What are the types of NAT, and when do you use each one?
Show the answer
Say this first
Static NAT maps one inside address to one global address permanently, in both directions: for servers that must be reachable from outside. Dynamic NAT maps inside hosts one-to-one onto a pool of global addresses, first come first served, and runs out when the pool is used up. PAT (overload) puts many inside hosts behind one global address by translating source ports as well: that is what nearly every office and home router does. Static PAT, or port forwarding, maps one global address and port to one inside host and port.
Go deeper
The base: mark the interfaces
interface GigabitEthernet0/0/0
ip address 203.0.113.2 255.255.255.248
ip nat outside
interface GigabitEthernet0/0/1
ip address 192.168.10.1 255.255.255.0
ip nat inside
interface GigabitEthernet0/0/2
ip address 192.168.20.1 255.255.255.0
ip nat inside
!
ip access-list standard NAT-USERS
permit 192.168.10.0 0.0.0.255Static NAT, one to one
ip nat inside source static 192.168.20.10 203.0.113.5Dynamic NAT from a pool
ip nat pool PUBLIC 203.0.113.3 203.0.113.4 netmask 255.255.255.248
ip nat inside source list NAT-USERS pool PUBLICPAT on the interface address
ip nat inside source list NAT-USERS interface GigabitEthernet0/0/0 overloadUse the PAT line instead of the dynamic pool line, not with it: one rule per access list.
| Type | Mapping | Inbound connections | Typical use |
|---|---|---|---|
| Static | 1 to 1, permanent | yes | servers, devices that need a fixed public identity |
| Dynamic | 1 to 1 from a pool | only while mapped | rare today |
| PAT | many to 1, by port | no | user internet access |
| Static PAT | 1 address and port to 1 host and port | yes, that port only | publishing a service on a shared address |
Policy NAT (ip nat inside source route-map ...) chooses the translation based on destination too,
for example a different address toward a partner network.
They will ask next
What happens when a dynamic NAT pool is used up?
The next host gets no translation and its traffic is dropped until an entry times out. That is why plain dynamic NAT is rare now and PAT is the default.
Why does a server need static NAT rather than PAT?
A connection from the internet needs a mapping that already exists. With PAT, an inbound packet that matches no entry is dropped. Static NAT or static PAT creates the mapping in advance.
Traps
- Forgetting
overload. Without it the interface rule is one-to-one, so only one inside host at a time gets out.