NAT & PAT

By Alec Gauldin, Principal Network Engineer · Updated July 2026

New to this? Start with the explainer: What Is NAT (Network Address Translation)?

NAT rewrites the IP addresses in packet headers as traffic crosses a boundary — typically translating private RFC 1918 addresses to a public address — so that many internal hosts can share a small pool of public IPv4 space. It sits in the IP Services portion of the CCNA 200-301 blueprint, where you are expected to configure and verify inside source NAT using both static entries and pools, plus PAT. The exact weighting of the IP Services domain can shift between exam revisions, so treat NAT as a reliably tested skill rather than fixating on a percentage.

Every NAT deployment starts the same way: you designate which interfaces face the private network with 'ip nat inside' and which face the public side with 'ip nat outside'. The router only translates traffic that actually crosses between an inside and an outside interface — miss that step and no entries ever build. On top of that sit three flavors: static NAT (a fixed one-to-one mapping), dynamic NAT (public addresses handed out from a pool on demand), and PAT, also called overload (many hosts sharing one address). The four address perspectives — inside local, inside global, outside local, and outside global — simply describe the same host as seen from each side of the boundary.

The static NAT guide covers the fixed one-to-one case: a permanent mapping so an outside host can always reach a specific inside server at a predictable public address. That same guide covers port forwarding, or static PAT, which maps a single public IP-and-port pair to an inside host-and-port so one public address can publish several distinct services. It is the right tool whenever a server must be reachable from the internet at a stable address.

Dynamic NAT draws from a configured pool, leasing each inside host a public address for the life of its session; once the pool is exhausted, new hosts are simply denied, so it is rarely deployed on its own. PAT — the subject of the NAT overload guide — is what nearly every home and branch router actually runs: many inside hosts share one outside address, kept distinct by unique source port numbers. Remember that NAT overload and PAT are the same feature; 'overload' is just the IOS keyword you append to make one address serve the whole network.

Whichever flavor you build, you confirm it the same way — through the translation table. 'show ip nat translations' lists the active mappings, 'show ip nat statistics' counts hits, misses, and which interfaces are marked inside and outside, and 'clear ip nat translation *' flushes dynamic entries to force a fresh build. Learning to read that table is how you distinguish a working translation from a reversed or missing interface designation, the single most common NAT mistake.

Master NAT in three passes. First, understand the model on this page so the inside/outside logic and the four address perspectives are second nature. Next, keep the command cheat sheet open while you drill the syntax for static mappings, pools, and the overload keyword. Finally, build and grade the hands-on labs so the configuration and verification stick under exam and production pressure. The linked guides give you the exact step-by-step sequences for static NAT and for PAT; this hub is the map that shows how those pieces relate.