What Is Network Address Translation (NAT) and How Does It Work?
Selene Gong
Network Address Translation (NAT) allows private networks to communicate with public networks, like the internet, by translating private IP addresses to public IP addresses. It helps conserve IPv4 address space, adds a layer of security by hiding internal IP structures, and enables seamless internet access for devices within private networks.
What Is Network Address Translation (NAT)?
NAT modifies IP address information in packet headers as traffic moves through a router or firewall, translating private IP addresses to public IP addresses and vice versa. This allows devices in private networks (home, branch, data centers) to access the internet while conserving global IP address space.
Why Do We Need NAT?
Address Conservation: IPv4 provides around 4.3 billion addresses, which is insufficient for today’s devices. NAT allows entire private networks to use a single public IP address for internet access, reducing the need for multiple public IP addresses.
Privacy and Basic Security: NAT hides internal IP addresses from the public internet, providing a layer of security by preventing unsolicited incoming connections unless explicitly configured.
Enabling Private and Public IP Communication: Private IP addresses (defined in RFC 1918) cannot route on the public internet. NAT bridges this gap, allowing private devices to communicate with public servers.
Types of NAT
Type
Description
Use Case
Static NAT
One private IP maps permanently to one public IP
Hosting internal servers needing fixed public access
Dynamic NAT
Private IPs are mapped to public IPs from a pool
Limited public IP pool, rotating assignment
PAT (NAT Overload)
Many private IPs map to a single public IP using different ports
Most common, enables internet access for many devices using one IP
How Does NAT Work?
When a device on a private network initiates a connection:
The NAT device replaces the private source IP with its public IP.
For PAT, it assigns a unique source port to differentiate sessions.
The NAT device maintains a translation table mapping private IP/port to public IP/port.
Return traffic is checked against this table, and the destination address and port are rewritten back to the internal IP and port.
If there is no existing mapping, unsolicited inbound connections are typically dropped unless allowed by configurations (as with Static NAT).
How to Configure Source NAT (NAT/PAT) on Cisco Routers
Below are simplified steps to configure NAT and PAT (overload) on Cisco routers:
Define Inside and Outside Interfaces:
interface GigabitEthernet0/0
ip nat inside
interface GigabitEthernet0/1
ip nat outside
Create an Access List to Match Internal Traffic:
access-list 1 permit 192.168.1.0 0.0.0.255
Configure NAT/PAT:
Static NAT:
ip nat inside source static 192.168.1.10 203.0.113.10
Dynamic NAT:
ip nat pool PUBLIC_POOL 203.0.113.100 203.0.113.110 netmask 255.255.255.0
ip nat inside source list 1 pool PUBLIC_POOL
PAT (NAT Overload):
ip nat inside source list 1 interface GigabitEthernet0/1 overload
Verify NAT Configuration:
show ip nat translations
show ip nat statistics
How to Configure NAT Traversal on Cisco Routers
When using VPNs, NAT can interfere with traffic. NAT Traversal (NAT-T) encapsulates IPsec traffic in UDP to pass through NAT devices. To enable NAT-T on Cisco routers:
crypto isakmp nat-traversal 20
This enables NAT-T with a keepalive of 20 seconds (default is 10 seconds).
Verification:
show crypto isakmp sa
Ensure your ACLs allow UDP/4500 and that your VPN peers support NAT-T.
Common NAT Applications
Home and Branch Internet Access – Multiple devices sharing a single public IP.
Server Hosting – Static NAT for inbound access to internal servers.
Carrier-Grade NAT (CGNAT) – ISPs managing large subscriber bases with limited public IPs.
IPv6 Transition (NAT64) – Enabling IPv6-only devices to communicate with IPv4 servers.
Added Privacy – Hiding internal addressing structure from external networks.
Limitations and Challenges of NAT
Breaks End-to-End Connectivity: Direct inbound connections require explicit NAT configurations.
Complicates Protocols Embedding IP Info: FTP, SIP may need ALGs or NAT traversal methods.
Port Exhaustion: PAT may exhaust available ports under heavy load.
Not a Firewall Replacement: NAT adds privacy but does not inspect or block malicious traffic.
NAT FAQ
Q1: What is a NAT in Cisco? NAT on Cisco routers translates private IP addresses to public IPs, enabling internet access while conserving address space.
Q2: How to configure a NAT network? Define inside/outside interfaces, create ACLs for internal traffic, configure NAT rules (static, dynamic, or PAT), and verify using show ip nat translations.
Q3: How to configure NAT traversal on Cisco routers? Use the crypto isakmp nat-traversal command to enable NAT-T, allowing VPN traffic to pass through NAT devices.
Q4: How to configure source NAT? Use the ip nat inside source commands to translate internal source IPs to public IPs, supporting static, dynamic, and PAT configurations.
