6.8 2 Lab Configure Nat For Ipv4

You're staring at the lab topology. In real terms, three routers. A simulated ISP. An inside network with a couple of PCs. And the instructions: *Configure NAT for IPv4 But it adds up..

If you're doing the Cisco 6.8.2 lab — or any NAT configuration task — you already know the theory. Inside local, inside global, outside local, outside global. Static vs dynamic vs PAT. Practically speaking, the definitions are easy. The configuration is where people get stuck.

I've watched students type ip nat inside on the wrong interface. I've seen access lists that match nothing. I've debugged NAT translations that never appear because the routing table sends traffic the other way That alone is useful..

This post isn't a cheat sheet for the lab. It's the guide I wish I had when I first configured NAT on real gear — the stuff the lab manual assumes you already know.

What Is NAT for IPv4 (Really)

Network Address Translation lets private IPv4 addresses talk to the internet. Practically speaking, that's it. That's the whole job.

Your LAN runs 192.0/24. On top of that, the internet doesn't route that. NAT sits at the edge — usually your border router or firewall — and rewrites the source address of outbound packets to a public IP (or a pool of them). 1.That said, 168. When replies come back, it rewrites the destination back to the original private host.

Three flavors you'll actually use:

Static NAT — one-to-one mapping. Inside local 192.168.1.10 always becomes 203.0.113.10. Used for servers that need a consistent public presence That's the whole idea..

Dynamic NAT — one-to-one from a pool. First inside host grabs 203.0.113.20, next gets 203.0.113.21. Rarely used in production anymore — you run out of public IPs fast It's one of those things that adds up..

PAT (Port Address Translation) — many-to-one. Also called NAT overload. Hundreds of inside hosts share a single public IP. The router tracks conversations by source port. This is what 99% of SMB and home networks run.

The 6.2 lab typically asks for PAT using the outside interface address. 8.That's the most common real-world scenario anyway.

Why This Lab Trips People Up

The concepts are straightforward. The CLI isn't. Here's what goes wrong:

Wrong interface designation. You tag ip nat inside on the LAN interface and ip nat outside on the WAN interface. Swap them and nothing works — the router doesn't know which side is which.

Access list matches nothing. The access-list 1 permit 192.168.1.0 0.0.0.255 line has to match your actual inside subnet. If your lab uses 192.168.10.0/24 and you paste the example ACL, you'll translate zero packets.

Routing fails before NAT even sees the packet. NAT happens after routing (outbound) and before routing (inbound). If your router doesn't have a route to the ISP — or the ISP doesn't have a route back to your public IP — the packet dies. NAT never gets a chance Simple, but easy to overlook..

Forgetting the default route. Your edge router needs ip route 0.0.0.0 0.0.0.0 <ISP next-hop>. Without it, return traffic from the internet has nowhere to go.

How to Configure NAT for IPv4 (Step by Step)

Let's walk through a complete, working configuration. Consider this: 8. I'll use the typical 6.2 topology: R1 (edge), R2 (ISP), PC-A and PC-B on the inside And that's really what it comes down to..

1. Verify your interfaces and addressing

Before typing any NAT commands, confirm what you're working with.

R1# show ip interface brief
Interface              IP-Address      OK? Method Status                Protocol
GigabitEthernet0/0     192.168.1.1     YES manual up                    up
GigabitEthernet0/1     203.0.113.2     YES manual up                    up

G0/0 = inside (LAN). G0/1 = outside (toward ISP). Your IPs will differ — use your numbers Most people skip this — try not to..

2. Define inside and outside

R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip nat inside
R1(config-if)# exit
R1(config)# interface GigabitEthernet0/1
R1(config-if)# ip nat outside
R1(config-if)# exit

Do this first. If you apply the NAT command before the interface is up, it'll still work — but the habit matters. Inside first, outside second.

3. Create the ACL that identifies interesting traffic

This is the traffic you want translated. Not all traffic — just the inside hosts that need internet access.

