Learning Objectives
- Understand why NAT was developed and its role in IPv4 conservation
- Configure static, dynamic, and PAT translations
- Determine NAT pool sizing requirements
- Identify NAT limitations and workarounds
Why NAT Exists
NAT (Network Address Translation) was created as a short-term solution to IPv4 address exhaustion. By allowing many private IP addresses to share a single public IP (or a small pool of public IPs), NAT dramatically slows the consumption of public IPv4 addresses.
RFC 1918 reserves three private address ranges:
- 10.0.0.0/8 — 16.7 million addresses
- 172.16.0.0/12 — 1 million addresses
- 192.168.0.0/16 — 65,536 addresses
These addresses are not routable on the public internet. NAT translates between private and public addresses at the network boundary.
Types of NAT
Static NAT — One-to-one mapping between a private IP and a public IP. Each internal host needs its own public IP. Used when an internal server must be reachable from the internet (web server, email server).
Dynamic NAT — Many-to-many mapping using a pool of public IPs. When an internal host initiates traffic, it grabs the next available public IP from the pool. After the translation times out, the public IP returns to the pool.
PAT (Port Address Translation) — Many-to-one mapping using port numbers. Thousands of internal hosts can share a single public IP by differentiating connections via source port. This is what your home router does — all devices share one ISP-assigned IP.
Configure Static NAT
Configure a one-to-one static NAT mapping so an internal server is reachable from the internet.
ip nat inside source static {inside_local} {inside_global}NAT Pool Sizing for Dynamic NAT
When using dynamic NAT or PAT, you must calculate the number of concurrent translations a pool can support:
PAT translations per public IP ≈ 65,535 (theoretical UDP/TCP port range)
Real-world usable ports per IP ≈ 4,000–30,000 (after reserved ports and per-destination limits)
For dynamic NAT (one-to-one mapping from pool):
Required public IPs = (peak concurrent internal hosts requiring translation)
An organization with 1,500 internal users needs internet access through PAT. Each user averages 12 concurrent connections. The ISP provides 3 public IPs. Is this sufficient?
NAT Limitations and Workarounds
NAT introduces several well-known problems:
| Problem | Description | Solution | |---------|-------------|---------| | End-to-end connectivity broken | External hosts cannot initiate connections to internal hosts | Static NAT / port forwarding | | IPsec incompatibility | AH authentication fails because NAT changes the IP header | Use IPsec in tunnel mode or NAT-T (NAT Traversal) | | Application layer issues | FTP, SIP, and others embed IP addresses in payload | Application Layer Gateway (ALG) inspection | | Logging and traceability | Many-to-one mapping makes auditing difficult | NAT logging and syslog |
The long-term solution is IPv6, which eliminates NAT entirely by providing enough addresses for every device to have a globally routable IP.
Configure PAT (Overload)
Configure PAT (port address translation) to allow multiple internal hosts to share a single public IP.
ip nat inside source list {acl} interface {interface} overloadWhat is the key difference between static NAT and PAT?
Why is IPv6 considered a better long-term solution than NAT?
Key Takeaways
- NAT conserves public IPv4 addresses by allowing private IP reuse
- Static NAT = one-to-one; Dynamic NAT = many-to-many from a pool; PAT = many-to-one via port multiplexing
- PAT pool sizing depends on average concurrent connections per user × users / usable ports per IP
- NAT breaks end-to-end connectivity, IPsec AH, and some application protocols
- IPv6 is the permanent fix — enough addresses for every device