NAT and PAT on IOS XE routers

Why this matters

Almost every office, branch and home network uses private IPv4 addresses inside, from the RFC 1918 ranges, and reaches the internet through one or a few public addresses rented from an ISP. The device that makes that possible is the edge router, translating addresses as packets cross it. A junior network engineer configures this on every new branch router, publishes the odd internal server to the internet, and is the first person called when "the internet is down for some users but not others".

NAT faults are easy to cause and confusing to read. Mark the interfaces the wrong way round and nothing is translated. Write a wildcard that misses half the LAN and only some hosts get out. Build a dynamic pool without the overload keyword and the fifth user of the morning cannot browse. Each of these shows up clearly in two show commands, once you know the four address names NAT uses.

The lesson

Configuring NAT and PAT on an IOS XE router

Network Address Translation (NAT) rewrites the addresses in a packet's IP header as it passes through a router. In this lesson the router rewrites the source address of packets going from the private inside network to the outside, and reverses the change on the replies. Port Address Translation (PAT), also called NAT overload, rewrites the source port too, so many inside hosts can share one public address.

All examples use an IOS XE edge router, R1, with Gi0/0/0 facing the LAN and Gi0/0/1 facing the ISP. Interface names on IOS XE routers have three parts: slot, subslot and port.

The four address names

NAT describes every address from two points of view: which side of the router the host is on (inside or outside), and which side of the router the address is seen from (local or global).

A host configured as 192.168.1.25, translated to 203.0.113.25 on its way to a web server at 198.51.100.80, has an inside local address of 192.168.1.25 and an inside global address of 203.0.113.25. The server's outside global address is 198.51.100.80. In ordinary inside source NAT, the outside local and outside global addresses are the same, because nobody rewrites the server's address.

Step 1: mark the interfaces

NAT only acts on packets that cross from an interface marked inside to one marked outside, or back. The LAN interface, where the private hosts live, is inside. The ISP interface is outside.

R1(config)#interface GigabitEthernet0/0/0
R1(config-if)#ip address 10.1.1.1 255.255.255.0
R1(config-if)#ip nat inside
R1(config-if)#exit
R1(config)#interface GigabitEthernet0/0/1
R1(config-if)#ip address 203.0.113.5 255.255.255.248
R1(config-if)#ip nat outside

Reversing these makes the router translate in the wrong direction, and traffic from the LAN leaves with its private source address, which the internet drops.

Static NAT: one inside host, one public address

Static NAT creates a permanent one-to-one mapping. It is used for servers that outside users must reach, because the entry exists all the time, so outside hosts can open sessions to the inside host. Static entries never time out and never take the overload keyword.

R1(config)#ip nat inside source static 10.1.1.50 203.0.113.50

The order is inside local first, inside global second. This maps the internal mail server 10.1.1.50 to 203.0.113.50 in both directions. Writing the addresses the other way round tells the router the server is configured with the public address.

A static port translation publishes one service rather than a whole host, leaving the public address free for PAT at the same time:

R1(config)#ip nat inside source static tcp 192.168.5.10 443 203.0.113.9 443

The order is protocol, inside local address and port, inside global address and port. Outside users browse to 203.0.113.9 on TCP 443 and reach the web server at 192.168.5.10. Writing udp would forward the wrong protocol for a server that listens on TCP.

Dynamic NAT: a pool, one address per host

Dynamic NAT takes inside global addresses from a pool as hosts need them. An ACL says which inside hosts may be translated. Here the hosts of a second inside LAN, 10.1.2.0/24, share a pool of public addresses.

R1(config)#ip nat pool PUB 198.51.100.65 198.51.100.94 netmask 255.255.255.224
R1(config)#access-list 2 permit 10.1.2.0 0.0.0.255
R1(config)#ip nat inside source list 2 pool PUB

Without the overload keyword, each inside host gets its own pool address for as long as its translation lasts. Once every address is in use, the next host waits until a translation times out. If the pool has four addresses and four hosts are active, a fifth host cannot reach the internet. That is pool exhaustion, not an ACL or interface fault: a missing ip nat outside would stop every host, not only the fifth.

Worked example: the end of a pool. The pool must use every usable address in 198.51.100.64/27.

1. A /27 leaves 5 host bits, so the block holds 2^5 = 32 addresses.
2. The block runs from 198.51.100.64 to 198.51.100.64 + 31 = 198.51.100.95.
3. .64 is the network address and .95 the broadcast address. The usable range is .65 to .94.
4. So the pool is 198.51.100.65 198.51.100.94. Ending at .95 would hand out the broadcast address.

