5.1.3. NAT Configuration

Static NAT Configuration: One-to-one mapping between inside local and inside global.

Router(config)# ip nat inside source static 192.168.1.10 203.0.113.10
Router(config)# interface GigabitEthernet0/0
Router(config-if)# ip nat inside
Router(config)# interface GigabitEthernet0/1
Router(config-if)# ip nat outside

Dynamic NAT (Pool) Configuration: Uses a pool of public addresses, assigned first-come-first-served.

Router(config)# ip nat pool MYPOOL 203.0.113.10 203.0.113.20 netmask 255.255.255.0
Router(config)# access-list 1 permit 192.168.1.0 0.0.0.255
Router(config)# ip nat inside source list 1 pool MYPOOL

PAT (NAT Overload) Configuration: Many-to-one translation using port numbers to distinguish connections.

Router(config)# access-list 1 permit 192.168.1.0 0.0.0.255
Router(config)# ip nat inside source list 1 interface GigabitEthernet0/1 overload

Verification:

Router# show ip nat translations
Router# show ip nat statistics
Router# clear ip nat translation *

Inside vs outside: ip nat inside goes on the interface facing the private (LAN) hosts and ip nat outside on the interface facing the ISP. Translation happens only for traffic crossing from an inside interface to an outside one (and back), so swapped markings mean no translations are ever created. In the interface ... overload form, the interface named is the outside one whose address the hosts share.

Reading the output: show ip nat translations lists every live mapping (inside local, inside global, outside local, outside global). show ip nat statistics shows only counters (active translations, hits, misses) and which interfaces are inside and outside. Many inside local addresses sharing one inside global address with different port numbers is PAT; dynamic NAT gives each inside local its own inside global from the pool; static NAT entries are permanent one-to-one mappings.