1. What Is NAT?

Network Address Translation (NAT) is a networking technique that modifies IP address information in packet headers as traffic passes between networks.

A common use of NAT is translating private IPv4 addresses used inside a local network into public IPv4 addresses used to communicate across the internet.

    Private Network
    192.168.1.10
    192.168.1.20
    192.168.1.30
          |
          v
    +----------------+
    | Router with NAT|
    +----------------+
          |
          v
    Public Internet
    Public IPv4 Address
    

NAT can translate addresses in different ways depending on the network requirements and configuration.

2. Why Do We Need NAT?

IPv4 has a limited address space. Private IPv4 addresses allow organizations to use the same address ranges internally without requiring a globally unique public address for every device.

The main reasons NAT is used include:

• Allowing multiple private IPv4 devices to share a public IPv4 address through PAT.
• Connecting private networks to the public internet.
• Mapping a specific public address to an internal server.
• Supporting networks with limited public IPv4 addresses.

Remember: NAT is not a complete security solution. Firewalls, access controls, updates, and secure configurations are still necessary.

3. Private IP vs Public IP

The three private IPv4 ranges are:

• 10.0.0.0/8 — 10.0.0.0 to 10.255.255.255
• 172.16.0.0/12 — 172.16.0.0 to 172.31.255.255
• 192.168.0.0/16 — 192.168.0.0 to 192.168.255.255

4. How Does NAT Work?

Consider a laptop with private IP address 192.168.1.10 accessing a website. The router translates the source address to a public address before forwarding the traffic to the internet.

    Laptop
    192.168.1.10
         |
         | Source: 192.168.1.10
         v
    +----------------------+
    | Router / NAT Device  |
    | Public IP: 203.0.113.10 |
    +----------------------+
         |
         | Source translated to
         | 203.0.113.10
         v
    Internet / Web Server
    

When the response returns, the router uses its translation state or mapping to forward the traffic to the correct internal device.

The public address 203.0.113.10 is reserved for documentation and is used here only as an example.

5. Types of NAT

Three commonly discussed NAT types are:

• Static NAT — a fixed mapping between an inside local address and an inside global address.
• Dynamic NAT — mappings are allocated from a configured public address pool.
• PAT (Port Address Translation) — multiple internal devices share one or more public IP addresses by using transport-layer port information to distinguish sessions.

6. What Is Static NAT?

Static NAT creates a fixed mapping between an internal address and a public address.

    Internal Web Server
    192.168.1.100
            |
            v
    +------------------+
    | Router with NAT  |
    +------------------+
            |
            v
    Public Address
    203.0.113.100
    

Static NAT is useful when a device needs a consistent address mapping, such as a server that must be reachable through a dedicated public IPv4 address.

A static NAT mapping alone does not guarantee that a server is reachable from the internet. Routing, firewall rules, and other network settings must also allow the traffic.

7. What Is Dynamic NAT?

Dynamic NAT assigns public IPv4 addresses from a configured pool when internal devices need translations.

    PC 1: 192.168.1.10 ----+
                          |
    PC 2: 192.168.1.20 ----+---- NAT Router
                          |        |
    PC 3: 192.168.1.30 ----+        v
                                Public IP Pool
                              203.0.113.10
                              203.0.113.11
                              203.0.113.12
    

The available public addresses are allocated according to the translation configuration and current usage. If the pool is exhausted, additional devices may not obtain a translation until an address becomes available.

8. What Is PAT?

Port Address Translation (PAT), also called NAT overload in Cisco terminology, allows multiple internal devices to share one public IPv4 address by using different transport-layer port mappings.

    PC 1: 192.168.1.10 ----+
                          |
    PC 2: 192.168.1.20 ----+---- NAT Router
                          |          |
    PC 3: 192.168.1.30 ----+          v
                                Public IP
                               203.0.113.10
                                      |
                                      v
                                   Internet
    

The router maintains translation information so that return traffic can be associated with the correct internal session.

PAT is widely used in home and office routers because a large number of devices can share a smaller number of public IPv4 addresses.

9. Static NAT vs Dynamic NAT vs PAT

10. Inside Local, Inside Global, Outside Local and Outside Global

Cisco NAT terminology describes addresses from the perspective of the NAT device:

• Inside local — the inside device's address as it appears on the internal network.
• Inside global — the address representing the inside device to the outside network.
• Outside global — the actual address assigned to the outside destination.
• Outside local — the address used to represent the outside destination to the inside network; it is often the same as the outside global address.

These terms are especially useful when studying Cisco NAT tables and troubleshooting translations.

11. Basic Cisco Static NAT Configuration

Example topology:

• Inside server: 192.168.1.100
• Inside interface: GigabitEthernet0/0
• Outside interface: GigabitEthernet0/1
• Example public mapping: 203.0.113.100

```

interface GigabitEthernet0/0
ip address 192.168.1.1 255.255.255.0
ip nat inside
no shutdown

interface GigabitEthernet0/1
ip address 203.0.113.2 255.255.255.0
ip nat outside
no shutdown

ip nat inside source static 192.168.1.100 203.0.113.100 

This is a conceptual example. The public address and interface addressing must match the actual lab topology and upstream routing.

12. Basic Cisco PAT Configuration

PAT can allow devices in an internal subnet to share the router's outside interface address.

```

access-list 1 permit 192.168.1.0 0.0.0.255

interface GigabitEthernet0/0
ip nat inside

interface GigabitEthernet0/1
ip nat outside

ip nat inside source list 1 interface GigabitEthernet0/1 overload 

The access list identifies inside addresses eligible for translation. The overload keyword enables PAT using the outside interface address.

In a working lab, configure valid interface IP addresses, routing, and any required upstream connectivity.

13. NAT Verification Commands

```

show ip nat translations
show ip nat statistics
show access-lists
show ip interface brief
show ip route 

Use these commands to inspect translation entries, NAT counters, matching access lists, interface status, and routing.

14. Common NAT Problems

• Incorrect inside or outside interface designation.
• An access list that does not match the intended internal subnet.
• Missing or incorrect routing.
• An exhausted dynamic NAT pool.
• Firewall rules blocking traffic.
• Incorrect server gateway or addressing.

Troubleshoot one layer at a time: verify interfaces, routing, NAT rules, translation entries, and security policies.

15. Does NAT Replace a Firewall?

No. NAT translates addresses; a firewall enforces traffic policies. Some devices perform both functions, but the concepts are different.

Do not assume that a NAT configuration alone provides comprehensive protection. Apply appropriate firewall rules and expose only the services that are required.

16. Quick Quiz

17. Key Takeaways

• NAT translates IP address information in packet headers.
• Private IPv4 addresses are commonly translated for internet access.
• Static NAT provides a fixed address mapping.
• Dynamic NAT allocates mappings from a configured pool.
• PAT allows many internal sessions to share public IPv4 addresses using ports.
• Cisco uses the overload keyword for PAT in common configurations.
• NAT does not replace firewall rules or other security controls.