Worked example: how many hosts at once. An ISP assigns 203.0.113.16/28. A /28 holds 16 addresses, from .16 to .31. Removing the network address .16 and the broadcast address .31 leaves 14 usable addresses. Without overload, dynamic NAT maps one inside host to each, so 14 hosts can be translated at once.

Worked example: the ACL wildcard. The NAT ACL must match every inside host in 172.16.32.0/20 and nothing else.

1. A /20 mask is 255.255.240.0.
2. Subtract each octet from 255: 0, 0, 15, 255. The wildcard is 0.0.15.255.
3. The block size in the third octet is 16, so the range is 172.16.32.0 to 172.16.47.255.
4. The statement is access-list 1 permit 172.16.32.0 0.0.15.255. ACLs take wildcards: writing the mask 255.255.240.0 in its place matches the wrong addresses. Lesson 22 covers wildcards in ACLs in full.

PAT: many hosts, one address

PAT is what almost every branch actually runs. The overload keyword tells the router to track each session by its source port as well as its address, so thousands of sessions can share one inside global address. The simplest form borrows the address of the outside interface:

R1(config)#access-list 1 permit 10.1.1.0 0.0.0.255
R1(config)#ip nat inside source list 1 interface GigabitEthernet0/0/1 overload

The interface keyword makes Gi0/0/1's own address, 203.0.113.5, the inside global address, which suits an ISP link that gets its address by DHCP. Naming Gi0/0/0 instead would borrow the private LAN address, which cannot be routed on the internet. PAT can also overload a pool: ip nat inside source list 1 pool PUB overload.

Verifying translations

R1#show ip nat translations
Pro  Inside global      Inside local       Outside local      Outside global
tcp  203.0.113.5:51544  10.1.1.20:51544    198.51.100.7:443   198.51.100.7:443
tcp  203.0.113.5:1024   10.1.1.21:51544    198.51.100.7:443   198.51.100.7:443

Both inside local addresses map to the same inside global address, 203.0.113.5, told apart only by port. That is PAT. Notice the second host used the same source port, 51544, as the first, so the router changed it to 1024 to keep the two sessions distinct. The outside columns are identical, because the server's address is not rewritten. Dynamic NAT without overload would show a different inside global address on each line. A static entry shows with dashes in the outside columns when no session is active:

Pro  Inside global      Inside local       Outside local      Outside global
---  203.0.113.50       10.1.1.50          ---                ---

The statistics command shows which interfaces are inside and outside, plus the counters:

R1#show ip nat statistics
Total active translations: 2 (0 static, 2 dynamic; 2 extended)
Outside interfaces:
  GigabitEthernet0/0/1
Inside interfaces:
  GigabitEthernet0/0/0
Hits: 1547  Misses: 12
Expired translations: 9
Dynamic mappings:
-- Inside Source
[Id: 1] access-list 1 interface GigabitEthernet0/0/1 refcount 2

Hits are packets that matched an existing translation. Misses are packets that needed a new one to be created. show ip nat translations lists the individual entries but not the interfaces or the counters. clear ip nat translation * removes the dynamic entries, which helps after changing the configuration, and debug ip nat shows each translation as it happens, on a lab router or with great care.

Troubleshooting NAT

When inside hosts get no translations at all, check these in order:

1. Is the LAN interface marked ip nat inside? NAT only translates packets that arrive on an inside interface.
2. Does the ACL match the hosts? A NAT rule for list 10 does nothing for hosts in 10.10.0.0/16 if list 10 permits some other range.
3. Is the outside interface marked ip nat outside, and does the NAT command name the right interface or pool?
4. Is there a route out? NAT happens only for packets the router routes to the outside interface, usually by a default route (lesson 14).

One order-of-operations detail matters for security. For a packet entering the outside interface, the router checks an inbound ACL before NAT translates the destination back. So an ACL on Gi0/0/1 permitting replies to host 10.1.1.20, translated to 203.0.113.5, must match 203.0.113.5, the inside global address. The inside local address appears only after translation.

What the exam is really asking

• Local versus global. Inside local is what the host has; inside global is what the internet sees. Outside local and global are the same in ordinary source NAT.
• Inside faces the private hosts. ip nat inside on the LAN, ip nat outside towards the ISP.
• Static order. ip nat inside source static <inside local> <inside global>; for a port, protocol, then inside address and port, then global address and port.
• Overload is the PAT switch. Without it, a pool serves one host per address; with it, one address serves many.
• Pool arithmetic. Count usable addresses, and never include the network or broadcast address.
• Wildcards, not masks, in the ACL.
• Two show commands. Translations for the entries; statistics for interfaces, hits and misses.
• Outside ACLs see global addresses. Inbound filtering on the outside happens before NAT.