Configuring and Verifying PAT/NAT Overload

How PAT Achieves Many-to-One Translation

PAT builds upon the concepts of dynamic NAT but adds a crucial element: it translates not only the source IP address but also the source port number.

Think of it like an office building. The public IP address is the building's street address. The port numbers are the unique suite or office numbers inside. When a packet leaves an internal computer, the router acts as the front desk, assigning it a unique combination of the public street address and an available office number. When a reply comes back to that specific address and office number, the router knows exactly which internal computer to deliver it to.

This process is managed in the router's NAT translation table, which tracks the mapping between the inside private address and port (Inside local) and the outside public address and port (Inside global).

The following video explains how the router handles this translation, especially in cases where two internal devices might coincidentally use the same source port.

Configuring PAT on a Cisco Router

Configuring PAT is very similar to dynamic NAT, but with one key difference: the overload keyword. This single keyword tells the router to enable PAT and use port numbers to track sessions, rather than consuming one public IP per private IP.

The most common method is to configure the router to use the IP address of its own outside-facing interface for all translations.

The steps are:

1. Define NAT Interfaces: Use ip nat inside on the internal interface and ip nat outside on the external (internet-facing) interface.
2. Define Traffic to Translate: Create a standard Access Control List (ACL) to permit the source IP address range of your internal network.
3. Enable PAT: Use the command ip nat inside source list <ACL_NUMBER> interface <INTERFACE_NAME> overload.

Let's walk through a full lab configuration.

For a text-based summary of these commands, you can refer to the following guide. It's a useful reference to have handy for your project.

Verifying and Troubleshooting PAT

Once PAT is configured, you need to verify that it's working as expected. The primary command for this is show ip nat translations. With PAT, you should see multiple different Inside local addresses all mapped to the same Inside global address, but with different port numbers.

Let's see this in action and learn a few other useful verification and troubleshooting commands.

The article from Firewall.cx also provides excellent examples of the verification command outputs and their interpretation.

Conclusion

In this lesson, you've learned how to configure and verify Port Address Translation (PAT), the most scalable and widely used form of NAT. By translating both IP addresses and port numbers, PAT allows an entire network of devices to share a single public IP address, conserving the limited IPv4 address space.

Key Takeaways:

• PAT (NAT Overload) is a "many-to-one" NAT, mapping multiple private IPs to a single public IP.
• It works by using unique port numbers to track individual communication sessions.
• Configuration is similar to dynamic NAT but uses the overload keyword. The most common command is ip nat inside source list <ACL> interface <INTERFACE> overload.
• Verification with show ip nat translations will show multiple inside local addresses mapped to the same inside global address.
• Commands like show ip nat statistics and clear ip nat translation * are essential for monitoring and troubleshooting.

With a solid understanding of IP addressing, subnetting, and now the full suite of NAT types, you have powerful tools for building and connecting networks. However, configuration is only half the battle. In the next module, we will shift our focus to troubleshooting, learning systematic methods and commands like ping and traceroute to diagnose and resolve common IP connectivity issues.