R1(config)# access-list 1 permit 192.168.1.0 0.0.0.255

Standard numbered ACL. Here's the thing — permit your inside subnet. Wildcard mask is the inverse of your subnet mask. Think about it: /24 = 0. But 0. 0.255. But /26 = 0. 0.Because of that, 0. On top of that, 63. Get this wrong and you'll either translate nothing or translate the wrong hosts.

4. Configure PAT (NAT overload) using the outside interface

This is the 6.And 8. 2 lab requirement — and the most common production config.

R1(config)# ip nat inside source list 1 interface GigabitEthernet0/1 overload

Break it down:

• ip nat inside source — translate the source address of packets going inside to outside
• list 1 — use ACL 1 to decide which inside hosts
• interface GigabitEthernet0/1 — use this interface's IP as the public address
• overload — enable PAT (port multiplexing)

Honestly, this part trips people up more than it should And that's really what it comes down to..

That's it. Consider this: one command. If you have a pool of public IPs instead, you'd use ip nat pool and reference it — but the lab (and most real deployments) uses the interface IP.

5. Verify it works

Generate traffic. Ping from PC-A to the ISP router (or 8.In real terms, 8. On top of that, 8. 8 if the lab allows).

Then check the translation table:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
icmp 203.0.113.2:1     192.168.1.10:1     198.51.100.1:1     198.51.100.1:1

You should see your inside local (private) mapped to the inside global (public interface IP) with a port number. That's PAT working.

Check statistics too:

R1# show ip nat statistics
Total active translations: 1 (0 static, 1 dynamic; 1 extended)
Outside interfaces: GigabitEthernet0/1
Inside interfaces: GigabitEthernet0/0
Hits: 5  Misses: 0

Hits incrementing = translations happening. Misses = packets that needed translation but didn't match the ACL The details matter here..

Common Mistakes (And How to Fix Them)

"I configured everything but show ip nat translations is empty"

Three usual suspects:

1. No traffic matched the ACL. Ping from the inside

host, not the router. And make sure the destination is reachable from the outside That's the whole idea..

2. Wrong interface designation. Double-check that ip nat inside is on the interface facing your LAN and ip nat outside is on the interface facing the internet or ISP.

3. ACL mismatch. The ip nat inside source list command must reference the same ACL number you created. If you used access-list 10, your NAT command needs list 10 That's the part that actually makes a difference..

"My inside host can't ping external addresses"

Check the return path. Here's the thing — nAT only handles inbound translations if you've explicitly allowed return traffic. For basic setups, ensure your inside hosts have the router as their default gateway. Try pinging the router itself from the host first—if that fails, the issue is upstream of NAT And it works..

"I see translations but traffic still doesn't work"

Look at the statistics again. Practically speaking, if misses are climbing, your ACL is too restrictive. Even so, if hits are zero but you're generating traffic, the ACL may not be matching correctly. Use show access-lists to verify entries are being hit.

Also verify the outside interface has a valid IP address and is operationally up. No IP, no NAT.

Beyond the Basics

Once you've mastered PAT, you can scale to more complex scenarios. Need multiple public IPs? Create a pool:

R1(config)# ip nat pool MYPOOL 203.0.113.2 203.0.113.10 netmask 255.255.255.0
R1(config)# ip nat inside source list 1 pool MYPOOL overload

Want to translate UDP or FTP? The same NAT configuration handles these protocols automatically, though FTP requires special handling in some legacy IOS versions And that's really what it comes down to. Simple as that..

For bidirectional traffic, consider static NAT mappings or NAT with port forwarding. But that's a topic for another lab.

Final Thoughts

NAT isn't magic—it’s policy. You tell it which traffic to translate, where to translate it to, and how to handle the return path. Get the inside and outside interfaces right, match your ACL precisely, and let PAT do the heavy lifting Not complicated — just consistent..

In production, security and scalability matter. But in the lab, this sequence gives you working NAT without the complexity. Master this, then expand.