Goldfish Networks wordmark
Create a free account
Topic

NAT practice labs

21 hands-on NAT scenarios you build in your own Cisco Modeling Labs instance and grade against the answer key. NAT configuration and troubleshooting practice for CCNA.

Private inside, one public address outside — the reference wiring for NAT & PAT, not a specific lab.

Included with a subscription

AdvancedDailyLocked

CCNA Break/Fix Capstone: One Floor, Two Layers, One Ticket

A full-path break/fix capstone for CCNA troubleshooting. A single floor was renumbered and re-cabled. Users on that floor cannot reach anything — not their default gateway, not other subnets, and not the internet. The change record mentions both the access switch and the internet edge. Your job: prove the path hop-by-hop from the client outward and repair every break. Fixing only one side does not change the symptom; both layers must be corrected.

CCNA75 min5 objectives

IntermediateDailyLocked

CCNA Break/Fix: Published Services Nobody Outside Can Open

A DMZ server was rebuilt onto a new IP last week. Since then, outside users cannot open its three published services, while the server itself can browse out normally. Your job: work from the public address toward the inside, diagnose where the forwarding breaks, and republish all three services on the advertised public IP without disrupting outbound internet access.

CCNA55 min4 objectives

IntermediateDailyLocked

CCNA Break/Fix: The Renumbering That Left Two Floors Offline

Daily CCNA troubleshooting repair: two branch floors were renumbered and now users report DHCP failures and no Internet access. Work end-to-end from each floor’s client to the WAN: trace DHCP pool-to-interface bindings, validate NAT policy per floor, and restore both floors so leases are issued from the new plan and both can reach the provider loopback.

CCNA47 min5 objectives

IntermediateDailyLocked

CCNA Break/Fix: Translation Happens, Replies Do Not

A branch reaches its provider through one edge router that hides the user LAN behind its upstream address. Since a change window, everyone on 192.168.10.0/24 reports that nothing beyond the branch answers, while the router itself reaches the provider's test address. Find what is wrong.

CCNA45 min4 objectives

AdvancedDailyLocked

CCNA: Secure Branch Edge Capstone (ACL/PAT/DHCP/SSH)

One-branch edge capstone that unifies DHCP for the LAN, PAT overload to an Internet server, an extended ACL that permits HTTP but denies SSH, and SSH-only management. The starting lab intentionally contains multiple faults across DHCP, NAT, and SSH so you must diagnose and repair the edge to achieve full end-to-end verification from the client.

CCNA90 min5 objectives

IntermediateDailyLocked

CCNA Foundations: PAT (NAT Overload) — Many Hosts, One IP

Deploy Port Address Translation (NAT overload) on an enterprise edge so two inside clients share a single public IPv4 address to reach an external HTTP service on an ISP router. You will designate inside/outside, build the NAT selection ACL, configure the overload rule, and verify simultaneous flows and translations from the end hosts.

CCNA55 min5 objectives

IntermediateDailyLocked

CCNA Foundations: Dynamic NAT — Translate from an Address Pool

Deploy dynamic NAT on an enterprise edge so multiple inside clients share a pool of public IPs. You will configure an ACL to match inside sources, build a public NAT pool, bind the ACL to the pool, and correctly mark inside/outside interfaces. Validate from end hosts and confirm on-demand translations on the edge router.

CCNA55 min5 objectives

BeginnerDailyLocked

CCNA Foundations: Static NAT — One-to-One Inside/Outside Mapping

Deploy a single-edge router performing static one-to-one NAT so an inside host has a fixed public address. You will mark inside/outside interfaces, create the static NAT mapping, and verify reachability to an internet host and the translation table. The lab is intentionally small but enterprise-clean, with a routed inside transit, an access switch for the user LAN, and an external host representing the internet.

CCNA55 min4 objectives

AdvancedLocked

NAT Troubleshooting Capstone: Interface Role + ACL

Advanced NAT capstone, run as a fault hunt. Inside hosts cannot reach the internet, the translation table stays empty, and one host cannot even reach its own gateway. The lab is called NAT, which is the trap: not every fault here is a NAT fault. You get symptoms and the required end state — no fault list. Faults span the router, the switch and the path beyond, and fixing the translation alone will not restore service.

