Every home and office network you have used is almost certainly behind NAT. Understanding what NAT is, and the vocabulary around it, is worth marks on both CompTIA Network+ and Cisco CCNA, where you will be asked to explain it, configure it and troubleshoot it. This guide covers the three NAT types, the four-address terminology with a worked table, configuration and verification on Cisco IOS, how NAT relates to IPv6, the problems it causes, and the traps that cost points.
What does NAT actually do?
IPv4 has about 4.3 billion addresses, far fewer than the number of devices online. The workaround was to reserve private ranges that anyone can reuse inside their own network and to translate them at the edge. RFC 1918 reserves three of them (10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16); these addresses are not routed on the public internet, so a packet leaving the network with a private source address would never get a reply. See our guide to private IP address ranges for exact first and last addresses.
A NAT device sits at the boundary between the inside (private) and outside (public) networks. When an inside host sends a packet outward, the router replaces the private source address with a public one, records the mapping in a translation table, and forwards the packet. When the reply comes back to the public address, the router looks up the mapping, rewrites the destination to the private address and delivers it. NAT works at the boundary between Layer 3 and Layer 4, because PAT also touches TCP and UDP port numbers; revisit the TCP vs UDP guide if ports are unfamiliar. The defining standard is RFC 3022, which describes Basic NAT (address only) and NAPT (address and port).
Static NAT vs dynamic NAT vs PAT
Static NAT permanently maps one inside address to one public address, dynamic NAT assigns public addresses from a pool on demand, and PAT (overload) maps many inside hosts to one public address by rewriting port numbers. PAT is what home routers and most offices use.
| Type | Mapping | Permanent? | Public addresses needed | Typical use |
|---|---|---|---|---|
| Static NAT | One inside address to one fixed public address | Yes | One per mapped host | Servers that must be reachable from outside |
| Dynamic NAT | Inside addresses to the next free address in a pool | No; entries time out | Pool size limits concurrent hosts | Rare today; mainly teaching and some legacy designs |
| PAT (overload) | Many inside addresses to one (or a few) public addresses, distinguished by port | No; entries time out | As few as one | Home routers, offices, almost all internet access |
Static NAT and dynamic NAT are both “one-to-one”: at any moment, one public address represents exactly one inside host. PAT breaks that limit by also rewriting the source port. If two inside hosts both use source port 51234, the router assigns them different translated ports on the shared public address so that replies can be told apart. Port numbers are 16 bits, so a single address can hold tens of thousands of simultaneous translations (each tracked by protocol and port).
Port forwarding is a static PAT entry: it maps a specific public port to a specific inside address and port, for example public 203.0.113.5 TCP 443 to 192.168.1.50 TCP 443. It is how you host a service behind a single public address.
Inside local vs inside global: the four NAT address terms
Cisco terminology describes an address by two questions: which host is it (inside or outside), and from whose point of view is it seen (local or global)? Local means as seen from the inside network. Global means as seen from the outside network.
| Term | Whose address | Seen from | Example |
|---|---|---|---|
| Inside local | Inside host | Inside network | 192.168.1.10 (private) |
| Inside global | Inside host | Outside network | 203.0.113.5 (public) |
| Outside local | Outside host | Inside network | 198.51.100.20 (same as global unless outside NAT is used) |
| Outside global | Outside host | Outside network | 198.51.100.20 (the server's real address) |
The addresses in this article come from ranges reserved for documentation (203.0.113.0/24 and 198.51.100.0/24), so no real network is implied. Worked example: PC 192.168.1.10 browses to a web server at 198.51.100.20 through a router whose public address is 203.0.113.5.
| Step | Where the packet is | Source | Destination |
|---|---|---|---|
| 1 | PC to router (inside) | 192.168.1.10:51234 (inside local) | 198.51.100.20:443 (outside local) |
| 2 | Router to internet (outside) | 203.0.113.5:1024 (inside global) | 198.51.100.20:443 (outside global) |
| 3 | Server reply, internet to router | 198.51.100.20:443 | 203.0.113.5:1024 (inside global) |
| 4 | Router to PC (inside) | 198.51.100.20:443 | 192.168.1.10:51234 (inside local) |
Memory trick for the exam: inside local is what you configure on the PC; inside global is what the internet sees. For almost every question, the outside local and outside global are identical, because outside addresses are not translated.
