NAT types: static, dynamic and PAT
Which NAT type fits the requirement
Network Address Translation (NAT, RFC 3022 describes the traditional form) rewrites IP addresses as packets cross a router, mainly so hosts with private addresses can reach the internet. Three types matter. Static NAT is a permanent one-to-one mapping, used when something outside must reach a specific inside host. Dynamic NAT maps inside hosts to addresses taken from a pool as they need them. PAT (port address translation, the overload keyword; RFC 3022 calls it NAPT) lets many inside hosts share one public address by also rewriting the source port. The decision rule: one server reachable from outside means static, many users and a short supply of public addresses means PAT, and dynamic with a pool is the in-between that needs one public address per simultaneous host.
| Requirement | Type | Key configuration |
|---|---|---|
| Publish one internal server on a fixed public address | Static | ip nat inside source static <local> <global> |
| Inside users share a pool of several public addresses, one each | Dynamic | ip nat pool ... plus ip nat inside source list N pool NAME |
| Hundreds of users behind one public address | PAT | ip nat inside source list N interface g0/0 overload |
Per RFC 3022, dynamic bindings are created when an outbound session starts and may be released when the last session using them ends, while a static mapping is fixed and is what allows hosts outside to reach a local host via a known public address.
The four address terms
The terms look hard because they describe one packet from two views. The word inside or outside says which network the host sits in; local or global says which network is looking at the address.
| Term | Meaning |
|---|---|
| Inside local | The inside host’s address as seen from inside, normally private |
| Inside global | The same inside host as seen from outside, normally the public address |
| Outside local | The outside host as seen from inside |
| Outside global | The outside host’s real address as seen from outside |
Cisco’s NAT configuration pages use these as the column headings of show ip nat translations. In ordinary internet-access NAT the outside host is not translated, so outside local and outside global are the same address, and the exam usually only asks you to tell inside local from inside global. A quick test: the router translates the inside local into the inside global on the way out.
A worked PAT example
Inside LAN 192.168.1.0/24, outside interface g0/0 with public address 203.0.113.5 (a documentation address). Configuration:
access-list 1 permit 192.168.1.0 0.0.0.255
!
interface g0/1
ip nat inside
interface g0/0
ip nat outside
!
ip nat inside source list 1 interface g0/0 overload
Three steps: mark which interface faces which side, use an ACL to say which inside addresses may be translated (the ACL does not filter here; it only selects, see ACLs explained), then bind that list to the outside interface address with overload.
PC1 192.168.1.10 browses to 198.51.100.20 on port 80 from source port 51000, and PC2 192.168.1.11 uses the same source port 51000. The table afterwards looks like:
Pro Inside global Inside local Outside local Outside global
tcp 203.0.113.5:51000 192.168.1.10:51000 198.51.100.20:80 198.51.100.20:80
tcp 203.0.113.5:1024 192.168.1.11:51000 198.51.100.20:80 198.51.100.20:80
Both hosts share 203.0.113.5. The router kept 51000 for PC1 and gave PC2 a free port instead, so replies to each port go to the right host. Cisco’s NAT FAQ explains that PAT first tries to keep the original source port and, when that is taken, uses the first free port from its range (1024 here; the exact value depends on the platform). That port rewriting is what RFC 3022 calls NAPT: (local address, local port) is mapped to (registered address, assigned port), and the mapping is reversed on return traffic.
Without overload, the same list 1 interface g0/0 binding translates one inside host at a time and the others fail.
What to verify when it does not work
Work down the list: show ip nat translations shows what was created; show ip nat statistics shows hits, misses and the interfaces marked inside and outside; debug ip nat shows each packet. The common faults are a missing or swapped ip nat inside / ip nat outside, an ACL that does not match the inside addresses (a wrong wildcard), a pool too small for dynamic NAT, and no route back to the translated address. Address planning also matters: private ranges in the subnetting guide are the inside local space, and the same job in IPv6 mostly disappears, see IPv4 vs IPv6.
Which exams test this
| Exam | How the topic appears | Where on this site |
|---|---|---|
| CCNA 200-301 | v1.1 (until Feb 2, 2027): IP Services, objective 4.1, configure and verify inside source NAT using static mappings and pools. v2.0 (from Feb 3, 2027): Network Services and Security, objective 4.3, configure NAT/PAT on IOS XE routers | Network services and security explained |
| CompTIA Network+ N10-009 | Network Implementation, objective 2.1: NAT and PAT as address translation within routing technologies; Networking Concepts adds private versus public addressing (1.7) and the cloud NAT gateway (1.3) | Networking concepts explained |
| CCNA Automation 200-901 | Network Fundamentals, objectives 6.6 and 6.8: describe what NAT does and diagnose an application connectivity problem caused by NAT | Network fundamentals explained |
How NAT questions are built
Questions give a short topology and ask for the missing command, or print a translation table and ask which address is which. The trap in the table is reading columns left to right as “source, destination”. The constraint words: “single public address” or “many hosts” (PAT, overload), “server must be reachable from the internet” (static), “pool of addresses” (dynamic), “overload” (ports are used), and “which address would a host on the internet see” (inside global). Another standard trap is a correct ip nat inside source line with the interfaces never marked inside and outside.
Practice questions
Question 1. A branch router has one public address on g0/0 and 300 inside hosts that all need internet access. Which configuration meets the requirement?
- A. ip nat inside source static for each host
- B. ip nat inside source list 1 pool PUBLIC with a pool of one address, no overload
- C. ip nat inside source list 1 interface g0/0, no overload
- D. ip nat inside source list 1 interface g0/0 overload
Show answer
Answer: D
Many hosts sharing one public address needs PAT, which is configured with the overload keyword on a list bound to the interface. Static NAT maps one inside host to one global address and cannot serve 300 hosts. Dynamic NAT with a pool needs roughly one global address per concurrently active host, and there is only one. A pool of one address without overload behaves the same way, and so does binding the list to the interface without overload: only one inside host can be translated at a time.
Question 2. In the output of show ip nat translations, an entry reads: Inside global 203.0.113.5:1024, Inside local 192.168.1.11:51000. Which statement is correct?
- A. Host 192.168.1.11 is being translated to 203.0.113.5 with its source port changed
- B. Host 203.0.113.5 is being translated to 192.168.1.11
- C. This is a static NAT entry for a server
- D. 203.0.113.5 is the outside server being contacted
Show answer
Answer: A
Inside local is the host’s real private address as seen from inside, so 192.168.1.11 is the inside host. Inside global is the address that host presents to the outside, the shared public address with a translated port. The router changed the source port from 51000 to 1024, which is PAT. The inside global address is not the host’s configured address, and the entry does not describe the outside server.