CCNA65 min5 objectives

BeginnerFree2026-07-02

CCNA NAT1: Static One-to-One NAT with ISP

Build a small but realistic edge topology and configure static one-to-one NAT on R1 so the inside host PC-A (192.168.10.10) always translates to 203.0.113.3. Validate bidirectional reachability with an upstream ISP router and a public server one hop further. Verify translation state and counters on R1 and connectivity from both ends.

CCNA40 min5 objectives

Free with an account

IntermediateLocked

PAT onto the Outside Interface (SOHO Edge)

Implement and verify interface-based PAT (overload) on a single-edge SOHO router. Inside hosts on 192.168.10.0/24 share the router’s lone public IP (203.0.113.1) on its outside interface. Validate NAT translations, ACL matches, and simultaneous host access, and practice troubleshooting common misconfigurations (inside/outside role reversal, ACL selection errors).

CCNA45 min6 objectives

IntermediateLocked

NAT Selection with an ACL: PAT a Single Host Only

Configure PAT on an edge router so only PC-A is translated using a standard ACL as the traffic selector. PC-B remains untranslated and fails to reach the ISP, illustrating that NAT occurs only for traffic explicitly matched by the ACL. Validate using host pings and IOS show commands, and interpret ACL hit counters and NAT tables.

CCNA45 min5 objectives

IntermediateLocked

CCNA NAT3: Dynamic NAT with an Address Pool

Configure dynamic one-to-one NAT using a public address pool on an IOS router between a private LAN and a simulated ISP. Two inside hosts draw from a two-address public pool on-demand. Validate that no translations exist before traffic, that each host receives a distinct global address after generating traffic, and that entries age out when idle.

CCNA38 min5 objectives

IntermediateLocked

NAT at the Internet Edge with Default Routing

Build an Internet-edge NAT design that reaches beyond the ISP to a real external network. You will configure dynamic PAT (overload) from a private LAN to a public /29 using a NAT pool on the edge router, with the router’s default route already pointing to the ISP. Verify that an inside host can reach a public server across the ISP and that translations, counters, and default routing reflect the expected state.

CCNA45 min5 objectives

IntermediateLocked

CCNA NAT4: PAT Overload onto a Pool

Implement Port Address Translation (PAT) using a one-address NAT pool so multiple inside hosts share a single public IP. Reuse the same 5-node topology and addressing as the prior lab; convert the pool to a single address and enable overload. Verify simultaneous connectivity from two inside hosts, observe translations and counters, and contrast with prior pool-exhaustion behavior.

CCNA45 min5 objectives

IntermediateLocked

CCNA NAT9: Verifying & Clearing NAT

Operate, observe, and clear Cisco IOS PAT translations on an internet edge. You will configure a standard PAT overload on R1, generate multiple concurrent sessions from an inside host, read translation/state counters, and clear single and all entries to see how the table repopulates immediately under live traffic.

CCNA45 min4 objectives

BeginnerLocked

Inside, Outside & the Translation Table

Configure static one-to-one NAT for two inside hosts on R1, mark inside/outside interfaces correctly, and read the four-column NAT translation table (inside local/global, outside local/global). Verify from both sides and relate observed traffic to table entries.

CCNA40 min5 objectives

IntermediateLocked

Static PAT: Port Forwarding to an Inside Server

Configure static PAT (port forwarding) on a Cisco IOS edge router so an outside client can reach an inside HTTP service on TCP/8080 using a dedicated public IP that is not the router's interface. Validate using curl from the outside host and NAT show commands on the router.

CCNA50 min5 objectives

AdvancedLocked

ACL Troubleshooting Capstone: Classic Faults, NAT, Placement

Advanced ACL and NAT capstone, run as a fault hunt. A branch site was cut over last night and the policy does not behave: the flow that should be blocked gets through, other traffic does not come back at all, and nobody recorded what changed. You get symptoms and the required end state — no fault list. The faults span all three routers and include a shadowed ACE and a policy applied on the wrong side of NAT, so translated addresses hide the very hosts the rules name. Expect fixing the first one to change the symptom rather than clear it.

