TechKnowSurge
Cisco CCNA 4.1 Cisco CCNA 1.7
TechKnowSurge Catalog Videos DEMO: Static NAT
VideoNetworkFree

DEMO: Static NAT

Static NAT translates a single private IP address to a fixed public or routable IP address, enabling consistent, one-to-one address mapping on a Cisco router. This topic covers configuration, verification, and removal of a static NAT entry using Cisco IOS commands.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Static Network Address Translation creates a fixed, one-to-one mapping between a device's private inside local address and a routable inside global address. Unlike dynamic NAT or PAT, static NAT assigns the same global address to the same local address every time, making it suitable for devices that need to be consistently reachable from outside the local network. In the scenario covered here, a switch at 10.2.0.5 is mapped to the global address 10.240.3.3, which resides on an existing routable subnet, eliminating the need for additional routing configuration across the network. Configuration begins in global configuration mode on the router, where the inside and outside NAT interfaces are identified using the ip nat inside and ip nat outside interface-level commands. The static translation entry is then created with the ip nat inside source static command, binding the two addresses together. Once applied, the router immediately begins translating traffic, and the mapped address becomes reachable and responds to connectivity tests as expected. Verification is handled through show ip nat translations, which displays active static and dynamic entries including real-time ICMP session data, and show ip nat statistics, which provides cumulative translation counts and peak usage figures. The clear ip nat statistics command resets those counters without disrupting active translations. To fully remove a static NAT entry, the no form of the original command is entered and the router prompts to confirm deletion of all associated child entries.

What you'll learn

What's covered

Static NAT Configuration

Aligned to

Cisco CCNA
4.1 Configure and verify inside source NAT using static and pools
1.7 Describe private IPv4 addressing

Key terms

Network Address Translation
NAT
A method that maps private IP addresses to a public IP address, allowing multiple devices to share a single public IP.
Router
A network device that forwards data packets between networks based on IP addresses.
IP Address
A numerical label assigned to each device connected to a network that uses the Internet Protocol.
Inside Local Address
The private IP address assigned to a device on the internal network before NAT translation occurs.
Inside Global Address
The public or routable IP address that represents an inside device after NAT translation to the outside network.
Static NAT
A one-to-one mapping between a single inside local IP address and a single inside global IP address, configured with the ip nat inside source static command.

Transcript

The Network and the Translation

We're going to program one of our routers with static network address translation. This is my network right here, and I'm going to be setting up NAT translation on router 3.

I have this switch hanging off of this network, and the IP address of this switch is 10.2.0.5. That's considered my inside local address. I want to translate it to an inside global address of 10.240.3.3. This network right here is 10.240.3.0/29, so I actually have up to eight IP addresses in here — of course one of those is the broadcast.

I'm going to be doing the translation on router 3, and it's going to translate the switch to this address, 10.240.3.3. I have a few IP addresses in here that I can use: this interface on router 2 takes up .1, this interface on router 3 takes up .2, and now I'm going to use another address of .3. So I'm using 10.240.3.3 on this 10.240.3.0 network. I'm using this because then I don't have to set up any extra routing — all these devices already know how to get to this network, and when I assign this IP address, this translation, to it, then this router will start responding to it.

Configuring the Interfaces

So that's what I'm going to do: set up router 3. I'm going to jump onto router 3 here, and I'm going to start out by getting into the global configuration mode, and I'm going to configure the interfaces. The fa0/1 is the one that's attached to that switch, so I'm going to paste that into here, and that's the inside. Then I'm going to specify that serial 0/0/0 is the outside. I get a little n Bar there, and that's just because of insufficient memory on this device, but that's not going to hinder what we're doing right here.

Adding the Static NAT Statement

The next one I'm going to do is this ip nat statement. Right now I'm pinging 10.240.3.3, and you can see that I'm getting a response that the time to live expired in transit, and I'm getting that back from 10.240.3.2, which is router 3. So it probably created some sort of loop there: the time to live decremented down, and router 3 then responded and said the time to live has died, so it kills the packet.

Once I paste this into here, we should then start getting a response, and the response is actually going to come from 10.2.0.5, which is that switch. So I'm going to put this command in here, and immediately we start translating it and we've got translation. We've got ping down here, we're pinging that IP address at 10.240.3.3, which is, once again, that NAT translation.

Show Commands

Next what I'm going to do is type in a few show commands so we can see what's going on. I'll end out of here and I'm going to show ip nat, hit enter, and we can see that 10.240.3.3 is going to 10.2.0.5. So this right here is our static entry, although it's created this ICMP packet that's being translated back and forth, and you can see that it's coming from 10.1.10.34, so it's coming from the laptop — that's the laptop IP address there.

Now I'm going to do a show ip nat statistics, and this one right here shows us some information on the translations. Peak translation is two; we saw both of those translations there. It's gone on 971 times — we probably do this again and it counted up 1,005 times, because I'm continuously pinging this, so that's why it's going to keep counting up.

The next command I'm going to do is clear out the stats here, so clear ip nat statistics would be something that I could use to clear those out, and then I can show them again, and you can see that it started over. So that's that clear statement right there. There's some show commands that we can use to see what's going on.

Removing the Translation

If I want to remove this, of course I just remove it with the no statement. So I'm going to get into conf t and then I'll just put a no at the beginning, copy that, paste it into here, and then it will kill that connection. Do I want to delete all the child entries? Yes, I want to delete it all — and now it's gone.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →