NAT Troubleshooting Capstone: Interface Role + ACL

Bundle lab

Advanced NAT capstone, run as a fault hunt. Inside hosts cannot reach the internet, the translation table stays empty, and one host cannot even reach its own gateway. The lab is called NAT, which is the trap: not every fault here is a NAT fault. You get symptoms and the required end state — no fault list. Faults span the router, the switch and the path beyond, and fixing the translation alone will not restore service.

Learning objectives

• Diagnose a NAT failure from operational state alone, with no list of what was changed
• Establish that traffic can reach the far side at all before blaming translation
• Reason about which interface is inside and which is outside relative to the traffic flow
• Check that the NAT match list covers the subnet that actually exists
• Resist the framing: a lab named after one protocol can be broken by another

Troubleshooting focus

• If pings from the inside host fail and the NAT table stays empty, confirm that traffic actually crosses from an 'ip nat inside' interface to an 'ip nat outside' interface.
• If NAT statistics show misses but no hits, verify that the ACL referenced by the NAT rule matches the real source IP range of the inside host.
• Ensure the edge router holds a working default route to the ISP and that the ISP segment can reach the router’s outside address.
• After changes, clear stale state if needed (translations age quickly, but you can trigger new flows to observe fresh hits).