CCNA 200-301 · 13 of 16

NAT and PAT: many hosts, one public address

The four address names Cisco insists on, static and dynamic translation, how port overloading squeezes a whole office behind one address, reading the translation table, and the things NAT quietly breaks.

Updated 2026-09-09

On this page

NAT was supposed to be temporary. It was invented in the mid-1990s to slow down the exhaustion of IPv4 addresses until something better arrived, that something took twenty-five years to deploy, and in the meantime address translation became the most widely deployed piece of network plumbing in the world. Every home router does it. Almost every office does it. It also quietly breaks assumptions that protocols were built on, which is half of why it is worth understanding properly rather than just configuring.

The map

Read this first when short on time. Every branch is a section below.

Figure 1. The whole article on one page. Every branch is a section below; fold what you know, open what you do not.

What NAT is for

An office has 200 devices and one public IP address from its provider. Those devices are addressed from 192.168.1.0/24, which is private space and cannot be routed on the internet — a packet with that source address will be discarded by the first provider router it meets, and no reply could find its way back.

Network address translation solves this by rewriting the source address of outbound packets to the router's public address, remembering the mapping, and reversing it for the replies. From the internet's point of view, all 200 devices are one machine.

Two clarifications that save a lot of confusion later.

NAT is not a firewall. It happens to block unsolicited inbound traffic, because an arriving packet with no matching translation entry has nowhere to go. That is a side effect of the mechanism, not a policy. It does not inspect anything, it does not distinguish good traffic from bad, and it offers no protection to any conversation the inside host started. Security comes from a stateful firewall; NAT just makes the addresses fit.

NAT is stateful, and routing is not. A router forwards each packet independently. A NAT router must hold a table entry for every active conversation, with a timer. Reboot it and every connection through it dies. That state is also a capacity limit — a busy NAT device runs out of table before it runs out of bandwidth.

The four names

Cisco's terminology for NAT addresses is famously awkward, and it becomes easy the moment you split it into two independent questions.

Inside or outside — whose host is this? Inside means a host on your private network. Outside means a host on the internet.
Local or global — where are you standing when you look at it? Local means as seen from the inside network. Global means as seen from the internet.

Combine them and you get four names for what are really two hosts.

Figure 2. The four names. Inside local and inside global are the two faces of your own host; outside local and outside global are the two faces of the remote one, and are usually identical.

Name	Whose host	Seen from	Example
Inside local	Yours	Inside	192.168.1.10 — the private address
Inside global	Yours	Outside	198.51.100.7 — the public address it appears as
Outside global	Theirs	Outside	203.0.113.9 — the server's real address
Outside local	Theirs	Inside	203.0.113.9 — usually the same, unless you translate them too

Outside local differs from outside global only in the uncommon case where you translate the addresses of external hosts as well — typically after a merger, when two networks discover they both use 10.1.0.0/16.

Static NAT: one to one, permanently

A fixed mapping between one private address and one public address. It works in both directions, which is the point: an outside host can initiate a connection to the public address and reach the inside server.

Router(config)# ip nat inside source static 192.168.1.50 198.51.100.50

Router(config)# interface GigabitEthernet0/0
Router(config-if)# ip nat inside
Router(config-if)# exit
Router(config)# interface GigabitEthernet0/1
Router(config-if)# ip nat outside

The two interface commands are not optional and are the most common reason a correct-looking NAT configuration does nothing at all. NAT only acts on traffic crossing from an interface marked inside to one marked outside, or the reverse. Without them there is no boundary and nothing is translated.

Static NAT costs one public address per host, permanently, so it is reserved for hosts that genuinely must be reachable at a stable address — a mail server, a VPN concentrator, an SFTP server a partner connects to.

Dynamic NAT: borrow from a pool

Inside hosts borrow a public address from a pool when they send something outward, and give it back when the translation times out. Still one-to-one while it lasts.

Router(config)# ip nat pool OFFICE 198.51.100.10 198.51.100.20 netmask 255.255.255.0
Router(config)# access-list 1 permit 192.168.1.0 0.0.0.255
Router(config)# ip nat inside source list 1 pool OFFICE

The access list is not a security control here — it selects which source addresses get translated. Anything it does not permit is forwarded unchanged, which on a private network means it is dropped somewhere upstream.

The limitation is arithmetic: eleven addresses in that pool means the twelfth simultaneous host gets nothing and its traffic is dropped. Because dynamic NAT does not multiplex ports, it wastes most of the benefit and is rarely used today. Its main purpose now is to make the contrast with the next section clear.

