Private IPv4 addresses are not routed across the public internet. Network Address Translation allows a router or firewall to replace those private addresses with public addresses, while Port Address Translation lets many devices share one public IPv4 address.
This topic is important for CCNA students because it combines IPv4 addressing, routing, transport-layer ports and Cisco IOS configuration. It also appears regularly in practical network troubleshooting.
What are NAT and PAT?
NAT translates one IPv4 address into another as traffic crosses a router or firewall. PAT is a form of NAT that translates both the source address and the source port, allowing multiple private devices to use the same public IPv4 address simultaneously.
A typical small network can be described as:
PC1 192.168.10.10 ----\
LAN ---- Router with NAT ---- Internet
PC2 192.168.10.20 ----/ Public IP: 203.0.113.2The PCs use addresses from the private 192.168.10.0/24 network. When they access the internet, the router changes their private source addresses to its public address.
The three private IPv4 ranges defined for internal use are:
| Private range | CIDR block | Common use |
|---|---|---|
10.0.0.0 to 10.255.255.255 | 10.0.0.0/8 | Large enterprise and cloud networks |
172.16.0.0 to 172.31.255.255 | 172.16.0.0/12 | Enterprise and data centre networks |
192.168.0.0 to 192.168.255.255 | 192.168.0.0/16 | Home and small office networks |
Internet routers do not normally carry routes for these private ranges. Translation is therefore required when an IPv4 private network communicates with public internet services.
Why is address translation needed?
Address translation conserves public IPv4 addresses and allows organisations to use reusable private addressing internally. It also separates an internal addressing plan from the public addresses assigned by an internet service provider.
Without NAT or PAT, every device needing direct IPv4 internet connectivity would require a globally routable address. PAT greatly reduces that requirement because hundreds or thousands of connections can share an address, provided each active translation can be identified by protocol and port information.
NAT is not a substitute for routing. A router still needs connected, static or dynamically learned routes to forward traffic. The relationship between these functions is covered further in how routers choose paths using static and dynamic routing.
NAT is also not automatically a complete security control. It hides internal addressing during normal outbound connections, but access policies, stateful inspection and logging are still required to control traffic.
What is the difference between NAT and PAT?
NAT is the general process of changing IP address information, while PAT also uses transport-layer port numbers to distinguish connections. PAT is commonly called NAT overload in Cisco IOS configuration.
| Feature | NAT without overload | PAT or NAT overload |
|---|---|---|
| Translation value | IP address | IP address and port number |
| Public address use | Usually one address per active inside host | Many inside hosts share one address |
| Scalability | Limited by the public address pool | Supports many simultaneous sessions |
| Cisco IOS keyword | Pool or static mapping | overload |
| Typical use | Published servers or public address pools | User internet access |
PAT normally processes TCP and UDP port numbers. For ICMP traffic, devices can use identifiers and other state information to track separate flows because ICMP does not use TCP or UDP ports.
What do inside local and inside global mean?
Cisco NAT terminology describes an address based on where the host is located and how that address appears. The two terms most often used in CCNA labs are inside local and inside global.
| Cisco term | Meaning | Example |
|---|---|---|
| Inside local | Address of an inside host as seen on the internal network | 192.168.10.10 |
| Inside global | Address representing that inside host to the outside network | 203.0.113.2 |
| Outside global | Real public address of the outside host | 198.51.100.20 |
| Outside local | Outside host address as represented to the inside network | Usually 198.51.100.20 |
In most basic internet-access configurations, the outside local and outside global addresses are identical because the router is not translating the destination server.
Consider an HTTPS connection:
Before translation:
192.168.10.10:51514 -> 198.51.100.20:443
After PAT:
203.0.113.2:41001 -> 198.51.100.20:443The router records the mapping between 192.168.10.10:51514 and 203.0.113.2:41001. When the HTTPS reply returns to destination port 41001, the router checks its translation table and forwards the packet to 192.168.10.10:51514.
What types of NAT are used in IPv4 networks?
The main types are static NAT, dynamic NAT and PAT. Each method solves a different addressing requirement, so the correct choice depends on whether the mapping must be permanent and how many public addresses are available.
