Octet

Say this first

In order: the interfaces are marked ip nat inside and ip nat outside on the right sides; the NAT access list matches the users' real source addresses; there is a default route out the outside interface; translations appear in show ip nat translations when a user tries; and the ISP routes the global address back to me. show ip nat statistics and a filtered debug ip nat usually point at the broken piece within minutes.

Go deeper

Symptom to cause

Symptom	Likely cause
No translations created at all	interface roles missing or swapped, ACL does not match, traffic not routed out the outside interface
Translations created, no replies	ISP not routing the pool addresses back, upstream filtering
Some users work, others do not	ACL covers only part of the range, or a dynamic pool without `overload` is full
VPN broke when NAT was added	no NAT exemption for VPN traffic
Inbound to a server fails	ACL written with the private address, wrong static entry, server gateway

Read the statistics

Output

R1# show ip nat statistics
Total active translations: 3 (1 static, 2 dynamic; 2 extended)
Outside interfaces:
  GigabitEthernet0/0/0
Inside interfaces:
  GigabitEthernet0/0/1, GigabitEthernet0/0/2
Hits: 1520  Misses: 4
Expired translations: 2
Dynamic mappings:
-- Inside Source
[Id: 1] access-list NAT-USERS interface GigabitEthernet0/0/0 refcount 2

The interface lists catch swapped roles. The dynamic mapping shows which ACL and target are in use.

Watch it happen

Filter the debug with a numbered ACL that matches one test host:

Cisco IOS

R1(config)# access-list 99 permit 192.168.10.10
R1# debug ip nat 99

Lines like NAT*: s=192.168.10.10->203.0.113.2, d=198.51.100.80 prove the translation. Outbound lines with no return lines put the problem upstream.

Classic ACL mistakes

A subnet mask where a wildcard belongs: permit 192.168.10.0 255.255.255.0 matches the wrong addresses.
permit any: the router starts translating traffic it should not, such as VPN and its own management traffic.

They will ask next

You fixed the NAT ACL, but some hosts still behave the old way. Why?
Existing translations stay until they expire, and TCP entries last 24 hours by default. clear ip nat translation * removes the dynamic entries, but it also cuts every session through them, so do it in a window.
The pool addresses are not on the outside interface subnet. What extra step is needed?
The ISP must route that block to your outside address. If the pool addresses are inside the outside interface subnet, the router answers ARP for them itself.

Traps

Running an unfiltered debug ip nat on a busy router.

How did you do?Book 3.3 Internet (IP)