# Policy NAT
**URL:** https://forum.networklessons.com/t/policy-nat/3881
**Category:** Lessons Discussion
**Created:** [May 15, 2018, 12:50pm UTC](https://forum.networklessons.com/t/policy-nat/3881 "2018-05-15T12:50:05Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [May 15, 2018, 12:50pm UTC](https://forum.networklessons.com/t/policy-nat/3881/1 "2018-05-15T12:50:05Z")
This topic is to discuss the following lesson:
[https://networklessons.com/cisco/ccie-enterprise-infrastructurepolicy-nat](https://networklessons.com/cisco/ccie-enterprise-infrastructurepolicy-nat)
---
### Author:  [@chrisnewnham17](https://forum.networklessons.com/u/chrisnewnham17)
#### Post date: [July 4, 2018, 12:19pm UTC](https://forum.networklessons.com/t/policy-nat/3881/2 "2018-07-04T12:19:57Z")
Hi Rene,
Believe you have a typo:
> R1(config)#interface Gi
> R1(config)#interface GigabitEthernet 0/1
Should be
> R1(config)#interface GigabitEthernet 0/1
> R1(config)#ip nat inside
---
### Author:  [@lagapidis](https://forum.networklessons.com/u/lagapidis)
#### Post date: [July 4, 2018, 5:17pm UTC](https://forum.networklessons.com/t/policy-nat/3881/3 "2018-07-04T17:17:19Z")
Hello Chris
Yes you are correct! Thanks for catching that! I will let @ReneMolenaar know to have that changed.
Thanks again!
Laz
---
### Author:  [@networkeh](https://forum.networklessons.com/u/networkeh)
#### Post date: [July 6, 2018, 6:39pm UTC](https://forum.networklessons.com/t/policy-nat/3881/4 "2018-07-06T18:39:35Z")
Hello Rene,
I haven’t yet tried out, but couldn’t we do something like this instead of using a route-map?
```
ip nat inside source list TO_ISP1 int g0/2 (or pool POOL_TO_ISP1)
ip nat inside source list TO_ISP2 int g0/3 (or pool POOL_TO_ISP2)
```
--
Respectfully
---
### Author:  [@wellerk.scott](https://forum.networklessons.com/u/wellerk.scott)
#### Post date: [July 8, 2018, 1:35am UTC](https://forum.networklessons.com/t/policy-nat/3881/5 "2018-07-08T01:35:15Z")
Hello Network E,
I hope you are doing well. I will admit that I have not read this lesson, but I have read the headline, and I might be able to answer your question. Policy based NAT is done with a route map, if you used some other method to NAT it would not be policy based NAT. So would your config work? Possibly, but if it did you are no longer using policy based NAT.
I hope this helps.
Scott
---
### Author:  [@lagapidis](https://forum.networklessons.com/u/lagapidis)
#### Post date: [July 12, 2018, 3:15pm UTC](https://forum.networklessons.com/t/policy-nat/3881/6 "2018-07-12T15:15:32Z")
Hello Network E
@wellerk.scott is absolutely right. You could do it that way as well. However, the exercise was used to show how to use a route-map.
The advantage of using a route map instead is that you have more flexibility by creating more specific NAT rules.
I hope this has been helpful!
Laz
---
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [July 16, 2018, 8:36am UTC](https://forum.networklessons.com/t/policy-nat/3881/7 "2018-07-16T08:36:24Z")
Thanks Chris, I fixed this.
---
### Author:  [@denis.grinceac](https://forum.networklessons.com/u/denis.grinceac)
#### Post date: [August 21, 2020, 10:45pm UTC](https://forum.networklessons.com/t/policy-nat/3881/8 "2020-08-21T22:45:50Z")
So the overall idea with regard to Policy-based NAT is very clear. Can you please elaborate on other advantages that PBN gives us beside matching traffic using ACL. What I mean is that it was correctly pointed out that the same result might be achieved using just ACL as a source instead of static nat. Also you can match the same traffic with this ACL. So what is the flexibility and advantage that route-maps are giving us?
Can we match next-hop, can we alter next-hop, can we do some advanced matching that we’ll not be able to achieve using ACL?
---
### Author:  [@lagapidis](https://forum.networklessons.com/u/lagapidis)
#### Post date: [August 24, 2020, 8:11am UTC](https://forum.networklessons.com/t/policy-nat/3881/9 "2020-08-24T08:11:10Z")
Hello Denis
As mentioned in a post above, yes you would be able to get the same result as that within this lesson simply by using an access list. However, the advantages of using Policy NAT over simply using an access list is the same as the advantages given by route lists over access lists.