CCNA75 min5 objectives

BeginnerFree2026-06-25

Standard ACL: Permit Host & Subnet, Deny Others

Beginner CCNA ACL lab on a compact 5-node CML-Free topology. You will configure static routing end-to-end, implement source NAT (PAT) at the source edge, and then build a standard numbered ACL near the destination to allow a single NATed host and a specific subnet while denying all others. You will validate with pings from end hosts, observe ACL hit counters and NAT translations, and troubleshoot common mistakes such as ACL placement, wildcard masks, and pre-/post-NAT address matching.

CCNA55 min7 objectives

Free with an account

IntermediateLocked

CCNA: Named ACLs & Editing by Sequence Number

Hands-on ACL practice using named standard and extended ACLs, applied with correct placement and direction, edited by sequence number, and verified with counters and end-host tests. The lab adds a realistic NAT edge to expose order-of-operations pitfalls without obscuring data-plane ACL effects.

CCNA75 min6 objectives

Practicing NAT and PAT on Cisco Modeling Labs

Why it matters, and what these labs cover.

NAT is a required CCNA topic and it sits at the edge of nearly every network you will ever work on, yet it is the subject where candidates most reliably lose points to terminology rather than syntax. Inside local, inside global, outside local, and outside global are four names for what is really two addresses viewed from two vantage points, and getting them backwards means the command you type is the reverse of the one you intended, with nothing on screen to warn you. NAT is also interface-driven, so a mapping that reads perfectly in the running configuration does absolutely nothing if the interfaces were never tagged inside and outside. Reliable intuition here comes from translating real traffic, reading the translation table, and seeing for yourself which column changed and which did not.

These labs run real Cisco IOS in Cisco Modeling Labs with an upstream router standing in for the ISP, so you configure both ends of every translation rather than assuming the far side works. You mark ip nat inside and ip nat outside on the correct interfaces, build a one-to-one map with ip nat inside source static where the inside-local address comes first and the inside-global second, publish a single service with static port forwarding, hand out a range with ip nat pool, and share one address across a whole subnet with ip nat inside source list and the overload keyword. You verify with show ip nat translations and use show ip nat statistics to confirm which interfaces NAT actually treats as inside and outside and whether the hit counter is moving. Fault labs supply a missing interface tag, a reversed static mapping, an ACL that misses half the subnet, and an inside-global address the upstream router never routes back. Each upload is graded requirement by requirement against the answer key.

Frequently asked questions

What is the difference between static NAT, dynamic NAT, and PAT?

Static NAT is a permanent one-to-one binding between one inside address and one public address. It is installed the instant you enter the command, never ages out, and works in both directions, which is what makes an inside server reachable from outside. Dynamic NAT draws addresses from a pool on demand but is still one-to-one, so translations fail once the pool is exhausted. PAT, which is dynamic NAT with the overload keyword, multiplexes many inside hosts onto one address by rewriting Layer 4 port numbers, so a single public IP can carry an entire LAN outbound sessions.

Why does show ip nat translations come back empty?

For dynamic NAT and PAT an empty table right after configuring is expected, because entries are built from real sessions and nothing appears until an inside host sends something outbound. If traffic is definitely flowing and the table is still empty, run show ip nat statistics and look at the inside and outside interface lists: a missing ip nat inside or ip nat outside is the most common cause, and no amount of correct mapping configuration translates without them. Static entries behave differently and appear immediately with no traffic at all.

Can I practice NAT without owning a public IP address?

Yes. The labs use RFC 1918 space on the LAN side and documentation address space on the WAN side, with a simulated upstream router inside the topology, so nothing ever touches real public addressing. You run the whole thing in your own Cisco Modeling Labs instance from a free-tier package that imports in one click.

Learn NAT

The theory behind these labs: the study hub, explainers and guides.

Looking for something else? Browse the full lab archive, narrow it to self-standing labs, or see today's daily lab.