PAT: the one everybody actually uses

Port Address Translation, called NAT overload in Cisco configuration, lets hundreds of hosts share a single public address by rewriting the source port as well as the source address.

The insight: a conversation is identified by five things — protocol, source address, source port, destination address, destination port. If two inside hosts both use source port 51288, the router simply gives one of them a different port on the way out and remembers the substitution.

Inside local	Inside global	Outside global
192.168.1.10:51288	198.51.100.7:1024	93.184.216.34:443
192.168.1.11:51288	198.51.100.7:1025	93.184.216.34:443
192.168.1.12:44100	198.51.100.7:1026	142.250.187.196:443

Two hosts using the same source port to the same server are distinguished purely by the port the router assigned. When a reply arrives for 198.51.100.7:1025, the table says it belongs to 192.168.1.11:51288, and the router rewrites the destination accordingly.

! the line you will type more than any other NAT command
Router(config)# access-list 1 permit 192.168.1.0 0.0.0.255
Router(config)# ip nat inside source list 1 interface GigabitEthernet0/1 overload

interface GigabitEthernet0/1 rather than a pool means "use whatever address that interface currently has", which is exactly right when the provider assigns it by DHCP. overload is the keyword that enables port translation; without it you have dynamic NAT with a pool of one.

Capacity is set by the port number space: about 64,000 ports per public address, minus reserved ranges. Since a host typically holds a few dozen connections at once, one address comfortably serves hundreds of users, and thousands with care.

Getting back in: port forwarding

PAT breaks inbound connections by design — an unsolicited packet matches no translation entry, so the router has no idea which inside host it belongs to. A static entry for one port fixes it for one service:

Router(config)# ip nat inside source static tcp 192.168.1.50 443 198.51.100.7 443

Now anything arriving on port 443 of the public address is sent to the internal web server, while everything else continues to be shared by the whole office. This is precisely what the "port forwarding" page in a home router does.

Checking it

Router# show ip nat translations

Pro  Inside global         Inside local       Outside local      Outside global
tcp  198.51.100.7:1024     192.168.1.10:51288 93.184.216.34:443  93.184.216.34:443
tcp  198.51.100.7:1025     192.168.1.11:51288 93.184.216.34:443  93.184.216.34:443
---  198.51.100.50         192.168.1.50       ---                ---

Router# show ip nat statistics
Total active translations: 3 (1 static, 2 dynamic; 2 extended)
Outside interfaces: GigabitEthernet0/1
Inside interfaces: GigabitEthernet0/0
Hits: 88213  Misses: 42

Reading that output: the two tcp rows are PAT entries, called extended because they include ports. The row with dashes is the static mapping, which exists permanently whether or not traffic is flowing. The Inside interfaces and Outside interfaces lines in the statistics are the first thing to check when nothing is being translated — if either is empty, that is the fault.

Router# clear ip nat translation *      ! drops every dynamic entry, and every connection
Router# debug ip nat                    ! per-packet detail; use briefly, on a quiet router

Translations time out on their own — an hour for TCP by default, a minute for UDP, and shorter after a TCP connection closes cleanly. The timeouts are tunable, and lowering them is the usual response to a NAT table filling up.

Watch out

clear ip nat translation * tears down every active conversation through the router. It is a legitimate troubleshooting step and it is not free — every user loses every connection at that instant. On a production router it belongs in a maintenance window, not in a diagnosis.

What NAT breaks

NAT violates the assumption that an address in a packet header is the same address the sender believes it has. Several things depend on that assumption.

Protocols that carry addresses in their payload. FTP in active mode sends the client's own IP address and port inside a command, telling the server where to open the data connection. NAT rewrites the header and not the payload, so the server dutifully connects to a private address and fails. SIP, used for voice, has the same problem, and so do several older protocols. The workaround is an application layer gateway — a helper in the router that inspects and rewrites the payload too. It works, and it is fragile, and it breaks completely once the payload is encrypted.

End-to-end integrity. IPsec in transport mode authenticates the IP header, so changing the address invalidates the signature. NAT traversal wraps IPsec inside UDP to get around it, at the cost of extra headers and complexity.

Peer-to-peer connections. Two hosts both behind NAT cannot connect to each other directly, because neither has an address the other can reach. Everything from video calls to games carries hole-punching machinery and relay servers to work around this, and those mechanisms are a substantial part of why real-time applications are complicated.

