Use IP NAT Command for Configuration

Available Languages

Download Options

  • PDF     (145.0 KB)
    View with Adobe Reader on a variety of devices
  • ePub     (95.5 KB)
    View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
  • Mobi (Kindle)     (92.8 KB)
    View on Kindle device or Kindle app on multiple devices
Updated:November 4, 2022
Document ID:218383

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

    Introduction

    This document describes a configuration that uses the ip nat outside source static command and the IP packets results from the NAT process.

    Prerequisites

    Requirements

    Cisco recommends that you have knowledge of this topic:

    Components Used

    The information in this document is based on Cisco 2500 Series Routers on Cisco IOS®Software Release 12.2(27) .

    The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

    Background Information

    This document provides a sample configuration with the use of the  ip nat outside source static command and includes a brief description of what happens to the IP packet during the NAT process. Consider the network topology in this document as an example.

    Configure

    Note: Use the Command Lookup Tool to find additional information on the commands that this document uses. Only registered Cisco users have access to internal tools and information.

    Network Diagram

    This document uses this network setup.

    Network DiagramNetwork Diagram

    When you issue a ping sourced from Router 2514W Loopback1 interface destined to Router 2501E Loopback0 interface, this is what happens:

    • On the outside interface (S1) of Router 2514X, the ping packet shows up with a Source Address (SA) of 172.16.89.32 and a Destination Address (DA) of 172.16.68.1.
    • NAT translates the SA to the Outside Local Address 172.16.68.5 (correspondent to the ip nat outside source static   command configured on Router 2514X).
    • Router 2514X then checks its routing table for a route to 172.16.68.1.
    • If the route does not exist, Router 2514X drops the packet. In this case, Router 2514X has a route to 172.16.68.1 through the static route to 172.31.1.0. It forwards the packet to the destination.
    • Router 2501E sees the packet on its incoming interface (E0) with an SA of 172.16.68.5, and a DA of 172.16.68.1.
    • It sends an Internet Control Message Protocol (ICMP) echo reply to 172.16.68.5. If it does not have a route, it drops the packet.
    • However, in this case it has the (default) route.
    • Therefore, it sends a reply packet to Router 2514X, with an SA of 172.16.68.1, and a DA of 172.16.68.5.
    • Router 2514X sees the packet and checks for a route to the 172.16.68.5 address.
    • If it does not have one, it responds with an ICMP unreachable reply.
    • In this case, it has a route to 172.16.68.5 (due to the static route).
    • It therefore translates the packet back to the 172.16.89.32 address, and forwards it out its outside interface (S1).

    Configurations

    This document uses these configurations:

    Router 2514W 
    hostname 2514W
!


!--- Output suppressed.

interface Loopback1
 ip address 172.16.89.32 255.255.255.0
!
interface Ethernet1
 no ip address
 no ip mroute-cache
!
interface Serial0
 ip address 172.16.191.254 255.255.255.252
 no ip mroute-cache
!

!--- Output suppressed.

ip classless
ip route 0.0.0.0 0.0.0.0 172.16.191.253

!--- Default route to forward packets to 2514X.

!


!--- Output suppressed.
    Router 2514X 
    hostname 2514X
!


!--- Output suppressed.

ip nat outside source static 172.16.89.32 172.16.68.5

!--- Outside local address.

!


!--- Output suppressed.

interface Ethernet1
 ip address 172.31.192.202 255.255.255.0
 ip nat inside

!--- Defines Ethernet 1 as a NAT inside interface.

 no ip mroute-cache
 no ip route-cache
!
interface Serial1
 ip address 172.16.191.253 255.255.255.252
 no ip route-cache
 ip nat outside

!--- Defines Serial 1 as a NAT outside interface.

 clockrate 2000000

!


!--- Output suppressed.

ip classless
ip route 172.31.1.0 255.255.255.0 172.31.192.201
ip route 172.31.16.0 255.255.255.0 172.16.191.254

!--- Static routes for reaching the loopback interfaces


!--- on 2514E and 2514W.

!


!--- Output suppressed.
    Router 2501E 
    hostname rp-2501E
!


!--- Output suppressed.

interface Loopback0
 ip address 172.16.68.1 255.255.255.0
!
interface Ethernet0
 ip address 172.31.192.201 255.255.255.0
!


!--- Output suppressed.

ip classless
ip route 0.0.0.0 0.0.0.0 172.31.192.202

!--- Default route to forward packets to 2514X.

!


!--- Output suppressed.

    Verify

    Note: Only registered Cisco users can access internal tools and information.

    Use the Cisco CLI Analyzer to view an analysis of the show command output. The Cisco CLI Analyzer  (OIT) supports several  show commands. 

    Use the show ip nat translations command to check the translation entries, as this output shows:

    2514X#show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
--- ---                ---                172.16.68.5        172.16.89.32
2514X#

    Troubleshoot

    This example uses NAT translation debugging and IP packet debugging to demonstrate the NAT process.

    Note: Because the debug commands generate a significant amount of output, use them only when traffic on the IP network is low so that other activity on the system is not adversely affected.

    Note: Refer to Important Information on Debug Commands before you use debug commands.

    This output is the result when you use the debug ip packet and debug ip nat commands simultaneously on Router 2514X, while you ping from the Router 2514W loopback1 interface address (172.16.89.32) to the Router 2501 E loopback0 interface address (172.16.68.1).

    This output shows the first packet that arrives on the outside interface of Router 2514X. The source address of 172.16.89.32 gets translated to 172.16.68.5. The ICMP packet is forwarded toward the destination out the Ethernet1 interface.

