical to the outside global address in simple NAT deployments, since translation of the destination is uncommon in typical scenarios)
Outside global address — the actual, real address of an outside (destination) device, as it exists on the public network
Simplified for most exam scenarios: In the overwhelming majority of tested configurations, only the inside local and inside global addresses actually change/matter — the outside local and outside global addresses are typically the same value, since most NAT deployments only translate internal source addresses, not the addresses of external destinations being reached.
Exam Alert: "Inside local" is always the private address before translation; "inside global" is always the address after translation, as seen by the outside world. This local/global and inside/outside terminology combination is one of the most consistently tested vocabulary sets in the entire NAT/PAT topic.
Static NAT creates a fixed, one-to-one, permanent mapping between one specific inside local address and one specific inside global address — the same translation always applies to that specific device every time, in both directions.
Use case: A server that needs to be consistently reachable from the outside network at a predictable public address (a web server, mail server, or similar internally hosted, externally accessible resource).
Configuration:
interface GigabitEthernet0/0
ip address 192.168.1.1 255.255.255.0
ip nat inside
interface GigabitEthernet0/1
ip address 203.0.113.1 255.255.255.252
ip nat outside
ip nat inside source static 192.168.1.10 203.0.113.10
Key configuration elements:
ip nat inside / ip nat outside — designates which interfaces are considered "inside" (facing the private network) and which are "outside" (facing the public network); NAT will not function on any interface without one of these two designations applied
ip nat inside source static [inside-local] [inside-global] — creates the permanent, one-to-one translation
Exam Alert: ip nat inside and ip nat outside must both be applied to the correct respective interfaces before any NAT configuration will actually take effect — a very commonly tested prerequisite, similar in spirit to ip routing being required for SVIs or ipv6 unicast-routing for IPv6 forwarding.
Dynamic NAT translates a pool of inside local addresses to a pool of inside global addresses, drawing an available public address from the pool on an as-needed basis for each internal device attempting outbound communication, rather than a fixed, predetermined one-to-one mapping.
Use case: A group of internal hosts that need outbound internet access, where a pool of multiple public addresses is available, but a permanent individual mapping (as with static NAT) isn't necessary or desirable.
Configuration:
ip nat pool PUBLIC-POOL 203.0.113.10 203.0.113.20 netmask 255.255.255.0
access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 pool PUBLIC-POOL
Key configuration elements:
ip nat pool [name] [start-address] [end-address] netmask [mask] — defines the range of public addresses available to be dynamically assigned
access-list [number] permit [network] [wildcard-mask] — defines which inside local addresses are eligible for translation (this ACL identifies traffic to be translated, it does not filter/block traffic the way a security ACL would)
ip nat inside source list [acl-number] pool [pool-name] — ties the eligible inside addresses (defined by the ACL) to the pool of available inside global addresses
Important limitation of dynamic NAT: If the pool of available public addresses is exhausted (every address in the pool is currently in active use by some other host's session), additional hosts attempting outbound translation will simply fail until an address becomes available again — dynamic NAT (without PAT/overload) provides only a limited number of simultaneous translated sessions, exactly matching the pool size.
Exam Alert: The ACL used in dynamic NAT (and in PAT, covered next) identifies which addresses are eligible for translation — it is not acting as a security/traffic-filtering ACL in this context, even though the syntax looks identical to a standard security ACL. This distinction in purpose is a commonly tested conceptual point.
PAT, also referred to in Cisco terminology as NAT overload, allows many inside local addresses to share a single inside global address (or a small pool of addresses) simultaneously, by additionally translating the Layer 4 port number along with the IP address — allowing the router to distinguish between many different internal hosts' sessions that are all sharing the exact same translated public IP address.
Why PAT is the most commonly deployed NAT variant in practice: Since PAT allows potentially thousands of internal hosts to share just one single public IP address (differentiated by port number rather than needing a unique public address per host), it is by far the most address-efficient NAT variant and is exactly what's used at the edge of most home and small business networks, translating an entire internal network down to a single ISP-assigned public address.
