Cisco CCNA Preparation · lesson 23 of 36 · 25 min
Network Address Translation (NAT)
NAT translates private RFC 1918 addresses (10.x, 172.16–31.x, 192.168.x) to one or more public IPs before packets leave the router. This conserves IPv4 address space and hides internal topology.
Static NAT — one-to-one permanent mapping. Used for servers that must be reachable from the internet (web, mail). Config: ip nat inside source static 192.168.1.10 203.0.113.10
Dynamic NAT — maps inside addresses to a pool of public IPs on demand. When the pool is exhausted, new connections are dropped. Config: define an ACL matching inside hosts, define a pool, then ip nat inside source list ACL pool POOL-NAME.
PAT (Port Address Translation / NAT Overload) — the most common form. Many inside hosts share a single public IP, differentiated by source port numbers. Config: add overload keyword. This is what home routers use.
NAT Interface Commands
Every NAT config requires marking interfaces: ip nat inside on LAN-facing interfaces, ip nat outside on the WAN interface. Without these, NAT will not translate.
DHCP — Dynamic Host Configuration Protocol
DHCP automates IP address assignment. A client broadcasts a DHCP Discover; the server replies with an Offer; the client sends a Request; the server confirms with an Acknowledgment (DORA process).
Cisco IOS DHCP Server config:
ip dhcp pool LAN → network 192.168.1.0 255.255.255.0 → default-router 192.168.1.1 → dns-server 8.8.8.8 → lease 7 (days)
Exclude addresses reserved for static devices: ip dhcp excluded-address 192.168.1.1 192.168.1.20
DHCP Relay (ip helper-address) — when the DHCP server is on a different subnet, the router relays broadcasts as unicast: ip helper-address 10.0.0.5 on the client-facing interface. This is a very common exam scenario.
DNS — Domain Name System
DNS resolves human-readable names (cisco.com) to IP addresses. The resolution hierarchy: local cache → hosts file → recursive resolver → root servers → TLD servers → authoritative server.
Key record types tested on CCNA: A (IPv4 address), AAAA (IPv6 address), CNAME (alias), MX (mail exchanger), PTR (reverse lookup), NS (name server).
On Cisco IOS, configure a DNS server for the device: ip name-server 8.8.8.8. Enable DNS lookup (on by default): ip domain-lookup. Set a domain name: ip domain-name example.com.
NTP — Network Time Protocol
Accurate time is critical for log correlation, certificate validity, and Kerberos authentication. NTP synchronizes clocks across the network using a hierarchy of strata (stratum 0 = atomic clock, stratum 1 = directly connected, stratum 2 = synced from stratum 1, etc.).
NTP client config: ntp server 216.239.35.0 (Google NTP). Verify: show ntp status and show ntp associations.
NTP server config: ntp master 3 (makes the router a stratum 3 server for downstream devices).
NTP authentication (exam topic): ntp authenticate → ntp authentication-key 1 md5 MYKEY → ntp trusted-key 1 → ntp server 10.0.0.1 key 1.
Exam Tip
If show ntp status shows “unsynchronized,” the router has not yet locked to a time source. Check connectivity to the NTP server and verify the key if authentication is configured.
Key Terms
Key Terms
Knowledge Check — 12 Questions
IP Services — NAT, DHCP, DNS, NTP
Which NAT type allows many inside hosts to share a single public IP using port numbers?
- Static NAT
- Dynamic NAT
- PAT (NAT Overload)
- Twice NAT
Answer: PAT (NAT Overload)
PAT (Port Address Translation) uses unique port numbers to track many simultaneous sessions through one public IP.
Which command marks an interface as the inside NAT interface?
- ip nat outside
- ip nat inside
- ip nat enable
- nat inside source
Answer: ip nat inside
ip nat inside is applied to the LAN-facing interface; ip nat outside is applied to the WAN interface.
What is the DHCP process in order?
- DORA
- ROAD
- ADOR
- DRAO
Answer: DORA
DORA: Discover → Offer → Request → Acknowledge.
A router needs to forward DHCP broadcasts to a server on 10.0.0.5. Which command is used?
- ip dhcp relay 10.0.0.5
- ip helper-address 10.0.0.5
- ip forward-protocol udp 67
- ip dhcp server 10.0.0.5
Answer: ip helper-address 10.0.0.5
ip helper-address converts DHCP broadcasts to unicast and forwards them to the specified DHCP server.
To exclude addresses 192.168.1.1 through 192.168.1.20 from DHCP, use: ip dhcp _____ 192.168.1.1 192.168.1.20
Answer: excluded-address
ip dhcp excluded-address reserves addresses so the DHCP server does not assign them.
Which DNS record type maps a hostname to an IPv6 address?
- A
- AAAA
- PTR
- MX
Answer: AAAA
AAAA records map hostnames to IPv6 addresses; A records map to IPv4.
NTP stratum 0 refers to:
- A router acting as NTP server
- An atomic clock or GPS receiver
- A device synced from a stratum 1 server
- An unsynchronized device
- Answer: An atomic clock or GPS receiver
Stratum 0 is the reference clock (atomic, GPS). Stratum 1 servers connect directly to stratum 0 sources.
Which command verifies NTP synchronization status on a Cisco router?
- show ntp associations
- show ntp status
- debug ntp events
- show clock detail
Answer: show ntp status
show ntp status shows whether the device is synchronized, the stratum, and the reference clock.
Static NAT creates a permanent one-to-one mapping between a private and public IP address.
- True
- False
Answer: True
Static NAT is a fixed, permanent mapping — used for servers that must always be reachable at the same public IP.
Which DNS record type is used for reverse DNS lookups (IP to hostname)?
- A
- CNAME
- PTR
- NS
Answer: PTR
PTR (pointer) records map IP addresses back to hostnames — used in reverse DNS lookups.
Dynamic NAT differs from PAT because:
- Dynamic NAT uses port numbers; PAT does not
- Dynamic NAT maps each inside host to a unique public IP from a pool; PAT shares one IP
- Dynamic NAT only works with IPv6
- Dynamic NAT requires static routes
Answer: Dynamic NAT maps each inside host to a unique public IP from a pool; PAT shares one IP Dynamic NAT uses a pool of public IPs (one per session); PAT overloads a single IP using port numbers.
The Cisco IOS command to configure the router to use 8.8.8.8 as a DNS server is: ip _____ 8.8.8.8
Answer: name-server
ip name-server specifies the DNS server(s) the router uses for hostname resolution.
Previous lesson: First Hop Redundancy: HSRP, VRRP, GLBP — active/standby, virtual IP, preemption
Back to Cisco CCNA Preparation
Next lesson: SNMP, syslog (facilities and levels), QoS PHB (classification, marking, queuing, policing, shaping), SSH, TFTP/FTP