    5d17h: NAT: s=172.16.89.32->172.16.68.5, d=172.16.68.1 [171]
5d17h: IP: tableid=0, s=172.16.68.5 (Serial0), d=172.16.68.1 (Ethernet0), routed
via RIB
5d17h: IP: s=172.16.68.5 (Serial0), d=172.16.68.1 (Ethernet0), g=172.31.192.201,
len 100, forward
5d17h:     ICMP type=8, code=0

    This output shows the return packet sourced from 172.16.68.1 with a destination address of 172.16.68.5, which gets translated to 172.16.89.32. The resultant ICMP packet gets forwarded out the Serial1 interface.

    5d17h: IP: tableid=0, s=172.16.68.1 (Ethernet0), d=172.16.68.5 (Serial0), routed
via RIB
5d17h: NAT: s=172.16.68.1, d=172.16.68.5->172.16.89.32 [171]
5d17h: IP: s=172.16.68.1 (Ethernet0), d=172.16.89.32 (Serial0), g=172.16.191.254,
 len 100, forward
5d17h:     ICMP type=0, code=0

    The exchange of ICMP packets continues. The NAT process for this debug output is the same as the previous output.

    5d17h: NAT: s=172.16.89.32->172.16.68.5, d=172.16.68.1 [172]
5d17h: IP: tableid=0, s=172.16.68.5 (Serial0), d=172.16.68.1 (Ethernet0), routed
via RIB
5d17h: IP: s=172.16.68.5 (Serial0), d=172.16.68.1 (Ethernet0), g=172.31.192.201,
len 100, forward
5d17h:     ICMP type=8, code=0
5d17h: IP: tableid=0, s=172.16.68.1 (Ethernet0), d=172.16.68.5 (Serial0), routed
via RIB
5d17h: NAT: s=172.16.68.1, d=172.16.68.5->172.16.89.32 [172]
5d17h: IP: s=172.16.68.1 (Ethernet0), d=172.16.89.32 (Serial0), g=172.16.191.254,
 len 100, forward
5d17h:     ICMP type=0, code=0
5d17h: NAT: s=172.16.89.32->172.16.68.5, d=172.16.68.1 [173]
5d17h: IP: tableid=0, s=172.16.68.5 (Serial0), d=172.16.68.1 (Ethernet0), routed
via RIB
5d17h: IP: s=172.16.68.5 (Serial0), d=172.16.68.1 (Ethernet0), g=172.31.192.201,
len 100, forward
5d17h:     ICMP type=8, code=0
5d17h: IP: tableid=0, s=172.16.68.1 (Ethernet0), d=172.16.68.5 (Serial0), routed
via RIB
5d17h: NAT: s=172.16.68.1, d=172.16.68.5->172.16.89.32 [173]
5d17h: IP: s=172.16.68.1 (Ethernet0), d=172.16.89.32 (Serial0), g=172.16.191.254,
 len 100, forward
5d17h:     ICMP type=0, code=0
5d17h: NAT: s=172.16.89.32->172.16.68.5, d=172.16.68.1 [174]
5d17h: IP: tableid=0, s=172.16.68.5 (Serial0), d=172.16.68.1 (Ethernet0), routed
via RIB
5d17h: IP: s=172.16.68.5 (Serial0), d=172.16.68.1 (Ethernet0), g=172.31.192.201,
len 100, forward
5d17h:     ICMP type=8, code=0
5d17h: IP: tableid=0, s=172.16.68.1 (Ethernet0), d=172.16.68.5 (Serial0), routed
via RIB
5d17h: NAT: s=172.16.68.1, d=172.16.68.5->172.16.89.32 [174]
5d17h: IP: s=172.16.68.1 (Ethernet0), d=172.16.89.32 (Serial0), g=172.16.191.254,
 len 100, forward
5d17h:     ICMP type=0, code=0
5d17h: NAT: s=172.16.89.32->172.16.68.5, d=172.16.68.1 [175]
5d17h: IP: tableid=0, s=172.16.68.5 (Serial0), d=172.16.68.1 (Ethernet0), routed
via RIB
5d17h: IP: s=172.16.68.5 (Serial0), d=172.16.68.1 (Ethernet0), g=172.31.192.201,
len 100, forward
5d17h:     ICMP type=8, code=0
5d17h: IP: tableid=0, s=172.16.68.1 (Ethernet0), d=172.16.68.5 (Serial0), routed
via RIB
5d17h: NAT: s=172.16.68.1, d=172.16.68.5->172.16.89.32 [175]
5d17h: IP: s=172.16.68.1 (Ethernet0), d=172.16.89.32 (Serial0), g=172.16.191.254,
 len 100, forward
5d17h:     ICMP type=0, code=0

    Summary

    When the packet travels from outside to inside, translation occurs first, and then the routing table is checked for the destination. When the packet travels from inside to outside, the routing table is checked for the destination first, and then translation occurs. Refer to NAT Order of Operation for further information.

    Take not of the part of the IP packet that gets translated when used with each of the previous commands. This table contains the guideline:

    Command Action
    ip nat outside source static
    • Translates the source of the IP packets that travel outside to inside.
    • Translates the destination of the IP packets that travel inside to outside.
    ip nat inside source static
    • Translates the source of IP packets that travel inside to outside.
    • Translates the destination of the IP packets that travel outside to inside.

    These guidelines indicate that there is more than one way to translate a packet. Based on your specific needs, you need to determine how to define the NAT interfaces (inside or outside) and what routes the routing table contains before or after translation. Keep in mind that the portion of the packet that is translated depends upon the direction the packet travels, and how you configure NAT.

    Related Information

    Revision History

    Revision Publish Date Comments
    1.0
    04-Nov-2022
    Initial Release
    TAC Authored

    Contributed by Cisco Engineers

    • Marin Grabovschi
      Cisco Technical Consulting Engineer

    Was this Document Helpful?

    FeedbackFeedback

    Contact Cisco

    This Document Applies to These Products