Dynamic Port Address Translation (PAT), also called NAT overload, lets many inside hosts share one public IPv4 address. The router distinguishes simultaneous sessions with TCP or UDP port numbers, making PAT the most widely used NAT type. section 9.3 section 9.3.3
For each session, the router translates an inside local address to an inside global address and records the mapping. It preserves the original port when possible, changes it when necessary, and reuses that assigned port for the session’s remaining packets. ICMP uses its 16-bit Identifier field similarly because it has no TCP or UDP port. section 9.3.3 section 9.4
Configure PAT on a Cisco router by completing these steps:
- Mark the inside and outside interfaces with ip nat inside and ip nat outside. section 9.3.3
- Use an ACL to identify inside local addresses eligible for translation; the ACL selects translations rather than filtering forwarded packets. section 9.4
- Map the ACL to a NAT pool with overload, or map it directly to an outside interface’s address with ip nat inside source list 1 interface g0/1 overload. section 9.3.3
R1(config)# interface g0/0 R1(config-if)# ip nat inside R1(config-if)# interface g0/1 R1(config-if)# ip nat outside R1(config-if)# exit R1(config)# access-list 1 permit 10.0.0.0 0.0.0.255 R1(config)# ip nat pool POOL1 192.0.2.1 192.0.2.5 prefix-length 29 R1(config)# ip nat inside source list 1 pool POOL1 overload #1 #1 Adds the overload keyword to the NAT statement
This configuration listing shows interface roles, an address-selection ACL, a five-address NAT pool, and the overload mapping that enables many-to-one translation. section 9.3.3
Verify active translations
show ip nat translations displays entries such as 203.0.113.2:44578 mapped from 10.0.0.11:44578 to an external HTTPS server. Multiple inside hosts therefore share 203.0.113.2 while using distinct session ports. show ip nat statistics reports active and peak translations, interface roles, hits, misses, and expired entries. section 9.3.3 section 9.4
