You've probably heard that public IPv4 addresses are limited and there aren't nearly enough for every computer in the world to have its own. NAT (Network Address Translation) solves exactly this problem — it lets internal organizational networks use private addresses (like 192.168.x.x) and translates them to one or more public addresses the moment traffic heads out to the internet.
The most common type of NAT: PAT (or NAT Overload)
In most small and medium networks, PAT (Port Address Translation) is used — where hundreds or thousands of internal computers all connect to the internet through just one public IP address (exactly what your home modem does too). Traffic for each computer is distinguished using port numbers (not just IP address) — which is why it's also called Overload.
This tutorial's scenario
Let's say the organization's internal network uses the 192.168.1.0/24 range, and the router has one inside interface (connected to the switch) and one outside interface (connected to the internet with a public address).
Step 1: Designate inside and outside interfaces
The router needs to know which interface faces the internal network and which faces the internet:
enable
configure terminal
interface fastEthernet 0/0
ip nat inside
exit
interface fastEthernet 0/1
ip nat outside
exit
Step 2: Define an access list to specify translatable traffic
We need to specify exactly which internal addresses are allowed through NAT:
access-list 1 permit 192.168.1.0 0.0.0.255
Step 3: Configure PAT on the outbound interface
Now we configure NAT using that access list and the outside interface's IP address (instead of a fixed address pool):
ip nat inside source list 1 interface fastEthernet 0/1 overload
The overload keyword is what turns this into PAT — meaning all the allowed internal addresses connect to the internet through a single external IP address (the fastEthernet 0/1 interface's address) using different port numbers.
Step 4: Verify
To see the active NAT translation table:
show ip nat translations
This command shows which internal address, with which port, was translated to which external address and port — very useful for troubleshooting when an internal user can't reach a specific site.
To see overall NAT statistics (active translation count, errors):
show ip nat statistics
Step 5: Practical test
From an internal computer in the 192.168.1.0/24 range, ping an internet address. If you get a reply and that traffic shows up in show ip nat translations with the outbound public address, NAT has been configured successfully.
Important note about Static NAT
Sometimes (e.g., for an internal web server that needs to be reachable from the internet), instead of dynamic PAT, Static NAT is used, which permanently maps one internal address to a specific public address:
ip nat inside source static 192.168.1.100 203.0.113.10
Why does NAT matter so much?
Without NAT, connecting internal organizational networks to the internet the way we do today simply wouldn't be possible — this protocol both makes up for the IPv4 address shortage and naturally adds a layer of security (since internal addresses aren't directly reachable from the internet unless Static NAT is defined). This is exactly one of the core skills in my CCNA courses.
Blog