Attribution. When five hundred users share one public address, a log entry naming that address identifies nobody. Providers running carrier-grade NAT are obliged to log port assignments as well as addresses, which is a large amount of data to keep purely so a request can be traced back.

In the wild

Carrier-grade NAT translates an ISP's own customers before they reach the internet, using the 100.64.0.0/10 block. It means a household is behind two layers of NAT, and it is why inbound connections to home services became unreliable.
Cloud NAT gateways — AWS NAT Gateway, Azure NAT Gateway — are the same mechanism sold as a service, letting private subnets reach the internet without public addresses, and billed per gigabyte.
Kubernetes uses NAT internally for service addresses, which is why tracing a request from a pod to an external service involves several translation layers before it leaves the cluster.

Inside local: An inside host's private address, as configured on the host.
Inside global: The public address the same host appears as from the internet.
PAT / overload: Translating source ports as well as addresses so many hosts share one public address.
Extended translation: A NAT table entry that includes port numbers, as PAT requires.
Application layer gateway: A helper that inspects and rewrites addresses inside a protocol's payload so it survives translation.

Recap

NAT rewrites private source addresses to a public one so hosts in RFC 1918 space can reach the internet.
It is not a firewall: blocking unsolicited inbound traffic is a side effect of having no matching table entry.
It is stateful, so a reboot kills every connection and the table is a capacity limit.
Inside or outside says whose host it is; local or global says which side you are looking from.
Inside local is the private address, inside global the public one it appears as.
Static NAT is a permanent one-to-one mapping that works in both directions, for servers that must be reachable.
Dynamic NAT lends addresses from a pool and runs out when the pool does.
PAT rewrites the source port as well, so about 64,000 conversations fit behind one address.
ip nat inside and ip nat outside on the right interfaces are mandatory, and their absence is the classic silent failure.
The access list in a NAT statement selects what to translate, not what to permit.
Port forwarding is a static translation for one port, restoring inbound access to one service.
NAT breaks protocols that carry addresses in their payload, end-to-end IPsec, direct peer-to-peer connections, and per-user attribution in logs.

Questions

Say the answer out loud before opening it.

What problem does NAT solve, and what does it not solve?

It lets hosts with private addresses reach the internet through a small number of public addresses; it does not provide security.

Private addresses cannot be routed on the internet, so replies could never return without translation.
Blocking unsolicited inbound traffic is a side effect of having no matching translation, not a policy decision.
NAT inspects nothing and cannot distinguish wanted traffic from unwanted.

Because the protection is incidental, a network that relies on it has no defence at all for connections its own hosts initiate — which is how most compromises actually happen.

Explain inside local, inside global, outside local and outside global.

Inside or outside says whose host it is; local or global says which side of the router you are standing on.

Inside local is your host's private address; inside global is the public address it appears as.
Outside global is the remote server's real address; outside local is how your side sees it.
Outside local and outside global are usually identical, because external addresses are rarely translated.

They differ only when you translate external addresses too, which is typically done after a merger where both organisations used the same private range.

What is the difference between static NAT, dynamic NAT and PAT?

Static is a fixed one-to-one mapping, dynamic borrows an address from a pool for the duration of a conversation, and PAT shares one address among many hosts by also rewriting ports.

Static works in both directions, so outside hosts can initiate connections.
Dynamic runs out when the pool is exhausted and offers no multiplexing.
PAT fits roughly 64,000 conversations behind a single address.

Dynamic NAT without overload is essentially obsolete: it consumes public addresses at the same rate as static NAT while offering none of its inbound reachability.

How does PAT keep two hosts' traffic separate when they use the same source port?

The router assigns each one a different source port on the public side and records the substitution in its translation table.

A conversation is identified by protocol, both addresses and both ports.
Replies arrive addressed to the assigned port, which uniquely identifies the inside host and its original port.
Table entries are called extended translations because they include port numbers.

The consequence is that the router must hold state for every conversation, which is why NAT capacity is measured in translations rather than in bandwidth.

A NAT configuration looks correct but nothing is translated. What is the first thing to check?

Whether ip nat inside and ip nat outside are configured on the right interfaces.

NAT only acts on traffic crossing between an inside-marked and an outside-marked interface.
show ip nat statistics lists both sets of interfaces, and an empty list is the answer.
The second most common cause is an access list that does not match the source subnet.

The failure is silent because packets are still forwarded — they simply leave with their private source address and are dropped somewhere upstream.