Route lists are more powerful since, besides prefixes, there are a lot of different match conditions that you can use. In the [Introduction to Route Maps lesson](https://networklessons.com/cisco/ccnp-route/introduction-to-route-maps), you will find the following list of elements that can be matched:
```
R2(config-route-map)#match ?
additional-paths BGP Add-Path match policies
as-path Match BGP AS path list
clns CLNS information
community Match BGP community list
extcommunity Match BGP/VPN extended community list
interface Match first hop interface of route
ip IP specific information
ipv6 IPv6 specific information
length Packet length
local-preference Local preference for route
mdt-group Match routes corresponding to MDT group
metric Match metric of route
mpls-label Match routes which have MPLS labels
policy-list Match IP policy list
route-type Match route-type of route
rpki Match RPKI state of route
security-group Security Group
source-protocol Match source-protocol of route
tag Match tag of route
track tracking object
```
So you can apply policy NAT based on the metric of a route, or even the tracking of a particular object. Even when working only with prefixes, route maps give you the advantage of working with multiple access lists allowing you to create more complex polices for NATting.
I hope this has been helpful!
Laz
---
### Author:  [@osvaldocarolb](https://forum.networklessons.com/u/osvaldocarolb)
#### Post date: [December 15, 2020, 5:55pm UTC](https://forum.networklessons.com/t/policy-nat/3881/10 "2020-12-15T17:55:31Z")
Hello Rene:
I was labbing this topic and detected that with static nat, “route-map” apply only when the traffic is initiated from the inside to outside. But when the traffic is initiated from the outside to inside, this does not follows “route-map” rules. I have checked on Cisco documentation and saw that need to include at the end the reverse option, also tested but did not work…Can you share any information about this issue, please? If necessary I can share the config I have tested.
Thanks in advance!!
---
### Author:  [@lagapidis](https://forum.networklessons.com/u/lagapidis)
#### Post date: [December 18, 2020, 6:20am UTC](https://forum.networklessons.com/t/policy-nat/3881/11 "2020-12-18T06:20:53Z")
Hello Ovaldo
What you are describing is the normal behaviour of NAT, whether you use policy NAT with route maps or not. When configuring `ip nat inside source static`, only traffic initiated from inside to outside will create the NAT translation. Of course, any return traffic of the same flow (same source and destination IP addresses and ports) will be allowed back through, as these are identified as responses to the initial communication.
If you want to enable incoming traffic from outside in, you must use the examples shown in the following lessons:
[https://networklessons.com/cisco/ccie-enterprise-infrastructurecisco-ios-nat-port-forwarding](https://networklessons.com/cisco/ccie-enterprise-infrastructurecisco-ios-nat-port-forwarding)
[https://networklessons.com/cisco/ccie-enterprise-infrastructureip-nat-inside-source-vs-ip-nat-outside-source](https://networklessons.com/cisco/ccie-enterprise-infrastructureip-nat-inside-source-vs-ip-nat-outside-source)
I hope this has been helpful!
Laz
---
### Author:  [@osvaldocarolb](https://forum.networklessons.com/u/osvaldocarolb)
#### Post date: [December 23, 2020, 2:45am UTC](https://forum.networklessons.com/t/policy-nat/3881/12 "2020-12-23T02:45:00Z")
Hello Laz:
Thanks a lot by your feedback!! You said that when we set “ip nat inside source static” only traffic initiated from the inside to outside can be translated and of course the return traffic beloging to the same flow. At this point, I can not agree with you, also traffic initiated from the outside can be translated (IG–\>IL). From my reading on Cisco Documentation when uses “route-map” for static nat, only inside to outside flow works, if the traffic is initiated from the outside “route-map” does not apply. This is, one interesting aspect , that’s why i asked about it.
Thanks!!
---
### Author:  [@lagapidis](https://forum.networklessons.com/u/lagapidis)
#### Post date: [December 27, 2020, 8:19am UTC](https://forum.networklessons.com/t/policy-nat/3881/13 "2020-12-27T08:19:15Z")
Hello Ovaldo
Yes, I stand corrected. My thoughts were focusing more on PAT. Using the `ip nat inside source static` command will create a one to one static NAT translation for traffic in both directions.
As for the use of route-maps for static NAT, the addition of the `route-map` keyword at the end of the NAT statement adds a requirement that the route-map achieve a match in order for that NAT statement to be applied, and the translation to take place. In the specific NAT statement of the lesson, the only way a translation will take place is if there is a match with the source address and the destination address. Since such a match will only take place on outgoing traffic with the specific source and destination IP addresses, then only the specific outgoing traffic will be matched.
What you are referring to here when talking about the `reversible` keyword in your post is further described in the following Cisco documentation:
> **[IP Addressing: NAT Configuration Guide, Cisco IOS Release 15M&T -...](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_nat/configuration/15-mt/nat-15-mt-book/iadnat-addr-consv.html#GUID-64306C21-506F-4085-8587-654BB69C890C)**
>
> Configuring NAT for IP Address Conservation
It includes restrictions on this feature, and what platforms support it.
I hope this has been helpful!
Laz
---
### Author:  [@osvaldocarolb](https://forum.networklessons.com/u/osvaldocarolb)
#### Post date: [December 29, 2020, 8:34pm UTC](https://forum.networklessons.com/t/policy-nat/3881/14 "2020-12-29T20:34:04Z")
Hello Laz:
Thanks for your reply!!
