How to configure Static NAT on Cisco IOS Router

(Rene Molenaar) #22

Hi @kayoutoure,

With the ip nat inside source static command, you’ll need an inside local + inside global address. The inside local can be any address that is routable on the inside. For the inside global address, you can pick any IP address that falls within the network of any of your interfaces that has the ip nat outside command. Usually, you’ll pick the IP address on your outside interface, but this is not really required. For example, this also works:

Let’s create a new loopback:

NAT(config)#interface loopback 0
NAT(config-if)#ip nat outside 
NAT(config-if)#ip address

NAT(config)#ip nat inside source static belongs to the network on loopback 0. Let’s enable a debug on the “host”:

HOST#debug ip packet 
IP packet debugging is on

And do a quick ping:

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to, timeout is 2 seconds:
Success rate is 100 percent (5/5), round-trip min/avg/max = 6/7/9 ms

Which works:

IP: s= (GigabitEthernet0/1), d=, len 100, input feature, MCI Check(109), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE

(MAODO T) #23

Ok. I see.

By the way (if you have time to correct it) ; you are using R1, R2, R3 router names, while the schema is using Host, NAT, Web1.


(Rene Molenaar) #24

You are right, just fixed it :slight_smile:


(Olof L) #25

Just a little type I guess. “on” not “no” in the first sentence?


(Rene Molenaar) #26

Hi Olof,

That’s a typo yes :smile: Thanks for letting me know, I just fixed it.



(Manami B) #27

Hi Rene,

What will happen if we configure like this:-

interface xxx
ip nat inside
ip nat outside source static a.a.a.a b.b.b.b

interface yyy
ip nat outside
ip nat inside source static c.c.c.c d.d.d.d

Will it work at all and if at all it works how would be the packet flow?


(Manami B) #28

Okay, My another doubt :-

For Cisco VASI Configuration, what we are doing -

Interface Physical_Interface1 (may be LAN Interface)
IP nat inside
Interface VasiLeft1
IP nat outside
ip nat inside source static
ip nat outside source static

interface VasiRight1
ip nat inside source static 500.500.500.5
ip nat outside source static 600.600.600.6

Please rectify me if I am wrong:-

When traffic enters “Physical_Interface1” it will translate the LAN Side IP as per “ip nat inside” command and forward it to VasiLeft1 Interface. Here it is mentioned as “Outside” so send it to VasiRight1 as usual.

My doubt is what it will do with “inside NAT statement” here in VasiLest1 interface?

it reaches VasiRight1 automatically.

Now here gain we see “inside” and “outside” NAT Statement. What would be the traffic flow?

For return traffic,

Where it will D-NAT? On VasiRight or on VasiLeft?

it should be on any one of the interface. Not on both. Why we are configuring “inside” “outside” combined NAT Statement on both the interface vasiright and vasileft?

Totally Confused about packet flow.

Will eagerly wait to get your answer.


(Lazaros Agapides) #29

Hello Manami

I assume in your example you mean the following:

router(config)#interface xxx
router(config-if)#ip nat inside
router(config#) ip nat outside source static a.a.a.a b.b.b.b

router(config)#interface yyy
router(config-if)#ip nat outside
router(config)#ip nat inside source static c.c.c.c d.d.d.d

I’ve never actually configured something like this, but I don’t see why it wouldn’t work. You may have some restrictions as to the IP addresses being used. I suggest you try it out in a lab environment and see what happens. Share your results with us if you can.

I hope this has been helpful!



(Troy H) #30

I’m still trying to understand this lesson–but please allow me a quick question regarding “overlapping” networks… where multiple networks share common IP addresses?

If I need to connect multiple different networks together, but they share a common IP scheme (, can I do that with NAT?

Thanks–trying to find the practical solution for a real world problem.



(Lazaros Agapides) #31

Hello Troy

In the specific reference to overlapping address spaces, what is being referred to here is if you have an inside network address that is the same as an address on the outside.

For this specific question, you’ll have to be a little more specific. Are these multiple different networks remote locations all using the same private address space of internally? When you say connect them together, what do you want to achieve? Have each network have access to all other networks as if they were in the same physical location or just have access to specific resources at each location such as a web or email server?

In general, NAT is not a technology used to connect remote networks, but allows the use of one address scheme on the “inside” network to be translated to another on the “outside” network. The inside network is almost always a private address scheme while the outside network is almost always the Internet.

For connectivity between remote sites, technologies such as VPNs are an option for remote connectivity, but this will require even internal address schemes to be unique. If they are not unique, NAT can be employed to translate appropriately but this becomes unnecessarily complex for a relatively simple solution.

I hope this gives you some insight into what you need to do. Feel free to comment or provide additional information so we can look into the issue in more detail.

I hope this has been helpful!



(Troy H) #32

Thanks for these questions, Laz–and the opportunity to learn from this exercise.

