Lab - Implement NAT
Topology
Addressing Table
Device Interface IP Address Default Gateway
R1 G0/0/0 [Link]/24 N/A
N/A
R1
G0/0/1 [Link]/24
R2 G0/0/0 [Link]/24 N/A
N/A
R2
G0/0/1 [Link]/24
N/A
R2
Loopback0 [Link]/24
R3 G0/0/0 [Link]/24 N/A
N/A
R3
G0/0/1 [Link]/24
D1 VLAN 1 [Link]/24 N/A
D2 VLAN 1 [Link]/24 N/A
PC1 NIC [Link]/24 [Link]
PC3 NIC [Link]/24 [Link]
PC4 NIC [Link]/24 [Link]
Objectives
Part 1: Build the Network and Configure Basic Device Settings
© 2020 - 2026 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 1 of 10
-
Lab - Implement NAT
Part 2: Configure and Verify Static Inside NAT
Part 3: Configure and Verify Dynamic NAT
Part 4: Configure and Verify PAT
Background / Scenario
The HQ and Branch sites must be configured to support NAT. Specifically, the HQ and Branch routers will be
configured to provide inside LAN users with outside public addresses using NAT. The HQ router will also
provide static NAT to access the email server from the outside network.
Note: This lab is an exercise in configuring and verifying various methods of NAT and does not reflect
networking best practices.
Note: The routers and switches used with CCNP hands-on labs are Cisco 8200L and Cisco 9300L, both with
Cisco IOS XE Release 17.12.05 (universalk9 image). Other routers and Cisco IOS versions can be used.
Depending on the model and Cisco IOS version, the commands available and the output produced might vary
from what is shown in the labs.
Note: Ensure that the routers and switches have been erased and have no startup configurations. If you are
unsure contact your instructor.
Required Resources
• 3 Routers (Cisco 8200L with Cisco IOS XE Release 17.12.05c universal image or comparable)
• 2 Switches (Cisco 9300L with Cisco IOS XE Release 17.12.05 universal image or comparable)
• 3 PCs (Choice of operating system with a terminal emulation program installed)
• Console cables to configure the Cisco IOS devices via the console ports
• Ethernet and serial cables as shown in the topology
Instructions
Part 1: Build the Network and Configure Basic Device Settings
In Part 1, you will set up the network topology and configure basic settings.
Step 1: Cable the network as shown in the topology.
Attach the devices as shown in the topology diagram and cable as necessary.
Step 2: Configure basic settings for each device.
a. Console into each device, enter global configuration mode, and apply the basic settings. A command list
for each device is provided below for the initial configurations.
Open configuration window
Router R1
hostname R1
no ip domain lookup
line con 0
exec-timeout 0 0
logging synchronous
exit
line vty 0 4
privilege level 15
© 2020 - 2026 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 2 of 10
-
Lab - Implement NAT
password cisco123
exec-timeout 0 0
logging synchronous
login
exit
banner motd # This is R1, Implement NAT Lab #
interface g0/0/0
ip address [Link] [Link]
no shut
exit
interface g0/0/1
ip address [Link] [Link]
no shut
exit
ip route [Link] [Link] g0/0/0 [Link]
Router R2
hostname R2
no ip domain lookup
line con 0
exec-timeout 0 0
logging synchronous
exit
line vty 0 4
privilege level 15
password cisco123
exec-timeout 0 0
logging synchronous
login
exit
banner motd # This is R2, Implement NAT Lab #
interface g0/0/0
ip address [Link] [Link]
no shut
exit
interface g0/0/1
ip address [Link] [Link]
no shut
exit
interface loopback 0
ip address [Link] [Link]
no shut
exit
ip route [Link] [Link] g0/0/0 [Link]
ip route [Link] [Link] g0/0/1 [Link]
© 2020 - 2026 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 3 of 10
-
Lab - Implement NAT
Router R3
hostname R3
no ip domain lookup
line con 0
exec-timeout 0 0
logging synchronous
exit
line vty 0 4
privilege level 15
password cisco123
exec-timeout 0 0
logging synchronous