What does the access list in "ip nat inside source list 1 interface Gi0/1 overload" do?

It selects which source addresses are translated. It is not a permit or deny decision about traffic.

Addresses that match are translated; addresses that do not are forwarded unchanged.
Unchanged private addresses are then dropped by the first upstream router.
The same list syntax is used, which is why it is easy to read it as a filter.

This is a general pattern in IOS: access lists are a matching language reused by NAT, route maps, quality of service and policy routing, not only by filtering.

How do you make an internal web server reachable from the internet behind PAT?

A static port translation: ip nat inside source static tcp 192.168.1.50 443 198.51.100.7 443.

Traffic arriving on that port of the public address is sent to the internal host.
Everything else continues to be shared by the whole network.
This is what a home router calls port forwarding.

The public port need not match the private one, which is how several internal servers can be published on different external ports of a single address.

Why does active-mode FTP break through NAT?

Because the client sends its own IP address and port inside the FTP command payload, and NAT rewrites headers rather than payloads.

The server reads a private address and tries to open the data connection to it.
The connection goes nowhere and the transfer fails after the control channel worked fine.
Passive mode avoids it by having the client open the data connection outbound instead.

An application layer gateway in the router can rewrite the payload as well, but it fails as soon as the control channel is encrypted, which is why passive mode became the default.

Why can two hosts behind different NAT devices not connect directly?

Because neither has an address the other can reach, and neither NAT device has a translation entry for a connection that has not started.

Both sides can initiate outbound, but neither can accept inbound.
Hole punching works by having both sides send outbound to a known third party at the same time, creating translation entries that then accept each other's traffic.
When that fails, traffic is relayed through a server, which costs latency and bandwidth.

The STUN, TURN and ICE protocols exist entirely for this, and they are a substantial part of why real-time video and voice systems are as complex as they are.

Why is NAT state a capacity problem?

Because every active conversation needs a table entry, so a NAT device can exhaust its table long before it exhausts its bandwidth.

Each entry holds addresses, ports and a timer.
A single browser session can open dozens of connections at once.
Lowering the idle timeouts is the usual first response to a full table.

It also means a NAT device is a stateful single point of failure: a reboot or a failover without state synchronisation drops every connection passing through it.

What does "clear ip nat translation *" do and when should you use it?

It deletes every dynamic translation, which tears down every active connection through the router.

It is useful when a stale entry is sending replies to the wrong host.
Static translations are unaffected.
Every user experiences an instant disconnection of everything.

Clearing a single entry is possible with a more specific form of the command, and is almost always the better choice on a production router.

What is carrier-grade NAT and what does it change for a home user?

NAT performed by the ISP on its own customers, so a household's router receives an address from 100.64.0.0/10 rather than a public one.

The household is then behind two layers of translation.
Port forwarding on the home router no longer makes anything reachable from outside.
A public address is shared among many customers, so logs attribute activity to a group rather than a household.

It exists because IPv4 addresses became expensive enough that providers preferred translation to purchase, and it is one of the strongest practical arguments for deploying IPv6.

How long do NAT translations last?

By default about an hour for TCP, a minute for UDP, and much shorter after a TCP connection closes cleanly.

Entries are removed when the timer expires, freeing the port for reuse.
Timeouts are configurable and are usually reduced when a table is filling.
Static entries never expire.

The UDP timeout is why long-idle UDP sessions such as VPN or voice keepalives send traffic every few seconds — without it the translation disappears and inbound packets have nowhere to go.

Does IPv6 need NAT?

No. There are enough addresses for every host to have a globally routable one, so translation serves no purpose.

The protection people credit NAT with is provided by a stateful firewall instead, explicitly and auditably.
Removing NAT restores end-to-end addressing, which simplifies peer-to-peer applications considerably.
NAT64 exists, but as a transition mechanism for IPv6-only clients reaching IPv4 servers.

The real migration risk is enabling IPv6 without extending firewall rules to it, since hosts that were unreachable behind IPv4 NAT become globally addressable the moment IPv6 comes up.

Why does using an interface rather than a pool make sense for PAT?

Because it uses whatever address the interface currently holds, which is what you need when the provider assigns it dynamically.

A pool must be configured with specific addresses that you own.
An interface reference follows a DHCP renewal automatically.
It is the standard form for a small office or branch with one internet connection.

The trade is that all outbound traffic shares a single address, so if the site later needs more capacity or several public identities, a pool with overload is the next step.