Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.1.x

PDF

Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.1.x

Network address translation (NAT)

Updated: April 10, 2026

Want to summarize with AI?

Log in

Explains how network address translation (NAT) mechanisms map private network addresses to public addresses, supporting secure and scalable internet access.

A network address translation is a networking technique that

  • allows multiple local IP addresses within a priavte network to be mapped to public IP addresses

  • enables devices on private networks to access external (Internet or Cloud) resources, and

  • enhances network security by concealing internal addressing schemes from outside networks.

Port address translation (PAT) enables a single IP address to be shared by multiple hosts through the use of IP and port translations.

L3 access on the controller supports only these NAT use cases:

  • translating client traffic in the guest network to reach corporate services, such as Cisco ISE, and

  • hiding the private IP addresses of clients from outside networks.

These types of NAT are supported:

  • Static address translation (static NAT) allows a one-to-one mapping between local and global addresses. The static translation is useful when a host from the inside is accessible from a fixed address from the outside.

  • Dynamic address translation (dynamic NAT or PAT) maps between the client subnet and a public global IP address or source port pool.

    This can be achieved using these:

    • Dynamic NAT without VRF.

    • Dynamic NAT with VRF.

Selective NAT support

A selective NAT support is a NAT configuration feature that

  • enables only a specified subset of NAT options within a software release, and

  • ensures compliance with recent Cisco IOS XE 17.13.1 platform capabilities.

Enable static NAT without VRF (CLI)

Configure static NAT to enable a device on the internal network to communicate with external networks using a fixed public IP address using commands.

Procedure

1.

Enter the global configuration mode.

Example:

Device# configure terminal
2.

Specify an interface and enter the interface configuration mode.

Example:

Device(config)# interface interface-type number
3.

Set the IP address for an interface.

Example:

Device(config-if)# ip address ip-address mask-address
4.

Connect the interface to the outside network.

Example:

Device(config-if)# ip nat outside
5.

Exit the interface configuration mode and enter the global configuration mode.

Example:

Device(config-if)# end
6.

Specify a different interface and enter the interface configuration mode.

Example:

Device(config)# interface interface-type number
7.

Set the IP address for an interface.

Example:

Device(config-if)# ip address ip-address mask-address
8.

Mark the interface as connected to the inside.

Example:

Device(config-if)# ip nat inside
9.

Exit the interface configuration mode and enter the global configuration mode. Translate between an inside local address and inside global address.

Example:

Device(config-if)# end
Device(config)# ip nat inside source static 10.10.10.100 209.165.200.226

Enable static NAT with VRF (CLI)

Establish a static Network Address Translation (NAT) mapping within a specific Virtual Routing and Forwarding (VRF) environment using commands.

Procedure

1.

Enter the global configuration mode. Specify an interface and enter the interface configuration mode.

Example:

Device# configure terminal
Device(config)# interface interface-type-number
2.

Activate multiprotocol VRF on an interface.

Example:

Device(config-if)# vrf forwarding vrf-name
3.

Enable IP address on an interface.

Example:

Device(config-if)# ip address ip-address mask-address
4.

Mark the interface as connected to the outside.

Example:

Device(config-if)# ip nat outside
5.

Return to privileged EXEC mode.

Example:

Device(config-if)# end
6.

Specify an interface and enter the interface configuration mode.

Example:

Device(config)# interface interface-type-number
7.

Activate multiprotocol VRF on an interface.

Example:

Device(config-if)# vrf forwarding vrf-name
8.

Enable IP address on an interface. Mark the interface as connected to the inside.

Example:

Device(config-if)# ip address ip-address mask-address
Device(config-if)# ip nat inside
9.

Return to the privileged EXEC mode. Translate between an inside local address and inside global address.

Example:

Device(config-if)# end
Device(config)# ip nat inside source static local-ip global-ip vrf vrf_name match-in-vrf
Note

The match-in-vrf keyword is optional and required when the same VRF is configured in the inside and outside NAT interface. For more information about match-in-vrf, see

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_nat/configuration/xe-16/nat-xe-16-book/iadnat-match-vrf.html

Enable dynamic NAT without VRF (CLI)

Configure a Cisco device to provide dynamic network address translation (NAT) for internal devices without using VRF using commands.

Procedure

1.

Enter the global configuration mode. Specify an interface and enter the interface configuration mode.