login
exit
banner motd # This is R3, Implement NAT Lab #
interface g0/0/0
ip address [Link] [Link]
no shut
exit
interface g0/0/1
ip address [Link] [Link]
no shut
exit
ip route [Link] [Link] g0/0/0 [Link]
Switch D1
hostname D1
no ip domain lookup
line con 0
exec-timeout 0 0
logging synchronous
exit
line vty 0 4
privilege level 15
password cisco123
exec-timeout 0 0
logging synchronous
login
exit
banner motd # This is D1, Implement NAT Lab #
interface range g1/0/1-24, g1/1/1-4, g0/0
shutdown
exit
interface range g1/0/11, g1/0/23
no shutdown
© 2020 - 2026 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 4 of 10
-
Lab - Implement NAT
exit
interface g1/0/23
switchport mode access
spanning-tree portfast
exit
interface vlan 1
ip address [Link] [Link]
no shutdown
ip default-gateway [Link]
username admin secret cisco123
line vty 0 15
login local
Switch D2
hostname D2
no ip domain lookup
line con 0
exec-timeout 0 0
logging synchronous
exit
line vty 0 4
privilege level 15
password cisco123
exec-timeout 0 0
logging synchronous
login
exit
banner motd # This is D2, Implement NAT Lab #
interface range g1/0/1-24, g1/1/1-4, g0/0
shutdown
exit
interface range g1/0/11, g1/0/23-24
no shutdown
exit
interface range g1/0/23-24
switchport mode access
spanning-tree portfast
exit
interface vlan 1
ip address [Link] [Link]
no shutdown
ip default-gateway [Link]
b. Set the clock on each device to UTC time.
c. Save the running configuration to startup-config.
Close configuration window
© 2020 - 2026 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 5 of 10
-
Lab - Implement NAT
Step 3: Verify reachability.
PC1 ([Link]) should be able to ping PC3 ([Link]) and PC4 ([Link]). PC4 should be able to ping
switch D1 ([Link]). If not, troubleshoot as necessary.
Part 2: Configure and Verify Static Inside NAT
In Part 2, you will configure and verify Static Inside NAT. The idea behind Static Inside NAT is to make an
inside local address reachable via an outside global address. For this lab, we will make interface VLAN 1 on
switch D1 appear as [Link] on the outside network.
Step 1: On R1, configure Static Inside NAT.
Note: The following steps a and b do not have to be carried out in the order listed.
a. Configure R1 to translate the address on D1 Interface VLAN 1 to [Link].
Open configuration window
R1(config)# ip nat inside source static [Link] [Link]
b. On R1, specify the inside and outside interfaces for NAT purposes.
R1(config)# interface g0/0/0
R1(config-if)# ip nat outside
R1(config-if)# exit
R1(config)# interface g0/0/1
R1(config-if)# ip nat inside
R1(config-if)# exit
Step 2: Verify the NAT process is occurring on R1.
a. On R1, issue the command show ip nat translations. In the output, you will see the static translation
information.
R1# show ip nat translations
Pro Inside global Inside local Outside local Outside global
--- [Link] [Link] --- ---
Total number of translations: 1
b. From the console of R2, send 10,000 pings to the destination address [Link] using the
command ping [Link] repeat 10000. The pings should be successful.
c. On R1, issue the command show ip nat translations. In the output, you will see the static translation as
well as the translation used for the ping.
R1# show ip nat translations
Pro Inside global Inside local Outside local Outside global
--- [Link] [Link] --- ---
icmp [Link]:0 [Link]:0 [Link]:0 [Link]:0
Total number of translations: 2
d. From the console of R2, stop the ping if it is still running and then establish an SSH session to
[Link]. You should be able to connect and login to D1. Use the username admin and cisco123
as the password when prompted.
e. While logged in to D1, issue the command show tcp brief. In the output, you will see the addresses
involved in the communication from D1’s perspective.