Static NAT
Static NAT creates a permanent one-to-one mapping between a private address and a public address. It is useful when an internal server must always use the same public representation.
ip nat inside source static 192.168.10.50 203.0.113.10The public address must be assigned or routed to the organisation. Static NAT alone does not safely publish a server; an ACL or firewall policy should permit only the required services.
Dynamic NAT
Dynamic NAT selects an available address from a configured public pool. A translation remains active while it is being used and eventually expires, so an inside host may receive a different public address later.
access-list 10 permit 192.168.10.0 0.0.0.255
ip nat pool PUBLIC_POOL 203.0.113.10 203.0.113.14 netmask 255.255.255.248
ip nat inside source list 10 pool PUBLIC_POOLIf all addresses in the pool are in use, another host cannot create a translation until an entry becomes available. Adding overload allows the pool addresses to be shared through PAT.
Port Address Translation
PAT changes source addresses and, when required, source ports. It is the most common option for outbound internet access because an interface address or small pool can support many internal sessions.
ip nat inside source list 1 interface GigabitEthernet0/1 overloadThe ACL used by this command identifies addresses eligible for translation. It is not acting as a packet-filtering ACL on an interface. For the filtering role of ACLs, see Cisco standard, extended and named ACL configuration.
How do you configure PAT on a Cisco router?
Configure IP addressing, mark the LAN and WAN interfaces, identify the inside source network, and enable overload on the internet-facing interface. A default route is also normally required so the router knows where to send internet traffic.
Use this lab topology:
LAN PC R1 ISP
192.168.10.10/24 G0/0 G0/1
Gateway .1 ---------- .1 .2 ------------- 203.0.113.1
Inside Outside
LAN: 192.168.10.0/24
WAN: 203.0.113.0/30Configure the router:
configure terminal
interface GigabitEthernet0/0
description LAN
ip address 192.168.10.1 255.255.255.0
ip nat inside
no shutdown
exit
interface GigabitEthernet0/1
description ISP-WAN
ip address 203.0.113.2 255.255.255.252
ip nat outside
no shutdown
exit
access-list 1 permit 192.168.10.0 0.0.0.255
ip nat inside source list 1 interface GigabitEthernet0/1 overload
ip route 0.0.0.0 0.0.0.0 203.0.113.1
end
write memoryThe wildcard mask 0.0.0.255 matches the complete 192.168.10.0/24 network. The overload keyword enables PAT, and the default route forwards destinations not found elsewhere in the routing table to the ISP next hop.
On the PC, configure:
IP address: 192.168.10.10
Subnet mask: 255.255.255.0
Default gateway: 192.168.10.1
DNS server: A reachable DNS resolverStudents who want to practise this workflow with routing, IPv4 addressing and verification can review the CCNA course.
How do you verify NAT and PAT on Cisco IOS?
Generate traffic from an inside host and inspect the translation table and statistics. Successful ping, DNS or HTTPS traffic should create entries when it passes from the NAT inside interface to the NAT outside interface.
Start with these commands:
show ip nat translations
show ip nat translations verbose
show ip nat statistics
show access-lists
show ip interface brief
show ip routeA PAT translation may look like this:
R1# show ip nat translations
Pro Inside global Inside local Outside local Outside global
tcp 203.0.113.2:41001 192.168.10.10:51514 198.51.100.20:443 198.51.100.20:443
udp 203.0.113.2:42002 192.168.10.20:53000 192.0.2.53:53 192.0.2.53:53Read the first row from left to right:
- The protocol is TCP.
- The inside global value is the router's public address and translated port.
- The inside local value identifies the original PC and source port.
- The outside service uses TCP port 443.
- Outside local and outside global are unchanged in this example.
show ip nat statistics reports the marked interfaces, active translations, pool details and hit or miss counters. If traffic is being translated, the hit count should increase.
In a lab, translations can be cleared before repeating a test:
clear ip nat translation *Use this command carefully on a production router because clearing active entries can interrupt user sessions.
How do you troubleshoot NAT when internet access fails?
Troubleshoot from the endpoint towards the internet instead of changing the NAT configuration immediately. Confirm local connectivity, routing and source matching before examining translation entries and return traffic.
