Cisco Certified Network Associate (CCNA) 200-301 · Free study guide

Objective 4.1 — Configure inside-source NAT

Network Address Translation rewrites address information at a defined boundary. Inside-source NAT translates the source identity of traffic originating on an inside network. Correct reasoning starts with address roles and traffic direction.

Address terminology

An inside local address identifies the inside host as it appears internally. An inside global address represents that host in the outside network. Static NAT binds those identities predictably. Dynamic NAT chooses an available inside- global address from a configured pool when matching traffic creates a translation.

These terms describe viewpoint, not whether an address is inherently private or public. A design commonly maps RFC 1918 inside-local addresses to public inside- global addresses, but the mechanism is broader than that convention.

Static translation

A static mapping provides a stable one-to-one relationship. It fits an inside service that must be represented consistently. The mapping alone does not permit traffic through every firewall, publish DNS, or ensure the server has a return route. Treat translation and security policy separately.

Dynamic pools

Dynamic NAT defines a pool of candidate global addresses and a match condition, commonly an ACL identifying eligible inside-local sources. When traffic crosses from an interface marked inside to one marked outside, a matching source can receive a pool address. A pool can exhaust, so monitor usage and size it from concurrent needs.

Dynamic NAT is not PAT unless ports are explicitly used to let many inside flows share one global address.

Interface roles and order

Mark the internal-facing interface as NAT inside and the external-facing interface as NAT outside. Define valid pool boundaries and prefix or mask, create a source match that does not capture unintended networks, then bind the translation rule. Routing must carry the packet to the boundary before NAT can process it.

IOS command map

Under the trusted-facing interface use ip nat inside; under the external-facing interface use ip nat outside. A one-to-one example is ip nat inside source static 10.10.20.15 198.51.100.15. For pooled translation, define an example pool with ip nat pool PUBLIC 198.51.100.100 198.51.100.109 netmask 255.255.255.0, match the approved sources with access-list 10 permit 10.10.20.0 0.0.0.255, and bind them with ip nat inside source list 10 pool PUBLIC. This is dynamic NAT, not overload, because no overload keyword appears.

Use show ip nat translations while generating matching traffic, show ip nat statistics for roles and counters, show access-lists 10 for match evidence, and the routing table for both sides. Documentation addresses in this lesson are synthetic; a real mapping requires addresses assigned and authorized for that network.

Worked scenario

Inside host 10.10.20.15 needs a permanent global representation 198.51.100.15; use a static inside-source mapping. Other hosts in 10.10.20.0/24 may use a dynamic pool .100–.109. Mark directions, match only that subnet, and verify translations under traffic. If eleven simultaneous hosts need addresses, the ten-address pool can exhaust.

Verification

Inspect NAT configuration, inside/outside interface roles, current translations, translation statistics, pool use, routing, and the matching ACL. Generate a specific flow and watch the expected entry form. Capture or inspect both sides where authorized to confirm source rewriting and return translation.

Common traps

• Reversing inside and outside roles.
• Calling dynamic NAT port overload.
• Using a broad ACL that translates unintended sources.
• Assuming NAT grants firewall permission.
• Checking configuration without generating matching traffic.

Readiness checklist

• I can identify inside-local and inside-global addresses.
• I can configure static and pooled translation.
• I can predict pool exhaustion.
• I verify state, counters, and both traffic directions.