How does PAT let thousands of hosts share one public IP address?
Show the answer
Say this first
PAT tracks each connection by address and port, not by address alone. R1 rewrites the source address to its global address and, when it has to, the source port too, so every inside connection gets a unique global address and port. Replies come back to that pair and R1 looks up which inside host and port it belongs to. One global address has roughly 64,000 usable ports per protocol, and each entry lives only as long as its timer.
Go deeper
A busy translation table
R1# show ip nat translations
Pro Inside global Inside local Outside local Outside global
tcp 203.0.113.2:51004 192.168.10.10:51004 198.51.100.80:443 198.51.100.80:443
tcp 203.0.113.2:49731 192.168.10.11:49731 198.51.100.80:443 198.51.100.80:443
udp 203.0.113.2:61812 192.168.10.12:61812 198.51.100.53:53 198.51.100.53:53
icmp 203.0.113.2:1 192.168.10.10:1 198.51.100.80:1 198.51.100.80:1
Total number of translations: 4Three hosts, one global address. ICMP echo has no ports, so PAT uses the ICMP query identifier in their place.
Port choice on classic IOS
IOS keeps the original source port when it is free on the global address. If it is taken, it picks
the first free port in the same group: below 512, 512 to 1023, or 1024 and up. With a pool and
overload, it moves to the next global address when one runs out of ports.
Timers (IOS defaults)
| Entry | Timeout |
|---|---|
| TCP | 86400 s (24 hours) |
| TCP after FIN or RST | 60 s |
| UDP | 300 s |
| DNS | 60 s |
| ICMP | 60 s |
Tuned with ip nat translation tcp-timeout, udp-timeout and friends. A long TCP timer means
abandoned connections hold ports. A short UDP timer breaks quiet VoIP and VPN flows.
They will ask next
How many users can share one public address?
Plan by concurrent connections, not users. If users average around 300 flows each, 64,000 ports is a couple of hundred users. Add addresses to the pool with
overloadbefore you get close.Why do VoIP phones behind PAT sometimes stop receiving calls?
Their mapping expired during a quiet period, so the provider's inbound INVITE matches no entry. Phones send registration or keepalive packets more often than the NAT UDP timeout to keep it alive.
Traps
- Saying PAT always changes the source port. IOS keeps it when it is free.