Goldfish Networks wordmark
IntermediatePublished 2026-07-02

NAT Selection with an ACL: PAT a Single Host Only

Bundle lab

Configure PAT on an edge router so only PC-A is translated using a standard ACL as the traffic selector. PC-B remains untranslated and fails to reach the ISP, illustrating that NAT occurs only for traffic explicitly matched by the ACL. Validate using host pings and IOS show commands, and interpret ACL hit counters and NAT tables.

Track
Est. time
45 minutes
Difficulty
Intermediate
Topics

Learning objectives

  • Mark the correct inside/outside NAT interfaces on an IOS router
  • Write a standard ACL that selects a single inside host for translation
  • Configure PAT with a single-address pool and tie it to the ACL
  • Verify translations and ACL hit counts; explain why unmatched traffic is not translated
  • Diagnose failures due to ACL logic or mis-marked inside/outside roles

Troubleshooting focus

  • If both hosts succeed, the ACL may be too permissive or not referenced by NAT
  • If both fail, inside/outside roles may be reversed or the NAT pool is missing
  • If translations appear but replies never arrive, verify the translated address is on the outside segment and that the ISP can reach it

Topology

Subscribe to preview this lab's topology.

See plans

Related labs

More hands-on Cisco Modeling Labs practice on the same track and topics.

Study this topic

Free guides, a command cheat sheet, and graded practice for this lab's topic.

Learn NAT & PATWhat Is NAT (Network Address Translation)?

Grade your work

How this lab is graded
  • Build it your way. Where a lab lets you choose a value — a VLAN name, an interface description — grading checks that you configured it, not which name you picked. Names that another line has to reference, like an ACL applied with access-class, are stated in the guide and do have to match.
  • Addresses, modes and protocol keywords are exact. An IP address, a subnet mask, switchport mode trunk, an encapsulation — these carry the meaning of the lab, so they are graded as written in the guide.
  • Grading reads your saved configuration. Export the lab from CML after you have configured it, and make sure anything you set is in the running-config — a change that only exists in a terminal session never reaches the grader.
  • You can submit as many times as you like. Your best score stands, and each attempt tells you which checks passed so you can work the gaps.
  • Scored something you believe is correct? Use Report an issue on this page — that is exactly how the grading fixes in the changelog got found.

Create a free account to submit your lab for grading.

Create a free account
Found a problem with this lab?

Please sign in to report a problem — tying it to your attempts lets us reproduce and fix it faster.