Example:

Device# configure terminal
Device(config)# interface interface-type number
2.

Set the IP address for an interface.

Example:

Device(config-if)# ip address ip address mask-address
3.

Mark the interface as connected to the outside.

Example:

Device(config-if)# ip nat outside
4.

Specify a different interface and enter the interface configuration mode.

Example:

Device(config)# interface interface-type number
5.

Set the IP address for an interface.

Example:

Device(config-if)# ip address ip address mask-address
6.

Mark the interface as connected to the inside.

Example:

Device(config-if)# ip nat inside
7.

Define a pool of network addresses for NAT.

Example:

Device(config)# ip nat pool name start-ip end-ip {netmask netmask | prefix-length prefix-length}
8.

Define a standard access list for the addresses to be translated.

Example:

Device(config)# access-list access-list-number permit ip source-address source-wildcard-bits host destination-address
Note

The host keyword is optional for access-list configuration. It depends on the type of ACL you want to configure.
9.

Establish dynamic source translation with overloading using the defined access list. Return to the privileged EXEC mode.

Example:

Device(config)# ip nat inside source list access-list-number pool name overload
Device(config)# exit

Enable dynamic NAT with VRF (CLI)

Enable dynamic Network Address Translation (NAT) on interfaces associated with a specific Virtual Routing and Forwarding (VRF) instance using commands.

Procedure

1.

Enter the global configuration mode. Specify an interface and enter the interface configuration mode.

Example:

Device# configure terminal
Device(config)# interface interface-type-number
2.

Activate multiprotocol VRF on an interface. Enable IP address on an interface.

Example:

Device(config-if)# vrf forwarding vrf-name
Device(config-if)# ip address ip address mask-address
3.

Mark the interface as connected to the outside. Return to the privileged EXEC mode.

Example:

Device(config-if)# ip nat outside
Device(config-if)# end
4.

Specify an interface and enter the interface configuration mode. Activate multiprotocol VRF on an interface.

Example:

Device(config)# interface interface-type-number
Device(config-if)# vrf forwarding vrf-name
5.

Enable IP address on an interface. Mark the interface as connected to the inside.

Example:

Device(config-if)# ip address ip address mask-address
Device(config-if)# ip nat inside
6.

Return to privileged EXEC mode. Define a standard IPv4 access list using a name.

Example:

Device(config-if)# end
Device(config)# ip access-list standard name

The name can be a number from one to 99.
7.

Specify the forwarded packet. Exit interface configuration mode and return to the global configuration mode.

Example:

Device(config-if)# sequence-number permit host-network wildcard-address
Device(config-if)# exit
Note

sequence-number refers to the number where the rule should be in the list. Here, lower the sequence number higher the priority for the rule.

8.

Define a pool of network addresses for NAT. Establish dynamic source translation with overloading using the defined access list.

Example:

Device(config)# ip nat pool name start-ip end-ip {netmask netmask |  prefix-length prefix-length}
Device(config)# ip nat inside source list access-list-number pool name vrf vrf-name match-in-vrf overload
Note

The match-in-vrf keyword is optional and required when the same VRF is configured in the inside and outside NAT interface. For more information about match-in-vrf, see

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_nat/configuration/xe-16/nat-xe-16-book/iadnat-match-vrf.html

9.

Return to the privileged EXEC mode.

Example:

Device(config)# end

Enable timeout for NAT (CLI)

Adjust the timeout values for NAT translations to optimize device performance using commands.

Procedure

1.

Enter the global configuration mode.

Example:

Device# configure terminal
2.

Specify timeouts for NAT translations.

Example:

Device(config)# ip nat translation [icmp-timeout | tcp-timeout | timeout | udp-timeout] number-of-seconds

These timeout options are supported:

  • icmp-timeout : ICMP packets timeout.

  • tcp-timeout : TCP packets timeout.

  • timeout : Global timeout for all protocol types.

  • udp-timeout: UDP packets timeout.

3.

Return to the privileged EXEC mode.

