Timedora

4 NAT Configuration and Troubleshooting

Learn how NAT types map addresses and services, how to configure NAT interfaces and rules in Cisco IOS, and how to verify and troubleshoot translated traffic.

NAT roles and example network

(NAT) rewrites packet addresses as traffic crosses a router. The examples use an inside network of 192.168.10.0/24, with the router’s inside interface at 192.168.10.1; the outside interface connects to an ISP.

The example global addresses are from 198.51.100.0/24 and 203.0.113.0/24, ranges reserved for documentation. Replace them with addresses routed to the router in a real network. The router’s ISP route, interface names, and firewall policy must also match the network environment.

Mark the NAT interfaces

Identify the interfaces that face the inside network and the ISP. Apply ip nat inside to the inside interface and ip nat outside to the ISP-facing interface. The interfaces must also be up, and traffic must be routed through the NAT device.

Configure

gives inside host 192.168.10.10 a persistent mapping to global address 198.51.100.10:

The host uses the same global address through this one-to-one mapping. For inbound access, any applicable firewall or interface access-control list must allow the traffic, and the host must have a working return route through the NAT router.

Allocate addresses with

assigns an available address from a pool to an eligible inside host. In this example, standard ACL 10 selects source addresses for translation, and PUBLIC-POOL contains the available global addresses:

The ACL selects addresses for NAT; it is not a firewall rule controlling inbound access. A pool has a limited number of addresses, so additional hosts may not get a translation when all are in use. Keep pool addresses separate from statically assigned NAT addresses, and ensure the upstream network routes the pool to the NAT router. Unlike PAT, ordinary does not let multiple hosts share one pool address at the same time.

Publish a service with

publishes an inside service by mapping an outside address and port to the server’s local address and port. To publish the web server at 192.168.10.20:80 as 198.51.100.11:8080, configure a static TCP mapping:

Outside clients connect to 198.51.100.11 on TCP port 8080; NAT forwards the packets to the server on port 80. For a UDP service, use udp instead of tcp. Confirm that the server is listening and that network security rules permit the traffic. Cisco IOS also supports static port mappings using the outside interface address when appropriate for the design.

Compare NAT translation methods

PAT lets multiple hosts share an address by distinguishing connections with transport-layer ports. The NAT methods serve different needs: provides a persistent one-to-one mapping, allocates a global address from a pool, PAT shares an address, and publishes a particular inside service.

Verify translated traffic

Generate traffic that should match the rule, such as an outbound connection from an inside host or a connection from an outside test host to a forwarded service. Then inspect the translations and counters:

The translation table shows the protocol, inside-global and inside-local addresses, and—when entries are port-based—the ports. For an outbound flow, expect the inside host’s local address to be associated with its translated global address. For , expect a static entry mapping the advertised address and port to the server’s local address and port. Statistics help confirm that the correct interfaces and mappings are active.

Troubleshoot NAT step by step

Use a test flow and inspect translations and statistics to narrow down the problem.

  1. Check interface roles and status. Verify that the intended interfaces have ip nat inside and ip nat outside, are up, and carry traffic through the NAT device.

  2. Check rule matching. Confirm that the source ACL matches the inside host and subnet. A NAT ACL selects traffic to translate; it does not itself grant or deny access.

  3. Check routing in both directions. The router needs a route toward the outside network, and the ISP must route the global address or pool back to the NAT router. The inside server must return traffic through the expected gateway.

  4. Check pool availability and address conflicts. Ensure that the dynamic pool is large enough and does not overlap addresses used elsewhere or reserved for static mappings.

  5. For , test from outside. Check the public-side address, protocol, and port; verify the server’s listening port and any intervening firewall or ACL. Testing from inside may depend on hairpin-NAT support.

  6. Compare results before and after generating traffic. Use show ip nat translations and show ip nat statistics. If there is no translation, investigate rule matching, interface direction, and routing. If there is a translation but no working session, investigate return routing, filtering, and the destination service.