Configuring Cisco

Using NAT


The hardest thing about NAT is understanding how to use the technology in real life. Tons of guide papers have been written, the Internet is full of gigabytes of information on the topic, yet the subject remains relevant. Truth is, 95% of absolute majority of people will only need to use just one of the two types of connections.

1) PAT (Port Address Translation)

A bunch of internal IP addresses are translated into a single external IP address when connecting to the outside world. While each packet destined to outside networks is being processed by a router or a Cisco ASA, the correlation of the actual internal IP address and port number of the source of the TCP connection is being remembered, which allows to correctly perform the reverse translation and transfer return packets.
This kind of NAT is used when you need to allow access from an internal network to external resources (such as the Internet).


2) Static NAT

This is translating addresses one-to-one. A specific public IP address is put together with an internal IP address. This kind of NAT translation is used when you need access from the outside world to a server or resource within the internal network or a DMZ.



If you need access from the internal LAN to the outside world, it is most likely that you will have to configure PAT.
If you need access from the outside world to a certain internal resource, then you will have to configure static NAT.

NAT configuration examples for the above cases

Cisco ASA (IOS below 8.3)

global (outside) 1 interface
nat (inside) 1

Static NAT
static (dmz,outside) interface netmask

The keyword interface in this code specifies the devices own IP address that is assigned to the external interface ( If the translation is being made into another IP address from the pool of IP addresses belonging to the external interface, then that address is specifically mentioned.

Cisco ASA (IOS above 8.3)

object-group network NET_LAN
nat (inside,outside) source dynamic NET_LAN interface

Static NAT
object network NAT_OUTSIDE_1.1.1.1
nat (dmz,outside) static interface

Cisco IOS Router

interface Ethernet X
ip address
ip nat inside
interface Ethernet Y
ip address
ip nat outside

ip nat pool POOL_PAT //No mistakes here. An external address is mentioned twice.
ip access-list standard ACL_PAT
permit ip
ip nat inside source list ACL_PAT pool POOL_PAT overload

Static NAT
interface Ethernet Z
ip address
ip nat inside
interface Ethernet Y
ip address
ip nat outside

ip nat inside source static interface Ethernet Y

This article includes only the simplest configuration examples for NAT translations, on purpose. More complex examples are covered in articles about basic Cisco router and Cisco ASA configurations.

Back to Table of contents

deltaconfig logo Personal Cisco tutor

1 Comment threads
0 Thread replies
Most reacted comment
Hottest comment thread
1 Comment authors
Wisam Recent comment authors
newest oldest most voted

Thanks Alex, I enjoyed your lesson very much… Great site.
looking forward to see a WLC basic configuration.


How can I help you?