Example:

Device(config)# end

Verify static NAT details

Verify static NAT details without VRF

To verify the static IP NAT statistics without VRF, use this command:

Device# show ip nat statistics
Total active translations: 1 (1 static, 0 dynamic; 0 extended)
Outside interfaces:
Vlan62
Inside interfaces:
Vlan55
Hits: 1474 Misses: 0
Reserved port setting disabled provisioned no
Expired translations: 1
Dynamic mappings:
nat-limit statistics:
max entry: max allowed 0, used 0, missed 0
In-to-out drops: 0 Out-to-in drops: 0
Pool stats drop: 0 Mapping stats drop: 0
Port block alloc fail: 0
IP alias add fail: 0
Limit entry add fail: 0

To verify the static NAT without VRF on active chassis, use this command:

Device# show platform software nat chassis active F0 translation
Pro Inside global Inside local Outside local Outside global
--- 62.1.1.15 155.1.100.1 --- ---
--- 62.1.1.16 155.1.0.4 --- ---
udp 62.1.1.16:33334 155.1.0.4:33334 62.1.1.11:33333 62.1.1.11:33333
udp 62.1.1.16:30000 155.1.0.4:30000 62.1.1.11:30000 62.1.1.11:30000
Total number of translations: 4

Verify static NAT details with VRF

To verify the static IP NAT statistics with VRF, use this command:

Device# show ip nat statistics
Total active translations: 1 (1 static, 0 dynamic; 0 extended)
Outside interfaces:
Vlan62
Inside interfaces:
Vlan55
Hits: 1474 Misses: 0
Reserved port setting disabled provisioned no
Expired translations: 1
Dynamic mappings:
nat-limit statistics:
max entry: max allowed 0, used 0, missed 0
In-to-out drops: 0 Out-to-in drops: 0
Pool stats drop: 0 Mapping stats drop: 0
Port block alloc fail: 0
IP alias add fail: 0
Limit entry add fail: 0

To verify the static NAT with VRF on active chassis, use this command:

Device# show platform software nat chassis active F0 translation
Pro Inside global Inside local Outside local Outside global
--- 62.1.1.15 155.1.100.1 --- ---
--- 62.1.1.16 155.1.0.4 --- ---
udp 62.1.1.16:33334 155.1.0.4:33334 62.1.1.11:33333 62.1.1.11:33333
udp 62.1.1.16:30000 155.1.0.4:30000 62.1.1.11:30000 62.1.1.11:30000
Total number of translations: 4

Verify dynamic NAT details

Verify dynamic NAT details without VRF

To verify the dynamic IP NAT statistics without VRF, use this command:

Device# show ip nat statistics
Total active translations: 1 (0 static, 1 dynamic; 1 extended)
Outside interfaces:
  Vlan62
Inside interfaces: 
  Vlan155
Hits: 3  Misses: 1
 Reserved port setting disabled provisioned no
Expired translations: 0
Dynamic mappings:
-- Inside Source
[Id: 2] access-list dest_nat_acl pool test_nat_pool refcount 1
 pool test_nat_pool: id 1, netmask 255.255.255.252
    start 62.1.1.101 end 62.1.1.101
    type generic, total addresses 1, allocated 1 (100%), misses 0
longest chain in pool: test_nat_pool's addr-hash: 0, average len 0,chains 0/256
nat-limit statistics:
 max entry: max allowed 0, used 0, missed 0
In-to-out drops: 0  Out-to-in drops: 0
Pool stats drop: 0  Mapping stats drop: 0
Port block alloc fail: 0
IP alias add fail: 0
Limit entry add fail: 0

To verify the dynamic NAT without VRF on active chassis, use this command:

Device# show platform software nat chassis active F0 translation
Pro  Inside global         Inside local          Outside local         Outside global
udp  62.1.1.101:30000      155.1.100.1:30000     62.1.1.11:30000       62.1.1.11:30000
Total number of translations: 1

Verify dynamic NAT details with VRF

To verify the dynamic IP NAT statistics with VRF, use this command:

Device# show ip nat statistics
Total active translations: 1 (0 static, 1 dynamic; 1 extended)
Outside interfaces:
  Vlan62
Inside interfaces: 
  Vlan155
Hits: 3  Misses: 1
 Reserved port setting disabled provisioned no
Expired translations: 0
Dynamic mappings:
-- Inside Source
[Id: 2] access-list dest_nat_acl pool test_nat_pool refcount 1
 pool test_nat_pool: id 1, netmask 255.255.255.252
    start 62.1.1.101 end 62.1.1.101
    type generic, total addresses 1, allocated 1 (100%), misses 0
longest chain in pool: test_nat_pool's addr-hash: 0, average len 0,chains 0/256
nat-limit statistics:
 max entry: max allowed 0, used 0, missed 0
In-to-out drops: 0  Out-to-in drops: 0
Pool stats drop: 0  Mapping stats drop: 0
Port block alloc fail: 0
IP alias add fail: 0
Limit entry add fail: 0

