Cisco NAT and PAT Cheat Sheet
Every NAT command you need on Cisco IOS, in the order you configure them: mark the inside and outside interfaces, choose static, pool, or overload, then verify. Values in <angle brackets> are yours to supply. Commands here were applied to a real IOS 17.16 device and read back, so what you see is what the image accepts.
Part of the NAT & PAT learning hub
1. Mark the inside and outside interfaces
This is the step people skip. NAT does nothing at all until one interface is 'ip nat inside' and another is 'ip nat outside' — the translation rules below are inert without it.
| Command | What it does |
|---|---|
interface <type/number> | Enter the interface facing your private network. |
ip nat inside | Mark this interface as the inside (private) side of the translation. |
ip nat outside | Mark the interface facing the internet or upstream network as the outside side. |
2. The four address terms
Exam wording depends on these. 'Local' and 'global' describe which side of the router the address is seen from, not whether it is private or public.
| Term | Whose address | Seen from | Typical value |
|---|---|---|---|
Inside local | Your host | The inside network | 192.168.99.10 (private) |
Inside global | Your host | The outside network | 203.0.113.10 (public) |
Outside global | The remote host | The outside network | 8.8.8.8 (public) |
Outside local | The remote host | The inside network | Usually the same as outside global |
3. Static NAT — one host, one fixed address
Use static NAT for a server that must always be reachable at the same outside address. IOS appends 'extendable' to the port-forwarding form on its own — your line is correct even though the running config does not match what you typed.
| Command | What it does |
|---|---|
ip nat inside source static <inside-local> <inside-global> | Permanently map one private address to one public address, both directions. |
ip nat inside source static tcp <local-ip> <port> <global-ip> <port> | Port forwarding: publish one TCP port of an inside host. Stored back as '... extendable'. |
ip nat inside source static udp <local-ip> <port> <global-ip> <port> | The same for a UDP service. |
no ip nat inside source static <inside-local> <inside-global> | Remove the mapping. Clear existing translations afterwards (group 6). |
4. Dynamic NAT — a pool of addresses
Without 'overload' this is one-to-one: the pool can run out, and the next host gets no translation. That exhaustion is the whole reason PAT exists.
| Command | What it does |
|---|---|
ip nat pool <name> <start-ip> <end-ip> netmask <mask> | Define the range of public addresses available for translation. |
ip nat pool <name> <start-ip> <end-ip> prefix-length <n> | The same, expressed as a prefix length instead of a mask. |
access-list <n> permit <network> <wildcard> | Match the inside hosts allowed to translate. IOS 17.x stores this as 'ip access-list standard <n>' with sequence numbers. |
ip nat inside source list <acl> pool <name> | One-to-one dynamic NAT: each inside host takes an address from the pool until it is empty. |
5. PAT (overload) — many hosts, one address
This is what a home router does, and what nearly every lab wants. Adding 'overload' lets many inside hosts share one outside address, distinguished by port number.
| Command | What it does |
|---|---|
ip nat inside source list <acl> interface <type/number> overload | The common form: overload the outside interface's own address. No pool needed. |
ip nat inside source list <acl> pool <name> overload | Overload a pool instead, when you have more than one public address to share. |
ip nat translation timeout <seconds> | How long an idle dynamic translation is kept (default 86400 for non-TCP/UDP entries). |
ip nat translation tcp-timeout <seconds> | Idle timeout for TCP translations specifically. |
ip nat translation max-entries <n> | Cap the total number of translations the router will hold. |
6. Verify, clear, and troubleshoot
An empty translation table is normal until inside traffic actually crosses the router. Generate a ping from an inside host before concluding NAT is broken.
| Command | What it does |
|---|---|
show ip nat translations | The live translation table: inside local, inside global, outside local, outside global. |
show ip nat translations verbose | Adds age and timeout for each entry — use it when translations vanish sooner than expected. |
show ip nat statistics | Hit and miss counters, active translations, and which interfaces are marked inside/outside. |
clear ip nat translation * | Drop every dynamic translation. Required after changing a rule — stale entries keep the old behaviour. |
debug ip nat | Log each translation as it happens. Noisy on a busy router; turn it off with 'undebug all'. |
show ip nat statistics | include interface | Fastest check for the most common mistake: no interface marked inside or outside. |
Frequently asked questions
What is the difference between NAT and PAT?
NAT maps addresses one-to-one, so ten inside hosts need ten outside addresses and the eleventh gets nothing. PAT adds the port number to the translation, letting many inside hosts share a single outside address. In IOS the difference is literally the word 'overload' on the end of the 'ip nat inside source list' command.
Why is my NAT translation table empty?
Two usual causes. Either no interface is marked — check 'show ip nat statistics' for the inside and outside interface list, because the rules do nothing without 'ip nat inside' and 'ip nat outside' — or no inside traffic has crossed the router yet, since dynamic entries are only created on demand. Ping something outside from an inside host and look again.
Why does my static PAT line say 'extendable' when I did not type it?
IOS adds it. A static port-forwarding entry created with 'ip nat inside source static tcp ...' is stored back as '... extendable', which allows the same inside host to be reached through more than one mapping. Your configuration is correct; the router is just being explicit about a default.
Do I have to clear translations after changing a NAT rule?
Yes, for dynamic entries. Existing translations keep using the old rule until they age out, so a change can appear to have done nothing. Run 'clear ip nat translation *' and generate fresh traffic before deciding whether the new configuration works.
Now build it
Labs that drill this on real Cisco IOS — configure it yourself, then grade your config against the answer key.
Stop memorizing — configure it on real Cisco IOS
A cheat sheet gets you unstuck; a graded lab makes it stick. Edit a real Cisco config and grade it instantly — free, no signup.