Skip to content
Study CCNP

3.3.b Configure NAT/PAT

4 min read ENCOR 350-401 v1.2 Updated

Aligned to Cisco's 350-401 ENCOR v1.2 exam topics.

On this page

What this objective tests

The objective says "configure". The exam wants working static NAT, dynamic NAT, and PAT configs. You must also read the translation table.

Network Address Translation (NAT) changes IP addresses in packets. Port Address Translation (PAT), also called NAT overload, lets many inside hosts share one outside address by translating ports too.

Every NAT config has four parts:

  1. Mark the inside interface.
  2. Mark the outside interface.
  3. Match the inside local addresses.
  4. Define how they translate.

NAT terms

TermMeaning
Inside localThe real inside address before translation
Inside globalThe address the inside host uses outside
Outside localHow an outside address appears inside
Outside globalThe real outside address

Example: one router pair, all three methods

Topology:

Inside LAN 10.10.10.0/24
   |
R1 Gi0/0 10.10.10.1 (ip nat inside)
R1 Gi0/1 203.0.113.2/30 (ip nat outside)
   |
ISP router 203.0.113.1, test host 198.51.100.20

Interface roles on R1:

interface GigabitEthernet0/0
 description Inside LAN
 ip address 10.10.10.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/1
 description To ISP
 ip address 203.0.113.2 255.255.255.252
 ip nat outside
!
ip route 0.0.0.0 0.0.0.0 203.0.113.1

Note: If you swap inside and outside, NAT will not behave as you expect. Check the markings first.

Static NAT

One inside address maps to one outside address. Use it for a server that needs a stable outside address.

ip nat inside source static 10.10.10.100 203.0.113.10

The server 10.10.10.100 always appears outside as 203.0.113.10.

Dynamic NAT with a pool

Inside hosts take addresses from a pool. The pool needs one address per active host.

ip access-list standard NAT-INSIDE
 permit 10.10.10.0 0.0.0.255
!
ip nat pool PUBLIC-POOL 203.0.113.17 203.0.113.30 netmask 255.255.255.240
ip nat inside source list NAT-INSIDE pool PUBLIC-POOL

If the pool is not part of the connected outside subnet, the ISP needs a return route for the pool. NAT does not teach the upstream router where the pool lives.

PAT overload

Many inside hosts share one outside address. PAT is the common choice because it conserves public IPv4 addresses.

ip access-list standard NAT-INSIDE
 permit 10.10.10.0 0.0.0.255
!
ip nat inside source list NAT-INSIDE interface GigabitEthernet0/1 overload

Use the pool form of PAT when you must overload a pool instead of the interface: add overload to the pool command.

Expected verification output

With static NAT and PAT active at the same time:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
icmp 203.0.113.2:7     10.10.10.11:7      198.51.100.20:7    198.51.100.20:7
tcp 203.0.113.2:49152  10.10.10.11:49152  198.51.100.20:80   198.51.100.20:80
--- 203.0.113.10       10.10.10.100       ---                ---

Read this output:

  • The first two entries are PAT entries. The inside global address is the same, but the ports differ. Each flow gets its own port.
  • The last entry is the static NAT entry. It has no protocol and no ports. It maps the whole address.

Check the counters:

R1# show ip nat statistics
Total active translations: 3 (1 static, 2 dynamic; 2 extended)
Outside interfaces:
  GigabitEthernet0/1
Inside interfaces:
  GigabitEthernet0/0
Hits: 248  Misses: 3
...

In a lab, clear the table with clear ip nat translation *. Use this command carefully in production.

Lab: configure all three NAT types

Topology: the R1 and ISP diagram from the example above. PC1 is 10.10.10.11. The server is 10.10.10.100.

Do these steps:

  1. Configure the R1 interfaces with the inside and outside markings above. Add the default route.
  2. Configure PAT overload for the 10.10.10.0/24 subnet.
  3. Ping the ISP test host 198.51.100.20 from PC1. Check show ip nat translations on R1. Find the PAT entry.
  4. Ping the test host from a second PC. Confirm both hosts share 203.0.113.2 with different ports.
  5. Add the static NAT entry for the server. Test reachability to 203.0.113.10 from the ISP side. Check the table for the static entry.
  6. Remove the PAT command. Configure dynamic NAT with PUBLIC-POOL. Generate traffic and watch the pool assignments.
  7. Break the config: remove the permit line from the NAT-INSIDE ACL. Predict the symptom, then test.
  8. Restore the ACL. Verify the translations build again.

Exam traps

  • The NAT ACL matches inside local addresses for inside source NAT.
  • NAT does not replace routing. You need a route out and a return path.
  • A pool outside the connected subnet needs upstream return routing.
  • PAT entries have protocol and port columns. Static entries do not.
  • No translations means no traffic matched the ACL or the interface markings are wrong.
  • Pool exhaustion causes intermittent failures when too many hosts are active.

Pass check

You are ready when you can do these things:

  • Configure static NAT, a dynamic pool, and PAT overload from memory.
  • Read show ip nat translations and name the NAT type of each entry.
  • Explain the four NAT terms with a concrete address.
  • List the troubleshooting order: markings, ACL, routing, return path, table.

Related objectives