NAT and PAT Configuration on Cisco Routers: A Simple Guide for Beginners

 NAT (Network Address Translation) lets devices with private IP addresses reach the internet using a public IP address. Almost every home and company network uses it. PAT (Port Address Translation) is the most common type, and it allows many devices to share one public IP address.

In this guide, you will learn what NAT and PAT are, the three types of NAT, and how to configure and verify each one on a Cisco router.

NAT and PAT in One Minute

• NAT: Changes the IP address of a packet as it passes through a router.
• Why: Private IP addresses cannot be used on the internet, and public IPv4 addresses are limited.
• Static NAT: One private address to one public address.
• Dynamic NAT: Private addresses use a pool of public addresses.
• PAT (NAT overload): Many private addresses share one public address by using different port numbers.

Why Do We Need NAT?

Home and company networks use private IP addresses, such as 192.168.1.10. These addresses are not routable on the internet. If you want to learn more about them, read our guide on IP Address Classes A, B, and C Explained.

There are also not enough public IPv4 addresses for every device. NAT solves both problems. The router replaces the private address with a public address before the packet goes to the internet, and it reverses the change for the reply.

As a side benefit, NAT hides the private addresses from the outside. But NAT is not a firewall, so you still need proper security rules.

NAT Terms in Simple Words

Cisco uses four terms. For a beginner, these two are the most important:

Term	Meaning
Inside local	The private address of the inside device
Inside global	The public address that represents it

The other two, outside local and outside global, describe the destination device. In most simple setups, they are the same public address of the destination.

Types of NAT

Type	Mapping	Common use
Static NAT	One to one	Servers
Dynamic NAT	Many to many (pool)	Small public pools
PAT	Many to one (ports)	Most networks

How PAT Works

PAT uses port numbers to tell the devices apart. Imagine two PCs both use source port 50001 to browse the web:

• PC1 192.168.10.5:50001 becomes 203.0.113.2:50001.
• PC2 192.168.10.6:50001 becomes 203.0.113.2:50002.

Both PCs share the same public IP address, but the router gives them different port numbers. When the reply comes back, the router checks the port number and sends it to the right PC.

To learn more about ports, read our guide on Common Network Ports and Protocols. You can also read TCP vs UDP: Key Differences Explained for Beginners.

Example Network

We will use this network on router R1:

Item	Value
LAN network	192.168.10.0/24
LAN interface	G0/0 (inside)
WAN interface	G0/1 (outside)
WAN address	203.0.113.2/28
ISP router	203.0.113.1
Internal server	192.168.10.10

The addresses 203.0.113.x are example public addresses used for documentation.

Step 1: Mark the Inside and Outside Interfaces

Every NAT type needs this step. Tell the router which interface faces the LAN and which faces the internet.

R1(config)# interface g0/0
R1(config-if)# ip nat inside
R1(config-if)# exit
R1(config)# interface g0/1
R1(config-if)# ip nat outside
R1(config-if)# exit

Also add a default route toward the ISP, so the router knows where to send internet traffic:

R1(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.1

Static NAT Configuration

Goal: Make the internal server 192.168.10.10 reachable from the internet as 203.0.113.10.

R1(config)# ip nat inside source static 192.168.10.10 203.0.113.10

This creates a permanent one-to-one mapping. Internet users connect to 203.0.113.10, and the router forwards the traffic to the server.

Dynamic NAT Configuration

Goal: Let LAN devices use a pool of public addresses from 203.0.113.3 to 203.0.113.6.

R1(config)# access-list 1 permit 192.168.10.0 0.0.0.255
R1(config)# ip nat pool PUBLIC-POOL 203.0.113.3 203.0.113.6 netmask 255.255.255.240
R1(config)# ip nat inside source list 1 pool PUBLIC-POOL

How it works:

1. The ACL selects which inside addresses can be translated. If ACLs are new to you, we will cover them in our guide on Standard and Extended ACLs on Cisco Routers.
2. The pool defines the public addresses available.
3. The last command connects the ACL and the pool.

The limit is the pool size. Here, only four devices can use the internet at the same time. The fifth device must wait until a mapping expires.

PAT Configuration (NAT Overload)

Goal: Let every device in the LAN share the WAN interface address.

R1(config)# access-list 1 permit 192.168.10.0 0.0.0.255
R1(config)# ip nat inside source list 1 interface g0/1 overload

The word overload is what turns NAT into PAT. This is the configuration most small and medium networks use.

If you have a public pool instead of one address, use:

R1(config)# ip nat inside source list 1 pool PUBLIC-POOL overload

If you are not sure how the wildcard mask 0.0.0.255 works, read our guide on Subnetting Step by Step: A Simple Guide for Beginners.

How to Verify NAT

Use these commands:

show ip nat translations
show ip nat statistics

• show ip nat translations shows the active mappings between inside and outside addresses.
• show ip nat statistics shows the interfaces, the number of translations, and the number of hits and misses.

Example output for PAT:

Pro  Inside global       Inside local        Outside global
tcp  203.0.113.2:50001   192.168.10.5:50001  198.51.100.20:80

To clear the translation table when you test, use:

clear ip nat translation *

Be careful with this command on a live network, because it interrupts active sessions.

Common NAT Problems

• Forgot ip nat inside or ip nat outside: NAT does nothing without both.
• Interfaces swapped: The inside and outside commands are on the wrong interfaces.
• Wrong ACL or wildcard mask: The ACL does not match your LAN addresses.
• No default route: The router does not know where to send internet traffic.
• Pool exhausted (dynamic NAT): All public addresses in the pool are in use. Use PAT instead.
• Forgot overload: You get dynamic NAT instead of PAT.

Frequently Asked Questions

What is NAT?

NAT is a function on a router or firewall that changes IP addresses in packets, usually to let private addresses reach the internet.

What is the difference between NAT and PAT?

NAT maps one address to another address. PAT lets many private addresses share one public address by using different port numbers.

What is NAT overload?

It is another name for PAT. On Cisco devices, you create it by adding overload to the NAT command.

Does NAT make my network secure?

NAT hides private addresses from the outside, but it is not a firewall. You still need ACLs or a dedicated firewall such as FortiGate.

Do I need NAT with IPv6?

Usually no. IPv6 has enough addresses for every device, so NAT is not needed for address shortage.

Which type of NAT is the most common?

PAT. It is used on home routers and in most company networks.

Conclusion

NAT and PAT let private networks connect to the internet using public addresses. Use static NAT for servers, dynamic NAT for small public pools, and PAT for most networks. Remember the key steps: mark the inside and outside interfaces, define which addresses to translate, and verify with show ip nat translations.

To practice, build the example network in Cisco Packet Tracer and test each type.

Next on BayteNet: Spanning Tree Protocol (STP) Explained.

Leave a comment if you have any questions!