3.7Time synchronization and address translation

Time synchronization and address translation look unglamorous, yet they are the foundation that makes fault investigation possible at all. Correlating syslog across devices to trace causality requires every clock to agree. NAT, meanwhile, is central to internet connectivity and produces directional faults—"nothing gets translated," "only return traffic fails"—demanding the ability to reason backwards from symptom to a missing configuration line. This section builds the skill of reading the difference between a healthy and an unhealthy picture in two outputs: show ntp status and show ip nat translations.

3.7.1NTP hierarchy and sync state

• NTP (UDP 123) expresses distance from the reference with a hierarchy number called the stratum. Stratum 0 is the reference clock itself (GPS, atomic clock), stratum 1 is a server directly attached to it, and the value increases by one per synchronization hop. Stratum 16 means "unsynchronized (invalid)", so seeing it tells you the time cannot be trusted.
• Configure an upstream with ntp server <ip>, act as a reference yourself with ntp master <stratum>, and prevent tampering with ntp authenticate plus key configuration. Verify with show ntp status—checking for Clock is synchronized, the stratum value, and the reference (sync source)—and with show ntp associations for the candidate list and the selected source (marked *).
• Common pitfalls: synchronization takes time (on the order of minutes), and the time zone setting (clock timezone) is separate from synchronization. If NTP is healthy but the displayed time is off by nine hours, the problem is the time zone. Also, configuring service timestamps log datetime msec localtime show-timezone to include milliseconds and time zone in syslog makes cross-device correlation far easier.
• PTP (Precision Time Protocol, IEEE 1588) achieves sub-microsecond accuracy using hardware timestamping. Topped by a grandmaster, it combines boundary clocks (segmenting and redistributing) and transparent clocks (correcting for transit delay while forwarding). Choose it where milliseconds are not enough: financial trade records, industrial control, broadcast. For ordinary device-log correlation, NTP suffices.

3.7.2The four NAT address types

• Understand NAT terminology as the cross product of "which side is the host on (inside/outside)" and "from which side is it named (local/global)." Inside local is the inside host's real address (the inside as seen from inside), inside global is how that inside host appears externally (the inside as seen from outside, i.e. the translated public address), outside global is the outside host's real address, and outside local is how the outside host is presented to the inside (usually identical to outside global).
• The variants are static NAT (a fixed one-to-one mapping, used when external users must reach a specific server), dynamic NAT (assigning free addresses from a pool, where pool exhaustion makes new connections fail), and PAT (overload), which multiplexes many inside hosts onto one global address using port numbers. Adding overload, as in ip nat inside source list 1 interface GigabitEthernet0/0 overload, turns it into PAT.
• The most common omission is designating the interface roles. Translation happens only when a packet crosses from an interface marked ip nat inside to one marked ip nat outside. Even with a perfect ACL and pool, forgetting either designation means no translation occurs at all and show ip nat translations stays empty. This is the classic cause of "I configured it but nothing is translated."

One day a branch reports that "only some hosts cannot reach the internet." As a starting point you try to correlate syslog across devices, but the router and firewall logs are about seven minutes apart, so causality cannot be traced. Running show ntp status, the router reads Clock is synchronized, stratum 4 (healthy) while the firewall reads stratum 16. Stratum 16 means unsynchronized—the time is invalid—so until you fix it the investigation itself cannot proceed. After confirming reachability to the upstream NTP server and that UDP 123 passes, you configure ntp server correctly, wait a few minutes, and it flips to Clock is synchronized, aligning the logs so correlation works. Deciding "it is only a clock skew, deal with it later" means stacking inferences without the prerequisite for investigation and takes longer overall. With clocks aligned, the logs show that traffic from the failing hosts is not being translated at the router. show ip nat translations lists entries for the working hosts, but the number of translations stops growing past a certain point. The configuration reads ip nat inside source list 1 pool BRANCH_POOL—dynamic NAT without overload. More hosts tried to reach outside simultaneously than there are global addresses in the pool, so the pool exhausted and no new translation could be created, and only the hosts that connected later failed. Adding addresses to the pool is one answer, but with a limited allotment of global addresses the root fix is to add overload and make it PAT. PAT multiplexes on port numbers, letting one global address serve many inside hosts. Note that if the symptom had been not "only some hosts" but "no host is translated at all," the suspects would be entirely different: show ip nat translations would be completely empty, and the cause would not be pool exhaustion but a missing ip nat inside or ip nat outside designation, or an ACL that does not match the intended traffic. The breadth of the symptom—some versus all—directly tells you which layer to suspect, and that is the pattern for NAT troubleshooting.

3.7.3Section summary

• NTP increments the stratum per hop and 16 means unsynchronized; judge by Clock is synchronized in show ntp status, and note the time zone is a separate setting
• PTP (IEEE 1588) reaches sub-microsecond accuracy with hardware timestamping; NTP suffices where millisecond accuracy meets the need
• In NAT, inside local is the internal real address and inside global the translated public one; both ip nat inside and outside are required, and overload makes it PAT (port multiplexing)