To verify the dynamic NAT with VRF on active chassis, use this command:

Device# show platform software nat chassis active F0 translation
Pro  Inside global         Inside local          Outside local         Outside global
udp  62.1.1.101:30000      155.1.100.1:30000     62.1.1.11:30000       62.1.1.11:30000
Total number of translations: 1

Verify NAT details

To verify the NAT datapath pool details, use this command:


Device# show platform hardware chassis active qfp feature nat datapath pool
pool_id 1 type 1 addroute 0 mask 0xfffffffc allocated 0 misses 0 rotary idx 0x0 ahash sz 4 size 1 max_pat_hash_size 1 next 0x0 hash_index 0x32, hilo ports 0x0 pool mem 0xde480010 flags 0x1 pool_name: test_nat_pool pat_wl 0 no_ports_wl 0 num_maps 1 num_overload_maps 1 vrf 0x0 port_used tcp 0 udp 0
Conf block info
start 62.1.1.102 end 62.1.1.102 flags 0x0 next 0x0 prev 0x0
TCP PAT block info
UDP PAT block info
ICMP PAT block info
GRE PAT block info
Alloced addr info

To verify the NAT datapath statistics, use this command:

Device# show platform hardware chassis active qfp feature nat datapath stats
Counter Value
------------------------------------------------------------------------
number_of_session 0
udp 0
tcp 0
icmp 0
non_extended 0
statics 0
static_net 0
entry_timeouts 0
hits 0
misses 0
cgn_dest_log_timeouts 0
ipv4_nat_alg_bind_pkts 0
ipv4_nat_alg_sd_not_found 0
ipv4_nat_alg_sd_tail_not_found 0
ipv4_nat_rx_pkt 2043
ipv4_nat_tx_pkt 122169
ipv4_nat_flowdb_hits 0
ipv4_nat_stick_rx_pkts 0
ipv4_nat_stick_i2o_pkts 0
ipv4_nat_stick_o2i_pkts 0
ipv4_nat_stick_forus_hits_pkts 0
ipv4_nat_stick_hit_sb 0
ipv4_nat_stick_ha_divert_pkts 0
ipv4_nat_stick_ha_ar_pkts 0
ipv4_nat_stick_ha_tcp_fin 0
ipv4_nat_stick_ha_failed_pkts 0
ipv4_nat_non_natted_in2out_pkts 122165
ipv4_nat_non_nated_out2in_pkts 0
ipv4_nat_bypass_pkts 0
ipv4_nat_unmarked_pkts 0
ipv4_nat_res_port_in2out_pkts 0
ipv4_nat_res_port_out2in_pkts 0
ipv4_nat_ipc_retry_fail 0
ipv4_nat_cfg_rcvd 2
ipv4_nat_cfg_rsp 2
To clear the NAT details, use this commands: 

clear platform software nat chassis active F0 translation forced
clear ip nat statistics

Verify NAT timeout details

To verify the NAT timeout details, use this command:


Device# show platform software nat chassis active r0 timeout 
Dump NAT timeout config
  Type: generic, Timeout (sec): 86400, Enabled: Yes
  Type: tcp, Timeout (sec): 86400, Enabled: Yes
  Type: tcp-pptp, Timeout (sec): 86400, Enabled: Yes
  Type: udp, Timeout (sec): 60, Enabled: Yes
  Type: tcp-fin-reset, Timeout (sec): 60, Enabled: Yes
  Type: tcp-syn, Timeout (sec): 60, Enabled: Yes
  Type: dns, Timeout (sec): 60, Enabled: Yes
  Type: icmp, Timeout (sec): 60, Enabled: Yes
  Type: skinny, Timeout (sec): 60, Enabled: Yes
  Type: icmp-error, Timeout (sec): 60, Enabled: Yes
  Type: esp, Timeout (sec): 300, Enabled: Yes
  Type: rtmap, Timeout (sec): 3600, Enabled: Yes