Configuration using a single interface's address (most common real-world pattern):
ip nat inside source list 1 interface GigabitEthernet0/1 overload
This configuration translates all inside local addresses matched by access-list 1 to the single public IP address currently assigned to GigabitEthernet0/1 (the outside interface), using port numbers to distinguish between the many simultaneous internal sessions sharing that one address.
Configuration using a pool with overload (allows a small pool of public addresses to be shared across many more internal hosts than the pool size alone would normally allow):
ip nat pool PUBLIC-POOL 203.0.113.10 203.0.113.10 netmask 255.255.255.0
ip nat inside source list 1 pool PUBLIC-POOL overload
The overload keyword is the critical distinguishing element: Without overload, ip nat inside source list [acl] pool [pool-name] performs standard dynamic NAT (one-to-one, pool-address-limited). Adding overload converts the exact same underlying command into PAT, allowing many-to-one/few translation using port numbers as the additional distinguishing factor.
Exam Alert: The overload keyword is the single most important, most frequently tested element distinguishing PAT from ordinary dynamic NAT — the base command structure is nearly identical, and missing (or correctly including) this one keyword is exactly the kind of detail the exam likes to test directly.
show ip nat translations — displays the current NAT translation table, showing active inside local/inside global (and outside local/outside global, if relevant) address pairs, along with the specific port numbers involved for PAT translations
show ip nat statistics — displays summary statistics, including the number of active translations, hits (successful translations) and misses, and confirms which interfaces are currently designated as inside/outside
clear ip nat translation * — manually clears all current dynamic NAT/PAT translations from the table, useful when troubleshooting stale or incorrect entries (static translations are unaffected by this command, since they're permanent by design)
debug ip nat — shows real-time translation events as they occur, useful for confirming whether translation is actually being attempted/applied to specific traffic (use cautiously in production due to CPU load)
Common NAT/PAT configuration problems:
ip nat inside / ip nat outside missing or applied to the wrong interfaces — NAT will not function at all without these designations correctly applied, and applying them to the wrong interface (inside/outside reversed) causes translation to fail in a confusing, hard-to-diagnose way
ACL used for NAT is misconfigured, either failing to match the intended inside local addresses, or (a subtle, classic mistake) using permit any, which can unintentionally include traffic that should never be translated, such as the router's own generated traffic in certain scenarios, or address ranges outside what was actually intended
Dynamic NAT pool exhausted, with no overload keyword applied, causing new connection attempts to fail once every pool address is in active use
Overload keyword missing when PAT behavior was actually intended, resulting in standard dynamic NAT's much more limited simultaneous-session capacity instead of PAT's much higher effective capacity
Return traffic being dropped due to a security ACL or firewall rule elsewhere in the path, unrelated to the NAT configuration itself, but presenting as if NAT were the problem
Overlapping or conflicting static NAT entries, where the same inside global address is inadvertently assigned to more than one inside local address
Exam Alert: Expect to be shown sample show ip nat translations output and asked to identify the inside local, inside global, outside local, and outside global addresses for a specific entry, or to identify whether a given configuration represents static NAT, dynamic NAT, or PAT based on the exact command syntax shown (specifically, the presence or absence of the overload keyword).
Confirm ip nat inside and ip nat outside are correctly applied to the appropriate interfaces — inside facing the private network, outside facing the public network.
Determine which NAT variant is actually required: static (permanent one-to-one, typically for a server needing consistent external reachability), dynamic (pool-based, limited simultaneous sessions), or PAT/overload (many-to-one or many-to-few, the most common real-world choice for general outbound internet access).
For dynamic NAT or PAT, confirm the ACL used correctly and precisely matches the intended inside local address range — remembering this ACL identifies translation-eligible traffic rather than functioning as a security filter.
For PAT specifically, confirm the overload keyword is present; its absence silently reduces the configuration to standard, much more session-limited dynamic NAT instead.
