Cisco Basics: NAT and PAT

Address Translation commonly referred to as either NAT or PAT is the process of altering traffic as it passes through a router so that it appears to come from different addresses. Address translation is particularly useful due to the limited supply of IPv4 addresses. Networks can have a much larger number of internal-only addresses behind a smaller number (usually one) public internet address.

The translation process is performed by a router usually on the edge of a network, connecting to an internet service provider. In routed networks usually just the source and destination MAC address are changed as they pass through routers, with address translation the source IP address (and port) is also changed.

Generally speaking, there are two types of address translation:

  • NAT
    Network Address Translation translates the source address to one from a list of public addresses. The downside to this approach is that for each internal host on the network you also need an external address.
  • PAT
    Port Address Translation usually has a single outside IP address and alters the source port when traffic leaves the router, that way traffic can be mapped back to internal addresses

Cisco has a few different NAT configurations depending on the scenario, I’ll cover them in more detail below. Before we get started, let’s assume we have the following configuration:

! Internal interface representing a LAN
interface FastEthernet0/1
 ip address 192.168.1.1 255.255.255.0

! Outside interface representing the internet
interface FastEthernet0/2
 ip address 1.1.1.1 255.255.255.0

The first thing we need to do is specify which interface is inside our network and which is outside:

Router(config)# int Fa0/1
Router(config-if)# ip nat inside
Router(config-if)# int Fa0/2
Router(config-if)# ip nat outside

When executing the “ip nat inside/outside” commands the router may hang for a second, it’s normal behaviour. This doesn’t usually happen in Packet Tracer but may do on production devices.

Dynamic NAT

Dynamic NAT is what was traditionally NAT. Inside hosts are each translated to their own outside address. It’s referred to as dynamic because once communication stops the outside address is freed up for the next internal host.

The first step is to setup a list, or “pool” of outside addresses to be used for translation. Lets say we have 10 addresses from our outside 1.1.1.1/24 network:

Router(config)# ip nat pool DynamicNAT 1.1.1.10 1.1.1.19 netmask 255.255.255.0

With our pool of external addresses assigned, we now need to create an ACL to group together all our inside network addresses that will be translated, in this case the entire 192.168.1.0/24 network:

Router(config)# access-list 1 permit 192.168.1.0 0.0.0.255

Finally we create the dynamic NAT configuration, using our ACL and NAT pool:

Router(config)# ip nat inside source list 1 pool DynamicNAT

If we try and access a web-server on the “outside” interface from a PC on the “inside” interface, we can see the translation taking place on the router:

Router#sh ip nat translations 
Pro  Inside global     Inside local       Outside local      Outside global
tcp 1.1.1.10:1026      192.168.1.2:1026   1.1.1.2:80         1.1.1.2:80

The next client would then get the 1.1.1.11 address and so on.

NAT Overload (PAT)

Overloading allows multiple inside IP addresses to be translated to a single outside address. This works by using the source port numebrs as a method of identifying translated inside addresses.

The first step is to create an ACL to group together all our inside network addresses that will be translated, in this case the entire 192.168.1.0/24 network:

Router(config)# access-list 1 permit 192.168.1.0 0.0.0.255

The next and final step is to configure the router to perform the translations:

Router(config)# ip nat inside source list 1 interface FastEthernet0/2 overload

One of the easy bits of the “ip nat” command to miss is the “overload” bit, without it only the first device to send traffic will be translated.

If we try and access a web-server on the “outside” interface from a PC on the “inside” interface, we can see the translation taking place on the router:

Router#sh ip nat translations 
Pro  Inside global     Inside local       Outside local      Outside global
tcp 1.1.1.1:1025       192.168.1.2:1025   1.1.1.2:80         1.1.1.2:80

Static NAT

Static NAT maps an unspecified source address to a single IP address, typically used for port-forwarding from an external address. This works bidirectionally, so return traffic is automatically translated.

If we want to translate traffic for a web-server running on 192.168.1.100, we’d use the following command:

Router(config)# ip nat inside source static tcp 192.168.1.100 80 1.1.1.1 80

Once that’s in place, we can see the translation in place even when nothing is sending traffic.

Router#sh ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
tcp 1.1.1.1:80         192.168.1.100:80   ---                ---

There is an additional type of NAT not mentioned herein, Overlapping NAT. Overlapping NAT is used when two networks share the same address information need to communicate. I’ll cover that another day.

Published by

Dave Hope

Dave is a Principal Software Analyst for a UK based retirement developer, in his spare time he enjoys digital photography and rock climbing.

Leave a Reply

Your email address will not be published. Required fields are marked *