D1# show tcp brief
TCB Local Address Foreign Address (state)
054D9734 [Link].23 [Link].63955 ESTAB
© 2020 - 2026 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 6 of 10
-
Lab - Implement NAT
f. On R1, issue the command show ip nat translations. In the output, you will see the static translation as
well as the translation used for the SSH session.
R1# show ip nat translations
Pro Inside global Inside local Outside local Outside global
--- [Link] [Link] --- ---
tcp [Link]:22 [Link]:22 [Link]:63955 [Link]:63955
Total number of translations: 2
g. On R2, enter exit to disconnect the SSH session to D1 in preparation for the next part of the lab.
Close configuration window
Part 3: Configure and Verify Dynamic NAT
In Part 3, you will configure, examine, and verify dynamic NAT. Dynamic NAT uses a pool of available outside
addresses to dynamically translate inside addresses on a one-to-one basis. The drawback to dynamic NAT is
that if you do not have a pool of addresses that is at least the same size as the number of addresses that
need to be translated, there will be inside hosts that cannot send traffic outside until a translation times out or
is manually cleared.
Step 1: On R3, configure Dynamic NAT.
Note: The following steps a, b, c, and d do not have to be carried out in the order listed.
a. On R3, create a standard access list that identifies the source addresses of traffic to be translated. Traffic
with source addresses matching this access list are referred to as “interesting” and will be processed
through the configured NAT rule. For this lab, specify the entire [Link]/24 network as interesting.
Open configuration window
R3(config)# access-list 33 permit [Link] [Link]
b. Next, create a pool of addresses to use for the interesting traffic translations. You should have authority to
use these addresses, and outside networks should route traffic destined to these addresses to you. For
this lab, we will use two addresses from the subnet connecting R3 and R2.
R3(config)# ip nat pool DYNAMIC-NAT [Link] [Link] prefix-length 24
c. Associate the interesting addresses with the NAT pool.
R3(config)# ip nat inside source list 33 pool DYNAMIC-NAT
d. Establish the inside and outside interfaces on R3.
R3(config)# interface g0/0/0
R3(config-if)# ip nat outside
R3(config-if)# exit
R3(config)# interface g0/0/1
R3(config-if)# ip nat inside
R3(config-if)# exit
Step 2: Verify the NAT process is occurring on R3.
a. On R3, issue the command show ip nat translations. The output will indicate that there are no
translations.
b. On R3, issue the command show ip nat pool name DYNAMIC-NAT. The output will give you details
about the pool that is available for translation.
R3# show ip nat pool name DYNAMIC-NAT
NAT Pool Statistics
© 2020 - 2026 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 7 of 10
-
Lab - Implement NAT
Pool name DYNAMIC-NAT, id 1
Assigned Available
Addresses 0 2
UDP Low Ports 0 1024
TCP Low Ports 0 1024
UDP High Ports 0 129024
TCP High Ports 0 129024
(Low ports are less than 1024. High ports are greater than or equal to 1024.)
c. From the command prompt on PC3, start a continuous ping to the destination address [Link].
The pings should be successful.
d. On R3, issue the command show ip nat translations. In the output you will see the pooled translation as
well as the translation used for the ping.
R3# show ip nat translations
Pro Inside global Inside local Outside local Outside global
--- [Link] [Link] --- ---
icmp [Link]:1 [Link]:1 [Link]:1 [Link]:1
Total number of translations: 2
e. From the command prompt on PC4, start a continuous ping to the destination address [Link].
The pings should be successful.
f. On R3, issue the command show ip nat translations. In the output you will see the dynamic translations
as well as the translation used for the ping.