These are multiple devices per site, each utilizing the same static IP scheme–changing it is not practical. Each device does not and should not communicate with any other, but I need to access each client on each device in order to scan them. The scanner will run on a server, to be installed at each site. The WAN provider has given me 200 addresses for each site, and those are the addresses I will use to reach each client.

I intend to subnet those 200 addresses into seven /27 networks, enough for six devices and a few addresses left over for management. The static IPs on the devices are contiguous (.1-.25) within the local address space. The problem I am trying to solve is to transcend the “public” IPs and reach the local IPs remotely. Is this possible with NAT? If so, can it be done on the router in the diagram? Or do I need additional L3 devices between the switches?




(Lazaros Agapides) #33

Hello Troy

Can you clarify the following:

  1. The scanner will run on a server to be installed at each site. Will this scanner have an internal IP address of the form 192.168.115.X?
  2. The 200 addresses, are those routable? i.e. not private?
  3. You say that the WAN provider has given you 200 address for each site. That’s 200 for each site?
  4. Where is the central device from which you want to access all of the internal clients? What is it’s IP address?
  5. What role do the servers at each site play? not sure I understood that part.

At first glance, what you will require is some nat translation with port forwarding so that you can access each individual client, but I must more fully understand the network topology before i can answer.

I await your response!



(Troy H) #34

My preference would be to keep the scanner off the 192.168.115.x network, but instead route its 172 address to all the clients on site. Yes, I have 200 addresses at each site and can route to them from a central server at a different site (ie., for the purpose of initiating and collecting the scans at all of the other sites.

Ideally, I want a one-to-one translation between the local to a public address. Then repeat that scheme for the next one on site– can be reached from the outside by, and so on. Is NAT right for me?



(Lazaros Agapides) #35

Hello Troy

Sorry for the late response. If you have a one to one relationship between the internal and external IP addresses for the clients, then yes, NAT would work for what you want to do. Sounds like an interesting setup, let us know how it goes!

I hope this has been helpful!



(mohanad a) #36

the following config is in the C891F-K9 in a production network my Question is why they config the ip nat static with route-map option

  router#sh running-config interface g8
Building configuration...

Current configuration : 357 bytes
interface GigabitEthernet8
 description WAN
 bandwidth 512
 bandwidth receive 3000
 ip address x.x.x.x
 ip access-group BLOCK_RECURSIVE in
 ip nat outside
 ip ips myips in
 ip virtual-reassembly in
 zone-member security INTERNET-ZONE
 duplex auto
 speed auto
 crypto map primarymap
 service-policy output MP_STD_4QUEUE

ip nat inside source static route-map NAT_MAP

route-map NAT_MAP permit 10
 match ip address NAT_LIST
 match interface GigabitEthernet8

ip access-list extended NAT_LIST
 deny   ip
 deny   ip any
 permit ip any

(Lazaros Agapides) #37

Hello Mohanad

Using a route map to define a static NAT is helpful because it adds a lot of flexibility. You can easily adjust which addresses are allowed and which are not. This is especially the case for one to one static NAT like the one you show in your post where users from the Internet (or from the outside network) can directly access the device on the inside via this static NAT translation. By adding the route-map and placing entries in the associated access list, you are blocking incoming requests from the specific IPs that are listed there.

You can limit and filter who has access from the outside to the device you are translating to. This is typical good practice especially when this is something that you want to adjust over the days and months of its operation.

I hope this has been helpful!



(Brian C) #38

PLease check under the NAT Router this configuration has the wrong IPs listed… they have

interface FastEthernet0/0
 ip address
 ip nat outside
interface FastEthernet1/0
 ip address
 ip nat inside

I am having problems with the PAT so I came to this one to back track and so I had just copied the configs from the config tabs.

that is why its not working for people!!!

should be 192.“168”.x.x on both

Ok I have tested this one and it works…. minus the changes that need to be made that I posted above. I also did no ip routing on the Web server… before I did that I could not ping from host to web but after I did that I could… odd!


(Lazaros Agapides) #39

Hello Brian

Thanks for catching that, I’ll let Rene know!



(Chris N) #40

Is there a tangible difference between

ip nat inside source static


ip nat outside source static



(Rene Molenaar) #41

Hello Chris,

There is:

ip nat inside source:

  • Translates the source IP address of packets that travel from inside to outside.
  • Translates the destination IP address of packets that travel from outside to inside.

ip nat outside source:

  • Translates the source IP address of packets that travel from outside to inside.
  • Translates the destination IP address of packets that travel from inside to outside.

So in your first example: source IP address is translated to when it translates from inside to outside. Destination IP address is translated to when the packet travels from outside to inside.

In the second example, we translate source IP address to when the packet travels from the outside to the inside. We translate destination IP address to when the return packet travels from the inside to the outside.

This question comes up every now and then so I decided to create some examples for it:

Hope this helps!