How do I configure static NAT on Cisco IOS?
Every IOS NAT configuration has the same two ingredients: mark the interfaces, then define the translation rule. For static NAT:
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip address 192.168.1.1 255.255.255.0
R1(config-if)# ip nat inside
R1(config-if)# interface GigabitEthernet0/1
R1(config-if)# ip address 203.0.113.2 255.255.255.0
R1(config-if)# ip nat outside
R1(config-if)# exit
R1(config)# ip nat inside source static 192.168.1.50 203.0.113.50The mapping is installed immediately and stays in the table permanently, which is why show ip nat translations lists it even with no traffic. A static port-forward variant restricts the mapping to one protocol and port:
R1(config)# ip nat inside source static tcp 192.168.1.50 443 203.0.113.50 443How do I configure dynamic NAT?
Dynamic NAT needs three things: an ACL that says which inside addresses may be translated, a pool of public addresses, and the rule that ties them together.
R1(config)# access-list 1 permit 192.168.1.0 0.0.0.255
R1(config)# ip nat pool PUBLIC 203.0.113.10 203.0.113.14 netmask 255.255.255.0
R1(config)# ip nat inside source list 1 pool PUBLICThe pool above holds five addresses, so only five inside hosts can be online at once; a sixth gets nothing until an entry times out or is cleared. The ACL here selects which traffic gets translated; a permit means “translate this”, not “allow this through the firewall”. Mixing up those two meanings is one of the most common CCNA lab mistakes.
How do I configure PAT (NAT overload)?
The most common design: all inside hosts share the router's outside interface address.
R1(config)# access-list 1 permit 192.168.1.0 0.0.0.255
R1(config)# ip nat inside source list 1 interface GigabitEthernet0/1 overloadUsing the interface form is the right choice when the outside address is assigned by DHCP and can change. If you have a pool but fewer addresses than hosts, add overload to the pool rule instead:
R1(config)# ip nat inside source list 1 pool PUBLIC overloadThe only difference between dynamic NAT and PAT in the configuration is the word overload. That is also how exam questions test it: a scenario where “only the first few users can reach the internet” usually means the pool is exhausted and overload is missing.
Practice what you just read
Try NAT and IP services questions in the free CertSharp practice mode: 30 questions per session, no signup needed.
Check yourself
Check 1. Which NAT type lets 500 inside hosts share a single public IP address?
PAT (NAT overload). It tracks each connection by a unique source port on the one public address. Static and dynamic NAT map addresses one to one.
Check 2. Is 172.20.4.9 an address that NAT would typically translate on the way to the internet?
Yes. 172.20.4.9 falls in 172.16.0.0/12 (172.16.0.0 to 172.31.255.255), an RFC 1918 private range, and private addresses are not routable on the public internet.
Check 3. What is the term for the public address that represents an inside host to the outside world?
Inside global. The inside local address is the host's private address as seen inside the network.
How do I verify and troubleshoot NAT?
Verify NAT with show ip nat translations and show ip nat statistics, and check that the inside and outside interfaces are marked. The output below is illustrative, not captured from production equipment.
R1# show ip nat translations
Pro Inside global Inside local Outside local Outside global
tcp 203.0.113.5:1024 192.168.1.10:51234 198.51.100.20:443 198.51.100.20:443
tcp 203.0.113.5:1025 192.168.1.11:49822 198.51.100.20:443 198.51.100.20:443
--- 203.0.113.50 192.168.1.50 --- ---
R1# show ip nat statistics
R1# clear ip nat translation *
R1# debug ip natRead the first two rows as PAT: one inside global address (203.0.113.5) with two different ports serving two inside hosts. The third row, with no ports, is a static one-to-one entry. show ip nat statistics shows the interfaces marked inside and outside, the number of active translations, hits and misses, and pool usage, which is what you check first when a pool seems exhausted. Use clear ip nat translation * to flush dynamic entries after you change a rule; static entries remain. debug ip nat prints each translation as it happens, but use it carefully on a busy production router.
| Symptom | Likely cause |
|---|---|
| No translations appear at all | Missing ip nat inside/ip nat outside on an interface, or ACL does not match the inside subnet |
| Only the first few hosts work | Dynamic pool exhausted; add overload |
| Inside hosts work, but the public server is unreachable | Missing static NAT or port forward; return route or firewall blocks |
| Translations exist but no replies | Routing problem on the outside; ISP does not route the pool addresses to you |
| Works after a clear, then breaks again | Overlapping or stale entries; verify configuration and timeouts |
NAT64 and IPv6: how are they related?
IPv6 was designed so that each device can have a globally unique address, which removes the original reason for NAT: address shortage. Our IPv4 vs IPv6 guide explains the address format. NAT does not disappear in an IPv6 world, though, because the two protocols do not interoperate directly: an IPv6-only host cannot send packets to an IPv4-only server.
NAT64, defined in RFC 6146, is a stateful translator between the two. An IPv6-only client sends traffic to an address built from a NAT64 prefix plus the server's IPv4 address. The well-known prefix is 64:ff9b::/96 (RFC 6052), so IPv4 address 192.0.2.33 becomes 64:ff9b::c000:221. The NAT64 gateway extracts the IPv4 address, translates the packet and maintains state for the return path. It is usually paired with DNS64, which synthesizes AAAA records for names that only have an IPv4 address, so the client needs no change. Some mobile networks that run IPv6-only to the device use this model.
For the exams, keep three terms apart: dual stack runs both protocols side by side, tunneling carries one protocol inside another, and translation (NAT64) converts between them. Do not confuse NAT64 with PAT, which maps IPv4 to IPv4.
What problems does NAT cause?
NAT was a pragmatic fix, and it trades convenience for complexity:
- It breaks end-to-end addressing. An outside host cannot start a connection to an inside host without a static mapping or port forward, because there is no translation entry yet.
- Protocols that embed addresses in the payload fail. SIP/VoIP, active-mode FTP and some tunneling protocols place IPs and ports inside the data, where NAT does not look. Application layer gateways (ALGs), STUN or session border controllers repair this.
- Peer-to-peer and gaming suffer. Two hosts both behind NAT need NAT traversal techniques, and strict NAT behavior can block them.
- It adds state and breakage points. The router keeps a table that consumes memory, times out idle sessions and is lost on reboot, dropping active connections.
- Troubleshooting is harder. Logs show the translated address; correlating internal users with external events requires NAT logs.
- It interferes with some security protocols. IPsec in AH mode breaks because the address is part of the integrity check; ESP needs NAT traversal (NAT-T) encapsulation.
- It is not security. The unsolicited-inbound blocking is a side effect of having no translation entry. Add a stateful firewall.
What is CGNAT?
Carrier-grade NAT (CGNAT, also called large-scale NAT) is NAT run by the ISP. Instead of giving each subscriber a public address, the ISP gives the customer router an address from a shared range and translates many customers onto a pool of public addresses. This creates two levels of NAT: the home router translates to the ISP's shared address, and the ISP translates again to a public address.
RFC 6598 reserved 100.64.0.0/10 (100.64.0.0 to 100.127.255.255, about 4.2 million addresses) as shared address space for exactly this purpose. It is deliberately different from RFC 1918 so that it does not collide with a customer's own private network. If your router's WAN address starts with 100.64 through 100.127, you are probably behind CGNAT, and inbound port forwarding will not work unless the ISP offers a public address option. IPv6 avoids the whole issue, which is one reason ISPs deploy it.
Network+ and CCNA exam traps
The most common NAT mistakes are treating the NAT ACL as a filter, forgetting the inside and outside interface commands, and omitting overload. The full list:
- NAT ACL is not a filter. In a NAT rule, the ACL identifies the addresses to translate. It does not block anything.
- Forgetting inside/outside. A perfect rule and ACL do nothing without
ip nat insideandip nat outsideon the interfaces. - Overload word. Dynamic NAT with a pool but no
overloadexhausts quickly. PAT = overload. - Local vs global. Inside local is the private address, inside global is the public one. Outside local usually equals outside global.
- Static NAT is bidirectional and permanent. It allows inbound connections, which is why it is used for servers.
- NAT is not encryption and not a firewall. Questions that ask which technology “hides” internal addresses can have NAT as the answer; questions that ask about security controls do not.
- Which address ranges are private? 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. 172.32.x.x and 192.169.x.x are public.
- PAT is also called NAT overload, NAPT, and sometimes just “NAT”. In real life, “NAT” usually means PAT.
- CompTIA vs Cisco depth. Network+ asks you to identify the NAT type and purpose. CCNA asks you to write and read the configuration and output. See Network+ vs CCNA.
NAT also builds on subnetting and VLAN knowledge: the private ranges you translate come from your subnet plan, and each VLAN maps to a subnet that the NAT ACL must cover. Quick references live in the CCNA cheat sheet and the Network+ cheat sheet.
NAT practice questions with answers
Answer each one before you open it. For a timed bank, use the CCNA practice exam or the Network+ practice exam.
1. A company has 200 PCs on 10.0.0.0/24 and one public IP address from its ISP. Which NAT feature is required?
PAT (overload). With one public address, only port translation can multiplex 200 hosts. Static NAT and dynamic NAT without overload would run out of addresses after one host.
2. A web server at 192.168.1.50 must be reachable from the internet at 203.0.113.50 all the time. Which type of NAT fits?
Static NAT: a permanent one-to-one mapping in both directions, configured with ip nat inside source static 192.168.1.50 203.0.113.50. Dynamic NAT would hand out whichever address is free from a pool and so would not guarantee the server's public address.
3. In the output of show ip nat translations, which column holds the private address of the inside host?
Inside local. Inside global holds the translated public address. Outside local and outside global describe the destination host.
4. Which two commands are mandatory on the interfaces for a Cisco router to perform NAT?
ip nat inside on the interface facing the private network and ip nat outside on the interface facing the public network. Without them the router does not know the direction of translation, even if the NAT rule and ACL are correct.
5. You configured PAT but no host can reach the internet and show ip nat translations is empty. The ACL is access-list 1 permit 192.168.10.0 0.0.0.255, but the hosts are on 192.168.20.0/24. What is wrong?
The ACL used to select traffic for translation does not match the hosts. The NAT ACL defines which inside source addresses may be translated, and it is not a firewall filter. Correct it to permit the 192.168.20.0 network, using a wildcard mask of 0.0.0.255.
6. An ISP assigns a customer router the WAN address 100.72.15.3. What does this indicate?
100.72.15.3 is in 100.64.0.0/10, the shared address space for carrier-grade NAT (RFC 6598). The ISP translates the customer, so the customer has no public IPv4 address and cannot use inbound port forwarding without an ISP option.
7. Which technology allows an IPv6-only client to reach an IPv4-only web server?
NAT64 (RFC 6146), usually paired with DNS64 so that the client receives a synthesized IPv6 address that embeds the server's IPv4 address. Dual-stack would give the client both protocols and tunneling carries one protocol inside another, neither of which translates between them.
8. A VoIP phone behind a PAT router registers fine but calls have one-way audio. Which NAT-related cause is most likely?
The SIP and RTP traffic carries private IP addresses and ports in the payload, which NAT does not rewrite, so the remote end sends media to an unreachable private address. Fixes include a SIP-aware ALG, STUN or a session border controller, and a static port forward for the media range. This illustrates NAT breaking end-to-end addressing.
Frequently asked questions
What is NAT and why is it used?
Network Address Translation (NAT) rewrites IP addresses, and often port numbers, in packets as they cross a router or firewall. It is used mainly so that many hosts with private RFC 1918 addresses can share a small number of public IPv4 addresses, which stretched the IPv4 address space. It also hides internal addressing from the outside, although that is a side effect and not a security control.
What is the difference between NAT and PAT?
Classic NAT maps one inside address to one outside address, so the number of simultaneous users is limited by the number of public addresses. PAT (Port Address Translation, also called NAT overload or NAPT) maps many inside addresses to one outside address by using a different source port for each connection, so thousands of hosts can share one public IP. On Cisco IOS it is configured with the overload keyword.
What are inside local, inside global, outside local and outside global?
Inside local is the address of an inside host as seen on the inside network, typically private. Inside global is that same host as seen from the outside, typically its public address. Outside global is the real address of an outside host. Outside local is the outside host as it appears to inside hosts, which is the same as outside global unless you also translate outside addresses.
Does IPv6 use NAT?
Not for address conservation. IPv6 has so many addresses that every host can have a globally unique one, and the design assumes end-to-end addressing. NAT still appears in IPv6 networks in the form of NAT64, which lets IPv6-only clients reach IPv4-only servers (RFC 6146), and in some prefix translation setups, but it is not a replacement for a firewall.
What is CGNAT?
Carrier-grade NAT is NAT performed by an internet service provider so that many customers share a pool of public addresses, so the customer router itself gets an address from the ISP that is not public. The IANA-reserved shared address space 100.64.0.0/10 (RFC 6598) exists for this. Customers behind CGNAT usually cannot receive inbound connections or use port forwarding.
Does NAT break any applications?
NAT breaks the end-to-end principle, so protocols that embed IP addresses in the payload or need inbound connections can fail without help: SIP and VoIP, active-mode FTP, IPsec in some modes and peer-to-peer or game traffic. Application layer gateways, STUN, port forwarding, UPnP and NAT traversal techniques exist to work around this.
Is NAT a firewall?
No. NAT with PAT does happen to block unsolicited inbound connections, because the router has no translation entry for them, but that is a side effect and not an intentional security policy. A stateful firewall with explicit rules is the real security control. Exams distinguish between the two.
How we wrote and checked this
CertSharp is a practice-exam provider, so we have a commercial interest in exam preparation. This guide was built from RFC 3022, RFC 2663, RFC 6146 and RFC 6598 and Cisco documentation. The IOS configurations follow vendor syntax and the show output is illustrative, not captured from production equipment. Address math, including the NAT64 example and the CGNAT range, was verified with a script. Last reviewed on October 18, 2026. Confirm exam objective wording on the Cisco and CompTIA pages.
Sources and further reading
- RFC 3022: Traditional IP Network Address Translator
- RFC 2663: IP Network Address Translator Terminology and Considerations
- RFC 1918: Address Allocation for Private Internets
- RFC 6146: Stateful NAT64
- RFC 6052: IPv6 Addressing of IPv4/IPv6 Translators
- RFC 6598: IANA-Reserved IPv4 Prefix for Shared Address Space
- Cisco: Network Address Translation (NAT) FAQ
- Cisco Learning Network: CCNA 200-301 exam topics
- CompTIA Network+ certification page
Practice NAT questions before exam day
30 free questions per session on Network+ and CCNA, practice mode, no signup and no credit card. The full 500-question bank with exam mode is $11.99 lifetime per certification, or $9.99/month Pro unlocks every CertSharp certification.