NAT terminology: inside local, inside global, outside local, outside global
NAT introduces four address terms that describe addresses from two perspectives (inside vs outside) and two locations (local = before translation, global = after translation).
Inside local: the actual IP address of an inside host as configured on its interface — typically a private RFC 1918 address (e.g., 192.168.1.10). Inside global: the translated address of an inside host as seen from the outside — typically a public IP address assigned by the ISP (e.g., 203.0.113.5). Outside global: the actual IP address of an outside host (e.g., 8.8.8.8 for Google DNS). Outside local: the translated address of an outside host as seen from the inside — in most implementations, this equals the outside global address since outside addresses are usually not translated.
On the CCNA exam: inside local = private IP of the LAN host. Inside global = public IP that the world sees. Know which address appears in the NAT translation table on each side.
Static NAT
Static NAT creates a permanent one-to-one mapping between an inside local address and an inside global address. One private IP always maps to the same public IP. This is used for servers that must be reachable from the internet with a consistent public address — web servers, mail servers, FTP servers.
Configuration: `ip nat inside source static <inside-local> <inside-global>`. Mark the LAN interface as `ip nat inside` and the WAN interface as `ip nat outside`. The mapping persists regardless of traffic — the inside global IP is always reserved for that one host.
Static NAT requires one public IP per mapped host. If you have 10 servers that need to be reachable from the internet, you need 10 static NAT entries and 10 public IPs.
Dynamic NAT
Dynamic NAT maps inside local addresses to inside global addresses from a pool of public IPs. When an inside host initiates a connection, the router assigns the next available IP from the pool. When the session ends, the public IP is returned to the pool.
Configuration: define the inside hosts with an access list, define the pool of public IPs with `ip nat pool`, and connect them with `ip nat inside source list <acl> pool <pool-name>`.
Dynamic NAT limitation: if all pool IPs are in use and a new host tries to connect, translation fails — the host cannot reach the internet. Dynamic NAT without overload still provides a one-to-one mapping, just dynamic instead of static.
PAT (Port Address Translation / NAT Overload)
PAT is what most people mean when they say 'NAT.' PAT maps multiple inside local addresses to a single inside global address by using port numbers to distinguish sessions. Each translation entry includes source IP, destination IP, source port (translated to a unique port), and destination port.
PAT is configured by adding `overload` to the NAT statement: `ip nat inside source list <acl> interface <outside-interface> overload` or `ip nat inside source list <acl> pool <pool-name> overload`. The `overload` keyword enables port-level multiplexing.
A single public IP can support tens of thousands of simultaneous translations because each session gets a unique source port. This is how a home router shares one ISP-assigned IP among all family devices.
`show ip nat translations` shows active NAT entries. `show ip nat statistics` shows totals and misses. `debug ip nat` shows real-time translation activity — useful for troubleshooting but verbose.