Name the addresses before the commands
- Inside local
- The address an inside host really has, usually private space such as 10.20.0.50.
- Inside global
- The public address that represents that inside host to the outside world after translation.
- Outside global
- The real address of a remote host, as it exists on the internet.
- Outside local
- How that remote host appears to inside hosts. With inside source NAT alone it equals the outside global address.
- ip nat inside / ip nat outside
- Interface roles. Translation only happens to traffic that crosses from one role to the other.
One-to-one, pool and overload
| Type | Mapping | Configured with | Translation entry |
|---|---|---|---|
| Static | One inside local to one inside global, fixed | ip nat inside source static | Exists as soon as it is configured, so outside hosts can open connections to the inside host |
| Dynamic (pool) | Each inside local borrows the next free pool address | ip nat pool plus an access list and a source list ... pool rule | Created by the host’s first outbound packet; removed when it times out |
| PAT (overload) | Many inside locals share one inside global, separated by port | The same rule ending in overload, on an interface or a pool | One entry per session, with the port printed after each address |
Address terms per Cisco’s NAT local and global terms note; PAT is the NAPT variant in RFC 3022.
All three on one edge router
Inside 10.20.0.0/24, outside 192.0.2.0/28 (documentation range)
interface GigabitEthernet0/0 ip address 10.20.0.1 255.255.255.0 ip nat insideinterface GigabitEthernet0/1 ip address 192.0.2.2 255.255.255.240 ip nat outside!! static: the web server is always 192.0.2.5 to the outsideip nat inside source static 10.20.0.50 192.0.2.5!! dynamic: inside hosts borrow 192.0.2.8 to 192.0.2.13access-list 1 permit 10.20.0.0 0.0.0.255ip nat pool PUBLIC 192.0.2.8 192.0.2.13 netmask 255.255.255.240ip nat inside source list 1 pool PUBLIC!! PAT alternative: replace the line above with this oneip nat inside source list 1 interface GigabitEthernet0/1 overloadKeep one dynamic rule per access list: the pool line or the overload line. The server keeps its static mapping either way, and everyone else uses the dynamic rule.
Verify in this order
Interface roles
show ip nat statisticslists the inside and outside interfaces. A swapped pair is the usual reason nothing translates.Access list hits
The list only selects which inside sources get translated. A host outside its range leaves with a private source address, and the internet does not route that back.
The translation table
show ip nat translationsshows static entries at once; dynamic and PAT entries appear only after an inside host sends traffic.Stale entries
After changing a rule,
clear ip nat translation *removes the dynamic entries so the new rule takes effect.Hand it to monitoring
Once translation works, a management station usually watches the edge router’s interfaces and alerts. How it polls the router and receives its traps, and how v3 secures that, is on SNMPv2c vs SNMPv3.
Frames on Static NAT, dynamic NAT, PAT
For each frame, label the inside local and inside global address first; the answer usually follows from those two.
Practice frames written by our editors for study, not Cisco items. The 200-301 exam itself mixes multiple choice, drag-and-drop and lab-style items.
Frame 001 of 007 · 0 answered · 0 ok
Keys
1–5 or A–E pick an option (on choose-N frames they toggle; then Check answer) · ← → previous / next frame · ↑ ↓ move in the frame list
- Frame 001 of 007
Which command is used to translate multiple local IP addresses to a single registered public IP address in NAT overload (PAT)?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
ip nat pool defines a range of public addresses for dynamic NAT; PAT to a single interface address needs no pool.
Note on B
The static form maps one inside address to one fixed global address and cannot share it among hosts.
Note on C
ip nat inside only marks an interface as the inside side; it translates nothing by itself.
Note on D
Correct: ip nat inside source list <acl> interface <intf> overload maps every host the ACL matches to one public address, using ports to tell them apart.
Best answer: D · why
PAT (NAT overload) needs three things: ip nat inside and ip nat outside on the interfaces, an ACL that matches the inside hosts, and ip nat inside source list 1 interface g0/1 overload (or pool <name> overload). The overload keyword lets many inside local addresses share one inside global address by using different source ports. Static NAT and pools without overload give one-to-one mappings.
- Frame 002 of 007
Which command is used to configure a static NAT translation for a web server with private IP 192.168.1.10 to be accessible from the internet using public IP 203.0.113.5?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
ip nat pool only defines an address range for dynamic NAT and needs a separate ip nat inside source list command to do anything.
Note on B
This is PAT for outbound traffic; it creates no permanent mapping that lets internet hosts reach the server.
Note on C
Correct: ip nat inside source static <local> <global> maps 192.168.1.10 to 203.0.113.5 permanently, so outside hosts can reach the server.
Note on D
The outside source form translates the addresses of outside hosts, and here the inside and outside roles are reversed.
Best answer: C · why
Static NAT creates a permanent one-to-one mapping, which is what makes an inside server reachable from outside. The command order is ip nat inside source static <inside local> <inside global>, so: ip nat inside source static 192.168.1.10 203.0.113.5. The interfaces also need ip nat inside and ip nat outside. Pools and overload are for dynamic outbound translation.
- Frame 003 of 007
What is the primary difference between Port Address Translation (PAT) and Static NAT?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: PAT is many-to-one, with hosts sharing an address and told apart by port, while static NAT is a fixed one-to-one mapping.
Note on B
PAT translates TCP and UDP ports (and ICMP query IDs), and static NAT translates addresses rather than ports.
Note on C
This swaps the two: static NAT is the one-to-one mapping, and PAT is the one that shares a single address.
Note on D
Direction is not the defining difference; static PAT entries can forward inbound ports, so PAT is not strictly outbound-only.
