What NAT does
Network Address Translation changes IP address information as traffic crosses a translating device. It is widely used to let private IPv4 hosts reach external networks and to publish selected internal services.
Important: NAT is not a replacement for a firewall. Translation changes addressing; security policy decides what traffic is allowed.
Types of NAT
| Type | Description | Example use |
|---|---|---|
| Static NAT | One fixed inside address maps to one fixed external address. | Publishing a server or maintaining predictable translation. |
| Dynamic NAT | Inside addresses are translated from a pool. | Legacy designs requiring a pool without port sharing. |
| PAT / overload | Many inside sessions share one or a few external addresses by using transport ports. | Normal office Internet access. |
| Policy / twice NAT | Translation depends on source, destination or service, and may change both sides. | Overlapping networks, VPN and advanced firewall designs. |
Common translation terminology
| Term | Meaning |
|---|---|
| Inside local | Address of the inside host as seen on the inside network. |
| Inside global | Translated address representing the inside host externally. |
| Outside global | Address of the outside host as globally represented. |
| Outside local | Address of the outside host as represented to the inside, which is often unchanged. |
PAT session example
10.0.0.10:51500
203.0.113.5:40001
Internet server:443
Return translation
The device keeps a state table so return traffic sent to the translated address and port can be mapped back to the correct private host and source port.
Basic PAT example
Cisco IOS-style example
access-list 10 permit 10.0.0.0 0.0.0.255 ! interface GigabitEthernet0/0 ip nat inside interface GigabitEthernet0/1 ip nat outside ! ip nat inside source list 10 interface GigabitEthernet0/1 overload
NAT troubleshooting checklist
- Confirm inside/outside interface roles.
- Verify the matching rule, ACL or policy.
- Check route lookup before and after translation according to platform behaviour.
- Inspect active translations and session table.
- Check firewall policy and return-path routing.
- Check whether VPN traffic should be exempted from NAT.
- Watch for overlapping networks, port exhaustion and asymmetric paths.
Useful checks
show ip nat translations show ip nat statistics show access-lists show ip route show logging
Quick self-check
1. Which NAT type allows many hosts to share one public IPv4 address?
Answer: PAT, also called overload.
2. Does NAT automatically permit traffic?
Answer: No. Firewall or ACL policy is separate.
3. What is an inside local address?
Answer: The inside host address as used on the inside network.
4. Why can VPN traffic fail when NAT is enabled?
Answer: The traffic may be translated when the VPN policy expects the original addresses; NAT exemption or policy ordering may be required.
5. What resource can PAT exhaust?
Answer: Available translated source ports and session-table capacity.
Frequently asked questions
1. Does NAT provide encryption?
Answer: No. NAT does not encrypt traffic.
2. Why is PAT common?
Answer: It conserves public IPv4 addresses by distinguishing sessions with ports.
3. Can NAT break applications?
Answer: Yes. Protocols that embed addresses, require inbound sessions or use unusual negotiation may need helpers, explicit rules or application changes.
Standards and further reading
- RFC 3022 — Traditional IP Network Address Translator
- RFC 1918 — Address Allocation for Private Internets
- RFC 4787 — NAT Behavioral Requirements for Unicast UDP
Editorial note: Vendor commands and best-path tie-breakers can differ by platform and software release. Always verify production configuration against the device vendor documentation.