Verify actual translation activity using show ip nat translations and show ip nat statistics, confirming expected inside local/inside global address pairs are actually being created as traffic flows.
If translations aren't appearing at all, revisit the inside/outside interface designations and the ACL matching criteria first, before assuming a deeper routing or connectivity problem.
If translations appear correct but connectivity still fails, consider whether a security ACL or firewall rule elsewhere in the path (separate from the NAT configuration itself) might be dropping the actual traffic.
Q1. In Cisco NAT terminology, which term refers to a device's actual private address on the internal network, before any translation occurs?
A. Inside global
B. Outside local
C. Inside local
D. Outside global
Answer: C. Inside local refers to a device's real, configured address as it exists on the internal (inside) network, before translation. Inside global refers to the translated address representing that same device as seen from the outside network, and the outside local/outside global terms refer to how the destination (external) device's address appears from each perspective.
Q2. Which command is required on both the inside-facing and outside-facing interfaces before NAT will function at all on a Cisco router?
A. ip nat pool
B. access-list permit
C. ip nat inside and ip nat outside
D. ip nat inside source static
Answer: C. Every NAT configuration requires the router's interfaces to be explicitly designated as either ip nat inside (facing the private network) or ip nat outside (facing the public network). Without these designations correctly applied to the appropriate interfaces, no NAT translation will occur, regardless of how correctly the rest of the NAT configuration (pools, ACLs, static mappings) has been entered.
Q3. Which single keyword converts a standard dynamic NAT configuration into PAT (NAT overload), allowing many internal hosts to share one or a small number of public addresses simultaneously?
A. static
B. pool
C. overload
D. inside
Answer: C. Adding the overload keyword to an otherwise standard dynamic NAT command (ip nat inside source list [acl] pool [pool-name] overload) is what enables PAT behavior — using port numbers in addition to the IP address to distinguish between many internal hosts' sessions sharing the same translated public address. Without overload, the identical base command performs standard one-to-one dynamic NAT instead, limited to the number of addresses in the pool.
Q4. An administrator configures a dynamic NAT pool with only 5 public addresses, without the overload keyword, for a department with 40 internal hosts. What happens once 5 hosts already have active translated sessions and a 6th host attempts outbound access?
A. The 6th host successfully shares one of the existing 5 addresses automatically
B. The 6th host's translation attempt fails, since the pool is exhausted and overload was not configured
C. NAT automatically converts to PAT
D. The static NAT entry takes priority
Answer: B. Without the overload keyword, dynamic NAT provides only a strictly limited number of simultaneous translated sessions, exactly matching the number of addresses in the defined pool. Once all 5 pool addresses are in active use, any additional host attempting translation will fail until one of the existing translations is cleared/expires and frees up an address.
Q5. Which command displays the currently active NAT translation table, including the specific port numbers used for PAT sessions?
A. show ip nat statistics
B. show ip nat translations
C. debug ip nat
D. clear ip nat translation *
Answer: B. show ip nat translations displays the actual current translation entries, including inside local/inside global address pairs and the associated port numbers for PAT sessions. show ip nat statistics instead provides summary counters (hits/misses, active translation count) rather than the individual entries themselves.
Q6. A network engineer configures ip nat inside source static 192.168.1.10 203.0.113.10 for an internally hosted web server. What type of NAT does this represent, and why would this be chosen over dynamic NAT or PAT for this specific device?
A. Dynamic NAT, because it uses a pool of addresses
B. Static NAT, because it creates a permanent, predictable one-to-one mapping suitable for a server that must be consistently reachable from outside at a known address
C. PAT, because it includes the overload keyword
D. Static NAT is functionally identical to PAT in this scenario
Answer: B. This command creates a static NAT entry — a fixed, permanent, one-to-one translation between a specific inside local address and a specific inside global address. This is the appropriate choice for a server that external users need to reliably reach at a consistent, predictable public address, unlike dynamic NAT or PAT, which assign addresses (or shared address/port combinations) on an as-needed basis not guaranteed to remain consistent for any particular internal host.