Best answer: A · why
Static NAT maps one inside local address to one inside global address permanently, so traffic can start from either side. PAT (NAT overload) maps many inside hosts to one public address and tracks each flow by its source port; it is how most networks share a single ISP address. Both work with TCP and UDP.
- Frame 004 of 007
What is the primary difference in IP address translation behavior between static NAT and dynamic NAT using a NAT pool?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Handing out addresses as they are needed is how dynamic NAT behaves; a static entry never changes.
Note on B
This reverses the two: the address pool belongs to dynamic NAT, while static NAT needs no pool.
Note on C
A mapping that never changes is static NAT; dynamic mappings are created on demand and time out.
Note on D
Correct: static NAT is a permanent one-to-one mapping, while dynamic NAT gives each inside host a free pool address when its traffic starts.
Best answer: D · why
Static NAT is configured one entry per host and never changes, which suits servers that must be reachable from outside. Dynamic NAT matches inside hosts with an ACL and gives each one a free address from a pool (ip nat pool). The mapping is still one-to-one while it lasts, but it is created on demand and released when it times out. Adding overload turns it into PAT.
- Frame 005 of 007
In a dynamic NAT configuration using a predefined pool, what happens when all the addresses in the NAT pool have been allocated and an additional internal host initiates a connection?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: without overload, each inside host needs its own pool address, so traffic from a host that cannot get one is not translated and is dropped.
Note on B
A dynamic mapping belongs to one inside host until it times out, so the router cannot lend it to another.
Note on C
Port overloading happens only when the overload keyword is configured, and this dynamic NAT setup has none.
Note on D
Every pool address is already in use, so there is nothing left to assign, randomly or otherwise.
Best answer: A · why
Dynamic NAT without overload is one-to-one: each inside host that starts traffic takes one free address from the pool. When every address is taken, the next host’s packets match the ACL but cannot be translated, so they are dropped until an existing translation times out or is cleared (clear ip nat translation). Adding overload, which turns it into PAT, avoids exhaustion by sharing addresses through ports.
- Frame 006 of 007
Inside host 10.1.1.10 opens a session to a web server at 198.51.100.20 on the internet. The edge router translates the host’s address to 203.0.113.25 on the way out and does not translate the server. In Cisco NAT terms, what is 203.0.113.25?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
The inside local address is the host’s own address as configured on the inside network, 10.1.1.10 here, not the translated one.
Note on B
Correct. 203.0.113.25 is the address that represents the inside host to the outside world, which Cisco calls the inside global address.
Note on C
Outside addresses belong to the remote host. The outside local address is how the web server appears to the inside, 198.51.100.20 here.
Note on D
The outside global address is the web server’s real address on the outside network, 198.51.100.20, not the translated inside host.
Best answer: B · why
Cisco’s NAT terms combine two words. Inside or outside says whose address it is: a host on our network or a remote host. Local or global says where the address is seen: on the inside network or on the outside network. The inside host’s configured address, 10.1.1.10, is inside local. The address that represents it after translation, 203.0.113.25, is inside global. The server is not translated, so its outside local and outside global addresses are both 198.51.100.20. Source: Cisco’s document on local and global NAT terms and RFC 3022.
- Frame 007 of 007
An engineer runs the command in the exhibit on the edge router R1 while three inside hosts browse to two web servers. Which type of NAT do the entries show?
R1# show ip nat translationsPro Inside global Inside local Outside local Outside globaltcp 198.51.100.7:51000 10.0.20.11:51000 203.0.113.80:443 203.0.113.80:443tcp 198.51.100.7:1024 10.0.20.12:51000 203.0.113.80:443 203.0.113.80:443tcp 198.51.100.7:52118 10.0.20.13:52118 192.0.2.53:443 192.0.2.53:443Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct. All three hosts map to 198.51.100.7, told apart only by port numbers, which is port address translation, also called NAT overload.
Note on B
Pool-based dynamic NAT gives each inside host its own inside global address. Here three hosts share 198.51.100.7, so ports must be in use.
Note on C
Static NAT maps one inside local address to one inside global address. Three hosts sharing one inside global cannot be one-to-one entries.
Note on D
The outside local and outside global columns match on every line, so the server addresses are not being translated at all.
Best answer: A · why
In ‘show ip nat translations’ each line lists the inside global, inside local, outside local and outside global address. Port numbers appear when port address translation is in use. Here three inside local addresses map to the same inside global address, 198.51.100.7, each on a different port, and the second host’s source port was changed because the first host already used 51000. That is PAT, configured with the overload keyword. Dynamic pool NAT and static NAT both keep a one-to-one address mapping, and identical outside columns show the servers are untouched. Source: Cisco’s local and global NAT terms document and RFC 3022 (NAPT).
NAT questions from the lab bench
Is PAT the same thing as NAT overload?
Yes. overload is the IOS keyword; the technique is port address translation, called NAPT in RFC 3022.
Can static NAT and PAT run on the same router?
Yes, and it is a common edge design: the server keeps its fixed public address for inbound connections while the other inside hosts share the outside interface address.
Why do inside hosts need NAT at all?
Their addresses come from the private ranges of RFC 1918, which internet routers do not carry. Without translation a reply has no route back, so the edge router swaps in a public address on the way out and reverses the swap on the way in.
Which address does the ISP see?
The inside global address. The inside local address never leaves the inside network.
What does the router do to the reply?
It reverses the swap. The reply arrives addressed to the inside global address; the router finds the matching entry and rewrites the destination to the inside local address before forwarding it inside.