A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
! Step 1: Define inside and outside interfacesR1(config)# interface gigabitEthernet0/0R1(config-if)# ip nat outsideR1(config-if)# exitR1(config)# interface gigabitEthernet0/1R1(config-if)# ip nat insideR1(config-if)# exit! Static NAT — one-to-one mapping for a web serverR1(config)# ip nat inside source static 10.10.10.50 203.0.113.50! Dynamic NAT — a pool of addressesR1(config)# ip nat pool PUBLIC_POOL 203.0.113.10 203.0.113.20 netmask 255.255.255.0! ACL to select which inside traffic gets translatedR1(config)# access-list 1 permit 10.10.10.0 0.0.0.255! Bind the ACL to the poolR1(config)# ip nat inside source list 1 pool PUBLIC_POOL! VerifyR1# show ip nat translationsR1# show ip nat statistics
The commands layer: define the inside/outside boundary (mandatory!), create the pool of public addresses, select which inside traffic gets translated via ACL, and then bind the ACL to the pool. Miss any layer and NAT silently doesn't happen.
Every NAT configuration needs at least one `ip nat inside` and one `ip nat outside` interface. Without them, the router has no idea which traffic to translate and which to leave alone. This is the #1 reason NAT silently fails — the commands all look configured, but no interfaces are marked.
Static NAT maps one inside local IP to one inside global IP, permanently. Use it for servers that need to be reachable from the internet: web servers, mail servers, VPN concentrators. The mapping persists, so external hosts always reach the same internal server via the same public IP.
Dynamic NAT assigns public IPs from a pool on a first-come, first-served basis. If the pool is exhausted, additional clients can't get translated and their traffic is dropped. Because public IPs are expensive and demand is high, almost nobody uses dynamic NAT in practice — PAT is what people mean when they say 'NAT.'
Do not confuse dynamic NAT with PAT. Dynamic NAT: N inside hosts → M public IPs where N and M are similar scales. PAT: many inside hosts → one public IP using ports to differentiate. The exam tests the distinction. The config commands differ: `ip nat inside source list 1 pool POOL` (dynamic) vs `ip nat inside source list 1 interface gi0/0 overload` (PAT).
Each line is one translation. `Inside global` is what the internet sees; `Inside local` is the real internal IP. The outside columns show the destination. For PAT, the port number differs on the inside global side (differentiating clients). For static NAT, the mapping is 1:1 with no port distinction.
Static NAT for servers, dynamic NAT with a pool (rare), and PAT (overload) for everyone else. The key is the inside/outside boundary — miss that, and NAT silently doesn't work. Next lesson goes deep on PAT.
Finish the lesson once you have worked through the material. This awards ★ 15 XP.