3.3.b Configure NAT/PAT

3 min read ENCOR 350-401 v1.2

Aligned to Cisco's 350-401 ENCOR v1.2 exam topics.

On this page

NAT changes IP addresses in packets. PAT, also called NAT overload, lets many inside hosts share one outside address by translating transport ports too.

For ENCOR, know the mechanics:

Mark inside and outside interfaces.
Match inside local addresses.
Define how they translate.
Verify the translation table and packet flow.

NAT terms

Term	Meaning
Inside local	Real inside address before translation.
Inside global	Address representing the inside host after translation.
Outside local	How an outside address appears to the inside network.
Outside global	Real outside address.

Most basic labs focus on inside local to inside global translation.

PC-A · 10.10.10.10:51344
PC-B · 10.10.10.11:49821
PC-C · 10.10.10.12:50102
R1 PAT table
203.0.113.2 · ports 62001–62003
Internet · one public IP, many inside flows

The router tracks each inside socket separately. Return traffic must match the same inside host and port or the translation fails.

Interface roles

Inside LAN
R1
Internet/Outside

R1:

interface GigabitEthernet0/0
 description Inside LAN
 ip address 10.10.10.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/1
 description Outside
 ip address 203.0.113.2 255.255.255.252
 ip nat outside

If inside/outside is reversed, NAT will not behave the way you expect.

Static NAT

One inside address maps to one outside address.

ip nat inside source static 10.10.10.10 203.0.113.10

Use case: inside server needs a stable outside address.

Verify:

show ip nat translations
show ip nat statistics

Dynamic NAT with a pool

Inside hosts use addresses from a pool.

ip access-list standard NAT-INSIDE
 permit 10.10.10.0 0.0.0.255
!
ip nat pool PUBLIC-POOL 203.0.113.20 203.0.113.30 netmask 255.255.255.0
ip nat inside source list NAT-INSIDE pool PUBLIC-POOL

This requires enough public addresses for active translations.

If the NAT pool is not from the connected outside subnet, the upstream network needs a return route for that pool back to the NAT device. NAT changes addresses, but it does not magically teach the provider or upstream router where the translated pool lives.

PAT / overload

Many inside hosts share one outside interface address.

ip access-list standard NAT-INSIDE
 permit 10.10.10.0 0.0.0.255
!
ip nat inside source list NAT-INSIDE interface GigabitEthernet0/1 overload

PAT is common because it conserves public IPv4 addresses.

Verification commands

show ip nat translations
show ip nat translations verbose
show ip nat statistics
show access-lists NAT-INSIDE
show ip interface brief
show run | include ip nat

To clear translations in a lab:

clear ip nat translation *

Use clearing carefully in production.

NAT troubleshooting order

Is the inside interface marked ip nat inside?
Is the outside interface marked ip nat outside?
Does the ACL match the inside local source?
Does routing send traffic toward the outside interface?
Does return traffic have a route back?
Is the translation table being built?
Is the pool exhausted?

Example: PAT with default route

interface gi0/0
 description LAN
 ip address 10.10.10.1 255.255.255.0
 ip nat inside
!
interface gi0/1
 description ISP
 ip address 203.0.113.2 255.255.255.252
 ip nat outside
!
ip access-list standard NAT-INSIDE
 permit 10.10.10.0 0.0.0.255
!
ip nat inside source list NAT-INSIDE interface gi0/1 overload
!
ip route 0.0.0.0 0.0.0.0 203.0.113.1

Test from an inside host:

ping <outside-test-host-in-your-lab>

Use a lab-controlled outside target when the goal is to prove NAT behavior. A failed public ping can be caused by DNS, upstream routing, firewall policy, ICMP filtering, or Internet access, not only NAT.

On R1:

show ip nat translations
show ip nat statistics
show access-lists NAT-INSIDE

Lab: Make PAT work

Topology

PC1 10.10.10.10
R1
ISP 203.0.113.1

R1 inside: 10.10.10.1/24. R1 outside: 203.0.113.2/30.

Task 1: Configure PAT

interface gi0/0
 ip address 10.10.10.1 255.255.255.0
 ip nat inside
 no shutdown
!
interface gi0/1
 ip address 203.0.113.2 255.255.255.252
 ip nat outside
 no shutdown
!
ip access-list standard NAT-INSIDE
 permit 10.10.10.0 0.0.0.255
!
ip nat inside source list NAT-INSIDE interface gi0/1 overload
ip route 0.0.0.0 0.0.0.0 203.0.113.1

Task 2: Verify

From PC1, test against a lab outside host you control, or a simulated ISP loopback. Public pings are poor proof because ICMP may be filtered and internet return paths are outside your lab control. On R1:

show ip nat translations
show ip nat statistics

Task 3: Break it

Remove the ACL permit or apply ip nat outside to the wrong interface. Predict the symptom, test again, then fix it.

Exam traps

NAT ACLs match inside local addresses for inside source NAT.
Standard ACL wildcard masks are easy to invert.
NAT does not replace routing. You still need a route out and return traffic must come back.
Dynamic pools need upstream return routing when the pool is not on the connected outside subnet.
PAT uses ports; static NAT maps one address to another.
No translations means the router did not match or process eligible traffic.
Pool exhaustion causes intermittent failures when too many hosts need translations.

Quick checklist

Are inside and outside interfaces marked correctly?
Does the NAT ACL match only traffic that should be translated?
Is the pool reachable on the return path?
Are translations being created?
Are NAT counters incrementing?
Is the failure really NAT, or is routing/ACL/stateful firewalling the issue?