NAT at the Internet Edge with Default Routing

Bundle lab

Build an Internet-edge NAT design that reaches beyond the ISP to a real external network. You will configure dynamic PAT (overload) from a private LAN to a public /29 using a NAT pool on the edge router, with the router’s default route already pointing to the ISP. Verify that an inside host can reach a public server across the ISP and that translations, counters, and default routing reflect the expected state.

Learning objectives

• Identify inside vs outside interfaces and why NAT only translates traffic crossing between them
• Configure dynamic PAT using a NAT pool with an ACL source selector
• Leverage an existing default route so routing works before translation
• Verify translations with show ip nat translations/statistics and ACL hit counts
• Test end-to-end reachability from an inside host to a true external network

Troubleshooting focus

• If pings from the inside fail, confirm inside/outside roles are correct on the edge router interfaces.
• Check that the NAT ACL matches the inside subnet exactly and isn’t shadowed by an unintended ACE.
• Make sure the public NAT pool lies within the connected outside /29 so the ISP can ARP and return traffic succeeds.
• Confirm the default route on the edge router points to the ISP next hop (not to itself).
• Validate that hosts have the right gateway and mask; the router should already forward before NAT.
• Observe NAT statistics; zero hits means translation is not being triggered by inside-to-outside flows.