Goldfish Networks wordmark
BeginnerPublished 2026-07-02

CCNA NAT1: Static One-to-One NAT with ISP

Free preview — the first lab of NAT & PAT

Build a small but realistic edge topology and configure static one-to-one NAT on R1 so the inside host PC-A (192.168.10.10) always translates to 203.0.113.3. Validate bidirectional reachability with an upstream ISP router and a public server one hop further. Verify translation state and counters on R1 and connectivity from both ends.

Track
Est. time
40 minutes
Difficulty
Beginner
Topics

Learning objectives

  • Identify and mark inside vs outside interfaces correctly on an IOS router
  • Configure a static one-to-one NAT mapping with ip nat inside source static
  • Verify static NAT: permanent translation entry and statistics on R1
  • Confirm end-to-end reachability from the inside host to a public server through translation
  • Demonstrate bidirectional reachability to the mapped global IP from the public side

Troubleshooting focus

  • No translation appears: inside/outside roles may be reversed or missing
  • Return traffic fails: mapped global address is not on the R1 outside segment
  • Inside host unreachable: missing default route on host or gateway not 192.168.10.1
  • Routing broken pre-NAT: confirm R1's default route toward ISP and ISP's connected reachability

Topology

Lab topology diagram

Related labs

More hands-on Cisco Modeling Labs practice on the same track and topics.

Study this topic

Free guides, a command cheat sheet, and graded practice for this lab's topic.

Learn NAT & PATWhat Is NAT (Network Address Translation)?

Grade your work

How this lab is graded
  • Build it your way. Where a lab lets you choose a value — a VLAN name, an interface description — grading checks that you configured it, not which name you picked. Names that another line has to reference, like an ACL applied with access-class, are stated in the guide and do have to match.
  • Addresses, modes and protocol keywords are exact. An IP address, a subnet mask, switchport mode trunk, an encapsulation — these carry the meaning of the lab, so they are graded as written in the guide.
  • Grading reads your saved configuration. Export the lab from CML after you have configured it, and make sure anything you set is in the running-config — a change that only exists in a terminal session never reaches the grader.
  • You can submit as many times as you like. Your best score stands, and each attempt tells you which checks passed so you can work the gaps.
  • Scored something you believe is correct? Use Report an issue on this page — that is exactly how the grading fixes in the changelog got found.

Create a free account to submit your lab for grading.

Create a free account
Found a problem with this lab?

Please sign in to report a problem — tying it to your attempts lets us reproduce and fix it faster.