---
### Author:  [@konstantinos\_dimos](https://forum.networklessons.com/u/konstantinos_dimos)
#### Post date: [February 27, 2023, 1:36am UTC](https://forum.networklessons.com/t/policy-nat/3881/15 "2023-02-27T01:36:30Z")
why the link btween nat and ips1 catch 192.168.1.101 as source and not 192.168.12.1?
---
### Author:  [@lagapidis](https://forum.networklessons.com/u/lagapidis)
#### Post date: [March 4, 2023, 7:25am UTC](https://forum.networklessons.com/t/policy-nat/3881/16 "2023-03-04T07:25:53Z")
Hello Konstantinos
When H1 attempts to create a telnet session with 2.2.2.2, the packet should arrive at ISP1 with a source address of 192.168.12.1. According to the lesson, this translation occurs successfully at R1. Are you seeing something different in your topology? If so, then there may be something wrong with the translation configuration, the route map, or the ACL in your configuration of R1. Take a look and if you need any further help, let us know!
I hope this has been helpful!
Laz
---
### Author:  [@davidilles](https://forum.networklessons.com/u/davidilles)
#### Post date: [January 31, 2025, 11:50am UTC](https://forum.networklessons.com/t/policy-nat/3881/17 "2025-01-31T11:50:19Z")
Hello, everyone.
I understand why Static NAT/PAT might be used, why Dynamic PAT might be used, even why Twice NAT, but Policy NAT? What are some use cases for that? Why would we want to translate the source IP/port only if it meets certain criteria?
Thank you.
David
---
### Author:  [@lagapidis](https://forum.networklessons.com/u/lagapidis)
#### Post date: [February 6, 2025, 8:21am UTC](https://forum.networklessons.com/t/policy-nat/3881/18 "2025-02-06T08:21:27Z")
Hello David
Policy NAT also known as Conditional NAT, is used when you want to apply NAT based on certain conditions or criteria. This is particularly useful in scenarios where you want to have more control of the NAT process.
Here are a few use cases for Policy NAT:
- Different Service Providers: If your network is connected to multiple ISPs and you want to route and NAT traffic to different ISPs based on the source IP or type of traffic, you can use Policy NAT.
- Security: You might want to translate the source IP only for certain destinations to hide the internal IP addresses from specific external networks, while leaving it un-translated for other destinations.
- Load Balancing: In some cases, you might want to distribute the network load by directing traffic through different paths based on source/destination IPs or protocols. Policy NAT can be used to achieve this. (Although this is not the best use of the feature! There are other more appropriate ways to do this…)
- Overlapping Networks: If your company merges with another company and both have networks using the same IP address range, you can use Policy NAT to avoid IP address conflicts.
The truth is that the use cases re somewhat limited, but are not unheard of. These are just some, and there may be more, but I think you get the idea.
I hope this has been helpful!
Laz
---
### Author:  [@samirkhair](https://forum.networklessons.com/u/samirkhair)
#### Post date: [September 12, 2026, 6:33pm UTC](https://forum.networklessons.com/t/policy-nat/3881/19 "2026-09-12T18:33:48Z")
Hi,
Any reason why you didn’t create the NAT this way:
```auto
ip nat inside source route-map TO_ISP1 interface Gi0/2
ip nat inside source route-map TO_ISP2 interface Gi0/3
```
Sam
---
### Author:  [@lagapidis](https://forum.networklessons.com/u/lagapidis)
#### Post date: [September 14, 2026, 4:57am UTC](https://forum.networklessons.com/t/policy-nat/3881/20 "2026-09-14T04:57:52Z")
Hello Sam
The commands you’re suggesting implement a valid NAT feature, but they **solve a different problem** than what the lesson implements. Let me explain why.
The lesson uses:
`ip nat inside source static 192.168.1.101 192.168.12.1 route-map TO_ISP1`
This creates a permanent, static 1:1 mapping between a specific inside host (192.168.1.101) and a specific global address (192.168.12.1). The route-map decides which static global address to use based on the destination of the traffic. This is perfect when you need a predictable, always-present, bidirectional binding.
Your proposed command would be:
`ip nat inside source route-map TO_ISP1 interface Gi0/2 overload`
(Note: the syntax requires `overload` at the end.) This creates a dynamic, on-demand PAT translation where traffic is translated to the interface’s IP address. It’s typically used for outbound multi-ISP scenarios where many inside hosts can share the same outside interface IP and you want failover or load-balancing between ISPs.
In the Policy NAT scenario in the lesson, the requirement is specific:
- A particular internal host (192.168.1.101) must translate to different global addresses depending on where it’s communicating to (destination-based routing)
- The translations must be static and always present in the translation table
- The route-map acts as a conditional selector for which pre-existing static mapping applies
Your syntax, by contrast, would create translations **only when matching traffic is seen** , and it would translate the **entire inside host to the interface IP** , and not to the specific global addresses like 192.168.12.1 or 192.168.13.1 that the lesson specifies.
Both are valid NAT applications, but each is used for a different use case. The lesson’s approach solves the specific “conditional static NAT” problem, while yours solves “multi-ISP PAT with failover.” Make sense?
I hope this has been helpful!
Laz
[Next page](https://forum.networklessons.com/t/policy-nat/3881.md?page=2)