Cisco CCNA Preparation · lesson 25 of 36 · 25 min
NAT and PAT Overview
NAT (Network Address Translation) translates private IP addresses to public IP addresses, allowing multiple devices to share a single public IP. PAT (Port Address Translation), also called NAT overload, is the most common form — it maps many private IP:port combinations to a single public IP using different source port numbers.
PAT is what makes home and small office internet access work — your router translates all internal devices to a single ISP-assigned IP address.
PAT Configuration
PAT configuration requires: defining inside/outside interfaces, creating an ACL to match inside traffic, and applying NAT overload.
PAT (NAT overload) — complete IOS config
overload keyword
The overload keyword is what makes it PAT. Without it, you get dynamic NAT (one-to-one from a pool). With overload, many private IPs share one public IP via port multiplexing.
How PAT Works
When a host at 192.168.1.10:54321 sends a packet to 8.8.8.8:53, the PAT router translates it to 203.0.113.1:10001 (the public IP with a unique port). The translation is stored in the NAT table. When the reply arrives at 203.0.113.1:10001, the router looks up the table and forwards it back to 192.168.1.10:54321.
Verification and Troubleshooting
Knowledge Check — 10 Questions
PAT (NAT Overload)
What is PAT also known as?
- Static NAT
- Dynamic NAT
- NAT overload
- Bidirectional NAT
Answer: NAT overload
PAT = Port Address Translation = NAT overload. It maps many private IP:port combinations to a single public IP using unique port numbers.
What keyword in the ip nat inside source command enables PAT?
- dynamic
- static
- overload
- pool
Answer: overload
The overload keyword enables PAT (port multiplexing). Without it, the command creates dynamic NAT (one-to-one from a pool).
Which interface is marked as ip nat inside?
- The WAN interface facing the internet
- The LAN interface facing internal hosts
- Both interfaces
- The loopback interface
Answer: The LAN interface facing internal hosts
ip nat inside is applied to the interface facing the private network (LAN). ip nat outside is applied to the interface facing the public network (WAN/internet).
What does the NAT translation table store?
- Routing table entries
- Mappings between inside local (private IP:port) and inside global (public IP:port)
- MAC address to IP mappings
- VLAN assignments
Answer: Mappings between inside local (private IP:port) and inside global (public IP:port)
The NAT table maps inside local (private IP:port) to inside global (public IP:port). Return traffic is matched against this table to forward replies to the correct internal host.
What command displays active PAT translation entries?
- show ip nat statistics
- show ip nat translations
- show ip route nat
- show interfaces nat
Answer: show ip nat translations
show ip nat translations shows all active NAT/PAT entries including inside local, inside global, outside local, and outside global addresses and ports.
In PAT, how does the router distinguish return traffic for different inside hosts sharing the same public IP?
- By destination IP address
- By unique source port numbers assigned to each translation
- By VLAN tags
- By TTL values
Answer: By unique source port numbers assigned to each translation
PAT assigns a unique port number to each translation. Return traffic arrives at the public IP with a specific destination port — the router looks up that port in the NAT table to find the correct inside host.
What is the difference between static NAT and PAT?
- Static NAT uses ports; PAT does not
- Static NAT is one-to-one (fixed mapping); PAT is many-to-one (using ports)
- PAT requires more public IPs
- Static NAT is only for IPv6
Answer: Static NAT is one-to-one (fixed mapping); PAT is many-to-one (using ports)
Static NAT permanently maps one private IP to one public IP — used for servers. PAT maps many private IPs to one public IP using port multiplexing.
What command clears all dynamic NAT translations?
- no ip nat translation
- clear ip nat translation *
- reset ip nat
- flush nat table
Answer: clear ip nat translation
clear ip nat translation removes all dynamic NAT/PAT entries from the translation table. Useful for troubleshooting or forcing re-translation.
The ACL used in ip nat inside source list [ACL] defines which inside hosts are eligible for _____ translation.
Answer: NAT
The ACL matches the inside (private) hosts that should be translated. Only traffic from matching hosts is translated; other traffic is not NATted.
A host at 10.0.0.5 cannot reach the internet. show ip nat translations shows no entry for this host. What is the most likely cause?
- The host IP is not in the ACL used by the NAT rule
- The NAT table is full
- The outside interface is down
- PAT is not supported on this router
Answer: The host IP is not in the ACL used by the NAT rule
If no translation entry exists, the host’s IP is likely not matched by the ACL in the ip nat inside source list command. Check the ACL and ensure it permits the host’s subnet.
Previous lesson: SNMP, syslog (facilities and levels), QoS PHB (classification, marking, queuing, policing, shaping), SSH, TFTP/FTP
Back to Cisco CCNA Preparation
Next lesson: DHCP server configuration on IOS: pools, exclusions, options, relay agent