R3# show ip nat translations
Pro Inside global Inside local Outside local Outside global
--- [Link] [Link] --- ---
--- [Link] [Link] --- ---
icmp [Link]:6740 [Link]:6740 [Link]:6740 [Link]:6740
icmp [Link]:1 [Link]:1 [Link]:1 [Link]:1
Total number of translations: 4
g. From the console of D2, send 10,000 pings to the destination address [Link] using the command
ping [Link] repeat 10000. The pings should fail.
h. On R3, you should see the following syslog message being repeated:
Sep 29 21:53:17.285: %NAT-6-ADDR_ALLOC_FAILURE: Address allocation failed; pool 1 may
be exhausted [2] port range: NA, non-PATable: NO, for ALG: NO, input intf:
GigabitEthernet0/0/1, mapping-id: 1, created by pkt: src_ip [Link] dst_ip
[Link] src_port 0 dst_port 0 proto 1QFP:0.0 Thread:000 TS:00000003573907612846
We purposely created a pool of addresses that was too small to demonstrate one of the shortcomings of
dynamic NAT. Verify the pool is exhausted by examining the output of the command show ip nat pool
name DYNAMIC-NAT.
R3# show ip nat pool name DYNAMIC-NAT
NAT Pool Statistics
Pool name DYNAMIC-NAT, id 1
Assigned Available
Addresses 2 0
UDP Low Ports 0 1024
© 2020 - 2026 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 8 of 10
-
Lab - Implement NAT
TCP Low Ports 0 1024
UDP High Ports 0 129024
TCP High Ports 0 129024
(Low ports are less than 1024. High ports are greater than or equal to 1024.)
i. Stop the pings on D2, PC3, and PC4. (Note: To stop the ping, press Ctr+Shift+6.)
j. In preparation for the next part of the lab, remove the pool and mapping commands. Leave the ACL and
the interface specifications.
R3# clear ip nat translation *
R3# conf t
R3(config)# no ip nat inside source list 33 pool DYNAMIC-NAT
R3(config)# no ip nat pool DYNAMIC-NAT [Link] [Link] prefix-
length 24
Close configuration window
Part 4: Configure and Verify PAT
In Part 4, you will configure and examine NAT Overload, which is also called Port Address Translation or
PAT. PAT overloads on an interface address or on a pool of addresses by associating each traffic session
with a unique set of port numbers. The advantage, especially for smaller networks, is that everyone can get
out of the network by leveraging a single outside IP address. The drawback to PAT is that you have a limit of
about 65,000 to the number of translations possible via a single address. The impact of this limit is felt in large
networks, where you must have multiple outside IP addresses to overload onto to ensure everyone can
communicate.
As a reminder, R3 still has interfaces setup as outside and inside, and still has access list 33 specifying the
LAN network address. You will leverage those existing configurations to complete this part of the lab.
For this lab, R3 will overload on the interface specified as outside, which is g0/0/0.
a. Configure the NAT statement directing the router to translate addresses matching access list 33 to the
outside interface IP address, keying on port numbers.
Open configuration window
R3(config)# ip nat inside source list 33 interface g0/0/0 overload
b. On R3, issue the command show ip nat translations. The output will indicate that there are no
translations.
c. From the command prompt on PC3, start a continuous ping to the destination address [Link].
The pings should be successful.
d. On R3, issue the command show ip nat translations. In the output you will see the PAT translation used
for the ping.
R3# show ip nat translations
Pro Inside global Inside local Outside local Outside global
icmp [Link]:1 [Link]:1 [Link]:1 [Link]:1
Total number of translations: 1
e. From the command prompt on PC4, start a continuous ping to the destination address [Link].
From the console of D2, send 100,000 pings to the same address. The pings should be successful.
f. On R3, issue the command show ip nat translations. In the output you will see the PAT translations as
well as the translation used for the ping from D2 and PC4.
R3# show ip nat translations
Pro Inside global Inside local Outside local Outside global
icmp [Link]:6791 [Link]:6791 [Link]:6791 [Link]:6791
icmp [Link]:1 [Link]:1 [Link]:1 [Link]:1
© 2020 - 2026 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 9 of 10
-
Lab - Implement NAT
icmp [Link]:6784 [Link]:1 [Link]:1 [Link]:6784
Total number of translations: 3
Close configuration window
e. Stop the continuous pings on D2, PC3, and PC4.
End of document
© 2020 - 2026 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 10 of 10