18 hands-on NAT scenarios you build in your own Cisco Modeling Labs instance and grade against the answer key. NAT configuration and troubleshooting practice for CCNA and CCNP.
Included with a subscription
Daily CCNA troubleshooting lab (repair-focused). Inside clients cannot reach an external destination even though PAT appears configured. Diagnose by reading the NAT table and interface roles, discover that translation isn’t triggering because the NAT boundary is undefined, and restore outbound reachability by correctly marking both sides.
One-branch edge capstone that unifies DHCP for the LAN, PAT overload to an Internet server, an extended ACL that permits HTTP but denies SSH, and SSH-only management. The starting lab intentionally contains multiple faults across DHCP, NAT, and SSH so you must diagnose and repair the edge to achieve full end-to-end verification from the client.
Deploy Port Address Translation (NAT overload) on an enterprise edge so two inside clients share a single public IPv4 address to reach an external HTTP service on an ISP router. You will designate inside/outside, build the NAT selection ACL, configure the overload rule, and verify simultaneous flows and translations from the end hosts.
Deploy dynamic NAT on an enterprise edge so multiple inside clients share a pool of public IPs. You will configure an ACL to match inside sources, build a public NAT pool, bind the ACL to the pool, and correctly mark inside/outside interfaces. Validate from end hosts and confirm on-demand translations on the edge router.
Deploy a single-edge router performing static one-to-one NAT so an inside host has a fixed public address. You will mark inside/outside interfaces, create the static NAT mapping, and verify reachability to an internet host and the translation table. The lab is intentionally small but enterprise-clean, with a routed inside transit, an access switch for the user LAN, and an external host representing the internet.
Configure static PAT (port forwarding) on a Cisco IOS edge router so an outside client can reach an inside HTTP service on TCP/8080 using a dedicated public IP that is not the router's interface. Validate using curl from the outside host and NAT show commands on the router.
Configure PAT on an edge router so only PC-A is translated using a standard ACL as the traffic selector. PC-B remains untranslated and fails to reach the ISP, illustrating that NAT occurs only for traffic explicitly matched by the ACL. Validate using host pings and IOS show commands, and interpret ACL hit counters and NAT tables.
Configure dynamic one-to-one NAT using a public address pool on an IOS router between a private LAN and a simulated ISP. Two inside hosts draw from a two-address public pool on-demand. Validate that no translations exist before traffic, that each host receives a distinct global address after generating traffic, and that entries age out when idle.
Implement Port Address Translation (PAT) using a one-address NAT pool so multiple inside hosts share a single public IP. Reuse the same 5-node topology and addressing as the prior lab; convert the pool to a single address and enable overload. Verify simultaneous connectivity from two inside hosts, observe translations and counters, and contrast with prior pool-exhaustion behavior.
Build an Internet-edge NAT design that reaches beyond the ISP to a real external network. You will configure dynamic PAT (overload) from a private LAN to a public /29 using a NAT pool on the edge router, with the router’s default route already pointing to the ISP. Verify that an inside host can reach a public server across the ISP and that translations, counters, and default routing reflect the expected state.
Operate, observe, and clear Cisco IOS PAT translations on an internet edge. You will configure a standard PAT overload on R1, generate multiple concurrent sessions from an inside host, read translation/state counters, and clear single and all entries to see how the table repopulates immediately under live traffic.
Configure static one-to-one NAT for two inside hosts on R1, mark inside/outside interfaces correctly, and read the four-column NAT translation table (inside local/global, outside local/global). Verify from both sides and relate observed traffic to table entries.
Advanced NAT capstone, run as a fault hunt. Inside hosts cannot reach the internet, the translation table stays empty, and one host cannot even reach its own gateway. The lab is called NAT, which is the trap: not every fault here is a NAT fault. You get symptoms and the required end state — no fault list. Faults span the router, the switch and the path beyond, and fixing the translation alone will not restore service.
Build a small but realistic edge topology and configure static one-to-one NAT on R1 so the inside host PC-A (192.168.10.10) always translates to 203.0.113.3. Validate bidirectional reachability with an upstream ISP router and a public server one hop further. Verify translation state and counters on R1 and connectivity from both ends.
