Configuring NAT on Cisco IOS: static NAT, dynamic NAT, PAT and port forwarding

The building blocks

Network Address Translation lets hosts with private addresses reach public networks and lets you publish internal servers. The idea is covered in NAT: how many devices share one internet address; here the focus is Cisco IOS configuration. Every NAT configuration has the same parts:

1. Mark interfaces as ip nat inside (towards your LAN) or ip nat outside (towards the provider).
2. Say which addresses to translate: one address for static NAT, or an ACL for dynamic NAT and PAT.
3. Say what to translate them to: an address, a pool, or the outside interface.

The examples use LAN 192.168.1.0/24 on GigabitEthernet0/1 and a provider link on GigabitEthernet0/0, with public block 203.0.113.0/27 (a documentation range).

interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/0
 ip address 203.0.113.2 255.255.255.224
 ip nat outside

Static NAT and port forwarding

Static NAT permanently maps one inside address to one public address in both directions. Use it for a server that must be reachable on many ports, or a device that must always appear with the same public address.

ip nat inside source static 192.168.1.20 203.0.113.10

Port forwarding (static PAT) maps only one port, so one public address can serve several internal hosts on different ports. Here HTTPS on the router's own outside address goes to a web server:

ip nat inside source static tcp 192.168.1.30 443 interface GigabitEthernet0/0 443

Publishing a server makes it reachable from the internet, so also filter inbound traffic to just that port with an ACL or firewall, and keep the server patched.

Dynamic NAT and PAT

Dynamic NAT gives each inside host a public address from a pool while it is active. If the pool runs out, new hosts cannot connect, so it is uncommon today.

access-list 1 permit 192.168.1.0 0.0.0.255
ip nat pool PUBLIC 203.0.113.20 203.0.113.29 netmask 255.255.255.224
ip nat inside source list 1 pool PUBLIC

PAT, also called NAT overload, lets many hosts share one public address by tracking the source port of each connection. This is what nearly every office and home router does.

access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 interface GigabitEthernet0/0 overload

Adding overload to a pool configuration gives PAT across several public addresses. The ACL decides what is translated, so make it match exactly your internal ranges; a permit any can translate traffic you never meant to.

Verifying and troubleshooting

show ip nat translations
show ip nat statistics
clear ip nat translation *
debug ip nat

show ip nat translations lists each mapping with inside local, inside global, outside local and outside global addresses (and ports for PAT). show ip nat statistics shows the inside and outside interfaces, hits, misses and pool usage. If NAT does not work, check in order:

• Inside and outside are on the correct interfaces (swapping them is the most common mistake).
• The ACL matches the real source addresses of your hosts.
• The router has a route to the internet, and the provider routes the public addresses back to you.
• A dynamic pool is not exhausted (statistics show misses).
• For port forwarding, the server uses the router as its default gateway, so replies are translated back.

Real-world example: a dental practice moved its appointment server to a new address, 192.168.1.25, but patients could no longer book online. The router still had ip nat inside source static tcp 192.168.1.20 443 ... pointing at the old address. show ip nat translations showed the forward to .20, which no longer existed. Updating the static entry and clearing the translations restored bookings within a minute, and the practice added the NAT entry to its change checklist for server moves.