1. Check the host configuration
Verify the IP address, subnet mask, default gateway and DNS server. First ping the router's LAN address:
ping 192.168.10.1If this fails, NAT is not yet the main problem. Check the VLAN, interface state, cabling, host subnet and gateway settings.
2. Check interface roles and status
show ip interface brief
show running-config interface GigabitEthernet0/0
show running-config interface GigabitEthernet0/1The LAN interface must contain ip nat inside, and the WAN interface must contain ip nat outside. Reversed or missing roles prevent the expected translation.
3. Check the NAT ACL
show access-lists 1Confirm that the ACL permits the actual source subnet. A wildcard mask error may exclude hosts or match an unintended range.
4. Check the route to the destination
show ip route 0.0.0.0
ping 203.0.113.1The router needs a route towards the internet, and the ISP next hop must be reachable. NAT may create a translation even when upstream routing is incomplete, so a translation entry alone does not prove end-to-end connectivity.
5. Generate traffic and inspect translations
show ip nat translations
show ip nat statisticsIf no entry appears, check the ACL, interface roles and whether the packet actually crosses the router. If an entry appears but no reply returns, investigate upstream routing, ISP reachability, filtering or the destination service.
6. Separate DNS failure from connectivity failure
Test a known reachable IP address before testing a hostname. If IP connectivity works but names fail, investigate DNS rather than NAT.
7. Use debugging only when necessary
debug ip nat
undebug allDebug output can be intensive on a busy router. Use it in a controlled lab or during an approved maintenance window, and disable it after collecting the required information. A structured approach is available in this layer-by-layer network troubleshooting guide.
What are the practical limits of PAT?
PAT has finite translation resources because each flow needs a unique mapping and consumes device memory. High session volumes, long-lived connections or exhausted port space can prevent new translations even when the interface remains operational.
Applications that embed IP addresses or ports inside their payload may also require protocol-aware handling. Inbound connections need an existing state entry, a static translation or port forwarding, plus the appropriate security policy.
NAT can also make troubleshooting and logging more difficult. Security teams may need the translated address, source port and timestamp to map an observed public connection back to the correct internal host.
Does IPv6 require NAT?
IPv6 is designed with a much larger address space, so ordinary internet access does not require IPv4-style address conservation through PAT. Networks normally use globally unique IPv6 addresses with routing and firewall policies controlling connectivity.
Translation mechanisms exist for specific IPv6 migration and multihoming cases, but they are not a direct reason to avoid proper IPv6 security controls. A firewall remains necessary even when every endpoint has a globally routable IPv6 address.
Frequently asked questions
Is PAT the same as NAT overload?
Yes. On Cisco IOS, NAT overload is the common configuration used to implement PAT, allowing multiple private hosts to share a public address by using different port mappings.
Does NAT provide firewall security?
Not by itself. NAT changes addressing information, while a firewall or ACL makes explicit decisions about which traffic is permitted or denied.
Can NAT work without a default route?
NAT can translate traffic without a default route, but the router still needs a route to the destination. Internet-edge routers commonly use a default route because maintaining every public route is unnecessary for a small customer network.
Why is the NAT translation table empty?
Dynamic NAT and PAT entries normally appear only after matching traffic crosses from an inside interface to an outside interface. Generate traffic, then check the NAT ACL, interface roles and route table if no entry appears.
Can two private hosts use the same source port with PAT?
Yes. The router can assign different translated source ports, producing unique public mappings even when both private hosts originally selected the same source port.
Summary
NAT changes IPv4 addresses, while PAT uses addresses and ports so multiple private devices can share limited public IPv4 space. A working deployment requires correct inside and outside roles, source matching, routing, translation state and return connectivity.
The best way to understand NAT is to build the topology, generate TCP, UDP and ICMP traffic, and interpret each field in the translation table.
*Reviewed by Network Rhinos networking trainers.*
To practise NAT, PAT, routing, ACLs and troubleshooting in guided Cisco labs, enquire about CCNA course batch details.
Related reading: Wireless Networking Basics for CCNA: SSIDs and WLCs