Free with an account
Implement and verify interface-based PAT (overload) on a single-edge SOHO router. Inside hosts on 192.168.10.0/24 share the router’s lone public IP (203.0.113.1) on its outside interface. Validate NAT translations, ACL matches, and simultaneous host access, and practice troubleshooting common misconfigurations (inside/outside role reversal, ACL selection errors).
Advanced ACL and NAT capstone, run as a fault hunt. A branch site was cut over last night and the policy does not behave: the flow that should be blocked gets through, other traffic does not come back at all, and nobody recorded what changed. You get symptoms and the required end state — no fault list. The faults span all three routers and include a shadowed ACE and a policy applied on the wrong side of NAT, so translated addresses hide the very hosts the rules name. Expect fixing the first one to change the symptom rather than clear it.
Beginner CCNA ACL lab on a compact 5-node CML-Free topology. You will configure static routing end-to-end, implement source NAT (PAT) at the source edge, and then build a standard numbered ACL near the destination to allow a single NATed host and a specific subnet while denying all others. You will validate with pings from end hosts, observe ACL hit counters and NAT translations, and troubleshoot common mistakes such as ACL placement, wildcard masks, and pre-/post-NAT address matching.
Free with an account
Hands-on ACL practice using named standard and extended ACLs, applied with correct placement and direction, edited by sequence number, and verified with counters and end-host tests. The lab adds a realistic NAT edge to expose order-of-operations pitfalls without obscuring data-plane ACL effects.
NAT is a required CCNA topic and it sits at the edge of nearly every network you will ever work on, yet it is the subject where candidates most reliably lose points to terminology rather than syntax. Inside local, inside global, outside local, and outside global are four names for what is really two addresses viewed from two vantage points, and getting them backwards means the command you type is the reverse of the one you intended, with nothing on screen to warn you. NAT is also interface-driven, so a mapping that reads perfectly in the running configuration does absolutely nothing if the interfaces were never tagged inside and outside. Reliable intuition here comes from translating real traffic, reading the translation table, and seeing for yourself which column changed and which did not.
These labs run real Cisco IOS in Cisco Modeling Labs with an upstream router standing in for the ISP, so you configure both ends of every translation rather than assuming the far side works. You mark ip nat inside and ip nat outside on the correct interfaces, build a one-to-one map with ip nat inside source static where the inside-local address comes first and the inside-global second, publish a single service with static port forwarding, hand out a range with ip nat pool, and share one address across a whole subnet with ip nat inside source list and the overload keyword. You verify with show ip nat translations and use show ip nat statistics to confirm which interfaces NAT actually treats as inside and outside and whether the hit counter is moving. Fault labs supply a missing interface tag, a reversed static mapping, an ACL that misses half the subnet, and an inside-global address the upstream router never routes back. Each upload is graded requirement by requirement against the answer key.
Static NAT is a permanent one-to-one binding between one inside address and one public address. It is installed the instant you enter the command, never ages out, and works in both directions, which is what makes an inside server reachable from outside. Dynamic NAT draws addresses from a pool on demand but is still one-to-one, so translations fail once the pool is exhausted. PAT, which is dynamic NAT with the overload keyword, multiplexes many inside hosts onto one address by rewriting Layer 4 port numbers, so a single public IP can carry an entire LAN outbound sessions.
For dynamic NAT and PAT an empty table right after configuring is expected, because entries are built from real sessions and nothing appears until an inside host sends something outbound. If traffic is definitely flowing and the table is still empty, run show ip nat statistics and look at the inside and outside interface lists: a missing ip nat inside or ip nat outside is the most common cause, and no amount of correct mapping configuration translates without them. Static entries behave differently and appear immediately with no traffic at all.
Yes. The labs use RFC 1918 space on the LAN side and documentation address space on the WAN side, with a simulated upstream router inside the topology, so nothing ever touches real public addressing. You run the whole thing in your own Cisco Modeling Labs instance from a free-tier package that imports in one click.
Study the theory behind these labs — the concept explainer and step-by-step guides.
Looking for something else? Browse the full lab archive, narrow it to self-standing labs, or see today's daily lab.