4.1NAT and PAT

Global IPv4 addresses are exhausted, and assigning an individual public address to every device inside a company is impractical. Internally, therefore, we use RFC 1918 private addresses and translate them to public addresses via NAT on the border router that faces the internet. CCNA does not test rote "what is NAT"; it tests the practical judgment of which of static, dynamic, or PAT to choose for a given requirement (how many hosts exit through how many public addresses) and of isolating a fault from a misconfiguration or the translation table.

4.1.1NAT terminology (inside local / inside global)

• inside local is the address of an internal host as seen from inside (typically a private address, e.g., 10.1.1.10). inside global is the address of that same internal host as seen from outside (the post-NAT public address, e.g., 203.0.113.10). Remembering "local = the inside viewpoint" and "global = the outside viewpoint" prevents confusion.
• A precondition for NAT to work is that the internal-facing interface must carry ip nat inside and the external (internet-facing) interface must carry ip nat outside. If this inside/outside designation is swapped or omitted, no translation occurs at all even when the translation rules themselves are correct.

4.1.2Choosing static / dynamic / PAT

• Static NAT maps one internal address to one public address in a fixed one-to-one manner. Use it for a server that must always be reachable from outside at the same public address (e.g., a published web server). Example: ip nat inside source static 10.1.1.10 203.0.113.10.
• Dynamic NAT dynamically and temporarily assigns a free address from a pool of public addresses to an internal host (one-to-one in principle). More simultaneous connections than the pool size cannot be served. Example: ip nat pool P1 203.0.113.1 203.0.113.30 netmask 255.255.255.224 plus ip nat inside source list 1 pool P1.
• PAT (Port Address Translation, overload) collapses many internal hosts onto one (or a few) public addresses in a many-to-one fashion, distinguishing them by source port number. This is the typical internet connection for home routers and small/medium businesses. Example: ip nat inside source list 1 interface g0/0 overload. The keyword overload is the marker of PAT.

Suppose you are the engineer building the border router for a small business, tasked with connecting about 80 internal PCs to the internet through a single public address assigned by the ISP. Static NAT is a fixed one-to-one map, so 80 PCs would need 80 public addresses—unsuitable; dynamic NAT can serve only as many simultaneous sessions as there are pool addresses, so a single address lets only one PC communicate—also unsuitable. To let 80 PCs egress simultaneously through one public address, PAT (overload), which distinguishes each session by source port number and collapses them many-to-one, is the only appropriate choice. Configure ip nat inside on the internal LAN side, ip nat outside on the ISP-facing WAN interface g0/0, build an ACL selecting what to translate (e.g., access-list 1 permit 10.1.1.0 0.0.0.255), and apply ip nat inside source list 1 interface g0/0 overload. If a "PCs cannot reach the internet" fault then occurs, the standard move—before blindly rewriting config—is to check show ip nat translations to see whether translation entries are being created. If no entries appear at all, the cause is usually a missing or swapped ip nat inside / ip nat outside, or an ACL that does not match the internal segment. Conversely, if entries exist but return traffic never arrives, suspect the default route toward the ISP or upstream reachability. Isolating the fault starting from the translation table as real data is the CCNA way to troubleshoot.

4.1.3Section summary

• NAT translates internal private addresses to public addresses. inside local = the private address from the inside viewpoint / inside global = the translated public address
• Static = fixed one-to-one (published servers) / dynamic = assigned from a pool / PAT (overload) = many-to-one by port number. Only PAT lets many hosts egress via one public address
• The internal interface needs ip nat inside and the external one ip nat outside. Troubleshoot by checking whether translation entries exist via show ip nat translations