TechKnowSurge
Cisco CCNA 4.1
TechKnowSurge Catalog Videos DEMO: Dynamic NAT and PAT
VideoNetworkFree

DEMO: Dynamic NAT and PAT

This content covers how to configure Network Address Translation (NAT) and Port Address Translation (PAT) on a Cisco router, including creating NAT pools, access lists, and interface assignments. Verification commands such as show ip nat translations and clear ip nat translation are also demonstrated.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Network Address Translation is configured on a Cisco router by defining three core elements in global configuration mode: a NAT pool specifying the range of routable outside addresses, a numbered access list identifying the inside network whose traffic should be translated, and an ip nat inside source statement that links the access list to the pool. Each router interface must then be labeled with either ip nat inside or ip nat outside to establish the translation boundary. In the demonstrated topology, Router 2 serves as the translation device, converting traffic originating from the 10.2.0.0 network into addresses drawn from a pool in the 10.240.2.0 range. With standard dynamic NAT in place, each inside host that initiates a session consumes one address from the pool for the duration of that session, which limits the number of simultaneous translated connections to the size of the pool. Converting the configuration to Port Address Translation requires only one modification: appending the overload keyword to the existing ip nat inside source command. PAT allows many inside hosts to share a single outside IP address by tracking individual sessions through unique port number assignments, substantially increasing the scale of address translation without requiring additional public IP addresses. Several IOS commands support ongoing verification and management of the translation table. The show ip nat translations command displays active entries, including the protocol, inside local address, inside global address, and corresponding outside address. The verbose option provides additional session detail. The clear ip nat translation command removes dynamic entries from the table, with options to clear all dynamic translations at once or target specific protocols, inside addresses, or outside addresses individually.

What you'll learn

What's covered

NAT & PAT Configuration

Aligned to

Cisco CCNA
4.1 Configure and verify inside source NAT using static and pools

Key terms

Network Address Translation
NAT
A method that maps private IP addresses to a public IP address, allowing multiple devices to share a single public IP.
Access Control List
ACL
A set of rules that defines which users or systems are granted or denied access to a resource.
Port
A logical endpoint for communication in a network, identified by a number that specifies a particular service or application.
Port Address Translation
PAT
A form of NAT that maps multiple devices on a private network to a single public IP address by differentiating each connection using unique source port numbers. PAT is the most common NAT implementation and is what enables an entire home or office network to share a single public IP address.
IP NAT Pool
A named range of public IP addresses configured on a Cisco router that are available for dynamic NAT translations.
Wildcard Mask
A 32-bit mask used in ACL statements and OSPF network commands where a 0 bit means the corresponding address bit must match and a 1 bit means it can be anything. Wildcard masks are the inverse of subnet masks and allow a single statement to match an entire range of IP addresses.

Transcript

Setting Up the Translation

This is my network, and this time let's go ahead and set up router 2 to be the translation device. What we're going to do is translate traffic from this network right here — this is going to be the inside network — but we're just going to translate the traffic from the 10.2.0.0 network, and we're going to translate it to everything on this side of the network. So let's see what the commands look like on router 2.

To see if it's working, I'm going to generate traffic from this switch and it's going to go to the demo laptop, and we're going to test to see if it's working by using Wireshark. Here's Wireshark, and it's seeing the different frames coming into it. Let's go ahead and generate a ping from the switch and see what happens. I'm going to pull up that switch and generate some traffic, and there you can see it immediately pops up, and you can see it's coming from 10.2.0.5. So the traffic is going back and forth and it's coming from the address we would expect it to, which is the IP address of that switch.

Creating the Pool

Now let's do the NAT translation. What I'm going to do is jump on router 2, and I've got to get into the global configuration mode.

The first thing I'm going to do is create a pool. The pool name is Andy — I just came up with this as the name, so you can see that it's whatever we want to name it, so I called it Andy. You start out with the beginning address, so I'm going to use 10.240.2.3. That's the network that — let me pull up my diagram here — that's this interface on this side right there. So I'm going to specify three addresses: 10.240.2.3, .4 and .5. This specifies the last address, so it's a range from this address to this address. I've got to specify the network mask, so here's the network mask right here.

Let's get that onto our router first. This is the pool, so I'm going to copy that and paste it into here.

The Access List

The next thing that I'm going to do is this access list right here. We haven't got into access lists, but we are defining the access list. We give it a number, so this is number 1. We'll just use the word permit — there's a permit and a deny, but for this purpose we'll just use permit. And we are going to do everything from that last site, so 10.2.0.0, that's the server site. Then we give it a wildcard mask, which is 0.0.255.255, meaning any host in this network. This is the network bits and this is the host bits.

So let's go ahead and get that access list entered in there. I'm going to paste it into here, and there we go.

The ip nat Statement

The next thing that I'm going to do is the ip nat statement. This is the thing that we've already been going over, that we should be somewhat familiar with. It starts out with ip nat inside source, and then the source is list 1. That's referencing this, that's the inside addresses or the local addresses. And then it's going to pool Andy, so these are the global addresses. So we have the local addresses and the global addresses. I'm going to copy that and we'll paste that into here.

Then I'm going to get into the interfaces. So s0000 would be — let me pull up this diagram again — this interface right here, that's the inside, so that's what I'm translating from. And I'm going to the outside, so that's what I'm translating to. I'm going to copy this and put that in there, and then I'm also going to copy this and paste that into there. I get a few errors — that's expected, it's just because of the amount of resources on this device, which is unfortunate.

Verifying It

Now let's generate our traffic again and see what address it's coming from. I'm going to generate that traffic, and we see that now it's coming from 10.240.2.3. That is in the range, so we have now successfully translated: traffic from this switch right here is going to this router, being translated at the router, and then being sent into this network right here. So we are good to go there.

There are a few commands we can use to see what's happening here. I'm going to do a show ip nat translation, and I do need to get into the privileged exec mode, so now I can do show ip nat translation and hit enter. Not surprisingly, there's the entry right there, the entry for that machine, and we've got ICMP, so that all makes sense with what we've seen before.

I'm going to do a show ip nat translation verbose, and this just gives us a little more information on that.

I can do clear ip nat translation. We've seen this before, but I'm just going to do a question mark so we can see what else we have — and I do need to type it in right, translation, so question mark. We can clear all dynamic translations, or we can choose specific TCP or UDP, or inside or outside. So there are a few selections that we have here that we could actually enter into this. And if I wanted to do everything, then I could do these stars, so we're going to delete everything, and that kind of resets that. So those are just some commands that I can use.

From NAT to PAT

The last thing that I'm going to do: at this point in time it's a network address translation, so if I generated any more traffic from that network, it would take up the next address in the range. So rather than 10.240.2.3, the next one would be 10.240.2.4, so it would take up that.

But let's say I want to do PAT, the port address translation. That would stretch this out from just being able to have three devices from that network be translated, to having tons of devices being able to be translated. The only thing we need to do is the same set of commands here, except we add overload to the end of it. So I'm going to copy this — we have to be in the global configuration mode for it — and enter that in, and now at this point in time it will do the port address translation. So it's all the same commands, except it's just this last overload on it that turns it into a port address translation instead of a network address translation.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →