Network address translation exists because RFC 1918 private addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) cannot appear on the Internet, yet the hosts using them must reach it. A NAT router rewrites the IP header at the boundary — source addresses outbound, destination addresses on the return — maintaining a translation table so replies find their way back. Cisco's terminology divides the world into inside/outside and local/global: an inside local address (10.1.1.10, the host's real address) maps to an inside global address (203.0.113.5, how the Internet sees it).
The three flavours
- Static NAT — one-to-one, permanent, bidirectional: 10.1.1.10 is 203.0.113.5, and unsolicited traffic to 203.0.113.5 reaches the server. This is how inside services are published.
- Dynamic NAT — a pool of public addresses handed to inside hosts first-come-first-served; historical curiosity more than practice, since it still needs one public address per simultaneous host.
- PAT / NAT overload — many-to-one: every inside host shares one public address (often the interface's own), sessions distinguished by translated source port. Tens of thousands of sessions per address; this is the NAT in every home router and most enterprise edges.
ip nat inside source static 10.1.1.10 203.0.113.5access-list 10 permit 10.1.0.0 0.0.255.255ip nat inside source list 10 interface gi0/0 overloadinterface gi0/1 ip nat insideinterface gi0/0 ip nat outsideR1# show ip nat translationsPro Inside global Inside local Outside globaltcp 203.0.113.1:51442 10.1.1.20:51442 142.250.77.46:443
What NAT breaks
NAT's price is the end-to-end principle: the address a host believes it has is not the address the world sees. Protocols that embed addresses in their payload — FTP active mode, SIP, some legacy VPN traffic — need application layer gateways to rewrite the payload too, and ALGs are a rich source of weird faults (the first troubleshooting step for broken SIP through NAT is often disabling the SIP ALG). Inbound connections need explicit port forwarding. Overlapping address space between merged companies needs double NAT. And the security folklore needs correcting: NAT is not a firewall — the statefulness incidentally blocks unsolicited inbound, but policy belongs to an actual firewall; NAT's job is address economics.
Troubleshooting order
- Is the traffic routed to the NAT router at all? NAT cannot translate what never arrives.
- Are ip nat inside / outside on the right interfaces? The most common silent failure.
- Does the ACL selecting translation traffic actually match — and never match traffic that must not be translated (VPN-bound packets being PATted is the classic site-to-site killer)?
- show ip nat translations / statistics — are entries created? Hitting pool exhaustion?
- Order of operations: on an inside→outside path the router routes first, then translates; NAT and ACLs interact by direction (inbound ACL sees the global address on the outside interface, the local address on the inside).
IPv6 was designed to make this chapter unnecessary, and in IPv6-native networks it largely is — global addresses end to end, policy at firewalls, NAT reserved for translation between protocol families (NAT64). Until then, PAT remains the load-bearing wall of the IPv4 Internet, and reading a translation table stays a daily skill.