Hello! In our last lesson, we mastered static NAT, learning how to create permanent one-to-one mappings between private and public IP addresses. This is perfect for making internal servers accessible from the internet.
This lesson continues our exploration of Network Address Translation by tackling Dynamic NAT. Instead of a fixed, permanent mapping, dynamic NAT allows a group of internal devices to share a smaller pool of public IP addresses on a first-come, first-served basis. This is a more scalable solution when you have more internal hosts than public IP addresses, but don't need them all to access the internet simultaneously.
By the end of this 60-minute lesson, you will be able to configure and verify dynamic NAT using a pool of public addresses, a crucial skill for managing outbound internet access in many networks.
How Dynamic NAT Works
The core idea of dynamic NAT is simple: when an internal device wants to send traffic to the outside world, the router picks an available public IP address from a pre-configured pool and creates a temporary translation. Once the device is finished, that public IP address is returned to the pool for another device to use.
To accomplish this, the router needs two key pieces of information:
- Which traffic to translate: We use an Access Control List (ACL) to identify the source IP addresses of the internal devices that are allowed to be translated. Unlike our previous work with ACLs for filtering, here the ACL is just used for identification—it doesn't block any traffic.
- Which addresses to translate to: We define a NAT pool, which is simply a range of public IP addresses that the router can use for translations.
Dynamic NAT still creates a one-to-one mapping, meaning one private IP uses one public IP from the pool at any given time. This leads to an important limitation called NAT pool exhaustion. If all addresses in the pool are in use, any new internal devices trying to access the internet will have their packets dropped until an address becomes free.
The following video provides an excellent explanation of this process.
Free CCNA | NAT (part 2) | Day 45 | CCNA 200-301 Complete Course
This video from Jeremy's IT Lab, "Free CCNA | NAT (part 2)," will explain the theory behind dynamic NAT.
Watch these two key segments: Introduction to Dynamic NAT: What it is. Focus on how an ACL is used to identify traffic for translation, not to filter it. Pools and Exhaustion: How it works. Pay close attention to the concept of one-to-one mapping and what happens during NAT pool exhaustion.
Configuring Dynamic NAT
The configuration process for dynamic NAT involves a few more steps than static NAT but follows a logical flow. You'll find it's an extension of what you already know.
Here is a summary of the steps involved:
- Define Inside and Outside Interfaces: As with static NAT, you must designate which router interface is internal (
ip nat inside) and which is external (ip nat outside). - Define an ACL: Create a standard access list that
permits the range of inside local addresses you want to be translated. - Define the NAT Pool: Create the pool of public (inside global) addresses the router can use. The command is
ip nat pool <POOL_NAME> <START_IP> <END_IP> netmask <SUBNET_MASK>. - Enable Dynamic NAT: Link the ACL and the NAT pool together with the command
ip nat inside source list <ACL_NUMBER> pool <POOL_NAME>.
Let's see these commands in action.
Free CCNA | NAT (part 2) | Day 45 | CCNA 200-301 Complete Course
Continuing with the same video from Jeremy's IT Lab.
Watch the segment on configuration and verification. This will walk you through the exact Cisco IOS commands and show you how to verify your work using show ip nat translations and show ip nat statistics.
For a quick reference, the article below provides a clear, step-by-step text guide to the configuration process. This is a great resource to bookmark for your project.
The "Dynamic NAT" article from Study CCNA provides a concise summary of the configuration and verification process.
Read through the page, focusing on the five numbered steps for configuration and the example that follows. Compare the commands with what you saw in the video. Notice how the show ip nat translations output shows the dynamic mapping created by the router.
Lab: Configuring and Verifying Dynamic NAT
Now, let's bring the theory and command syntax together in a practical lab demonstration. This lab will not only show you the configuration but also what happens when you hit the NAT pool exhaustion limit we discussed earlier.
Free CCNA | Dynamic NAT | Day 45 Lab | CCNA 200-301 Complete Course
This lab video, "Free CCNA | Dynamic NAT | Day 45 Lab," will put everything into practice.
Watch the entire lab demonstration. Pay special attention to the following: The configuration, where the ACL and NAT pool are created and linked. The verification. Notice how pings from PC1 and PC2 succeed, but the ping from PC3 fails because the two-address pool is exhausted. This is a perfect real-world example of the concept. Then, examine the show ip nat translations output to see the active mappings.
Conclusion
In this lesson, we transitioned from the fixed world of static NAT to the more flexible system of dynamic NAT. You learned how to configure a router to translate a range of private IP addresses using a shared pool of public IP addresses.
Key Takeaways:
- Dynamic NAT provides on-demand, one-to-one mappings from a pool of public IP addresses.
- An ACL is used to identify which internal source IPs are eligible for translation.
- A NAT pool defines the range of available public IPs.
- The key configuration command is
ip nat inside source list <ACL> pool <POOL_NAME>. - A major limitation is NAT pool exhaustion, where connection attempts are dropped if no public IPs are available in the pool.
- Verification is done with
show ip nat translationsandshow ip nat statistics, which will now show "dynamic" entries.
While dynamic NAT is more efficient than static NAT for general-purpose internet access, it still doesn't solve the core problem of IPv4 address scarcity. What if you have hundreds of internal devices but only one public IP address? In our next lesson, we will cover Port Address Translation (PAT), also known as NAT Overload, which solves this exact problem and is the most widely used form of NAT today.