Explain inside local, inside global, outside local and outside global using a real example.
Show the answer
Say this first
"Inside" and "outside" say whose address it is: one of my hosts, or a host out there. "Local" and "global" say where you are looking from: from my inside network, or from the outside. PC1 at 192.168.10.10 browsing to 198.51.100.80 through R1's PAT: inside local is 192.168.10.10, inside global is 203.0.113.2 (R1's outside address), and outside local and outside global are both 198.51.100.80, because I do not translate the far end.
Go deeper
The example
R1 has Gi0/0/1 inside (192.168.10.1/24) and Gi0/0/0 outside (203.0.113.2/29), with PAT on the
outside interface.
| Term | Whose address | Seen from | Value |
|---|---|---|---|
| Inside local | PC1 | inside | 192.168.10.10 |
| Inside global | PC1 | outside | 203.0.113.2 |
| Outside local | the web server | inside | 198.51.100.80 |
| Outside global | the web server | outside | 198.51.100.80 |
The packet walk
- PC1 sends
192.168.10.10:51004 to 198.51.100.80:443: inside local to outside local. - R1 routes it to
Gi0/0/0and rewrites the source:203.0.113.2:51004 to 198.51.100.80:443, which is inside global to outside global. - The reply comes back to 203.0.113.2:51004. R1 rewrites the destination to 192.168.10.10:51004 and routes it inside.
R1# show ip nat translations
Pro Inside global Inside local Outside local Outside global
tcp 203.0.113.2:51004 192.168.10.10:51004 198.51.100.80:443 198.51.100.80:443
Total number of translations: 1The column order is worth memorising: inside global, inside local, outside local, outside global.
When outside local differs
Only with outside NAT, usually for overlapping networks. After a merger the partner's server 10.1.1.50 clashes with our own 10.1.1.0/24, so we make it appear to our users as 172.31.1.50:
ip nat outside source static 10.1.1.50 172.31.1.50 add-routeOutside global is 10.1.1.50 (its real address), outside local is 172.31.1.50 (what our users use).
add-route installs a route to 172.31.1.50 so the router can forward toward it.
They will ask next
Which of the four addresses does PC1 ever see?
Only inside local (itself) and outside local (the far end). The web server only sees inside global and outside global. The router is the one place where all four meet.
Can an inside global address be a private address?
Yes. When you NAT between two private networks, for example toward a partner over a VPN, the inside global can be RFC 1918 space. The terms are about point of view, not public or private.
Traps
- Defining local as private and global as public. It usually works out that way, but the terms mean point of view.
- Getting the column order of show ip nat translations wrong when reading it aloud.