What Two Addresses Are Specified In A Static Nat Configuration

You're Missing Half the Picture If You Only Know One Address in Static NAT

Let's be honest—most network diagrams show you the pretty flow of traffic, but then you hit that one question in the certification exam and something clicks off in your brain: "How many addresses does static NAT actually configure?" You've got one address mapped, sure. But static NAT? It's not just about telling your router where to send traffic back. It's about creating a two-way conversation between two specific IP addresses Simple, but easy to overlook..

And that's exactly what static NAT does—it establishes a permanent mapping between two IP addresses. Still, one local, one global. Which means one inside, one outside. You need both to make the magic work Simple, but easy to overlook..

What Is Static NAT?

Static Network Address Translation is the most straightforward type of NAT you'll configure. Consider this: unlike dynamic NAT or PAT (port address translation), static NAT creates a one-to-one mapping between an internal private IP address and a specific external public IP address. The router doesn't assign these addresses randomly or based on availability—it's preconfigured, locked in, and unchanging.

Think of it like a permanent phone line. No guessing, no translation tables aging out, no port multiplexing. When someone inside your network needs to be reached from the outside world, static NAT ensures there's always the same number (public IP) pointing back to the same extension (private IP). Just a direct, unbreakable link Worth keeping that in mind..

The Two Addresses You Need

Here's where most people trip up. Static NAT requires two addresses to function:

1. The Inside Local Address – This is the private IP address assigned to the internal host or interface
2. The Outside Global Address – This is the public IP address that external entities use to reach that internal host

These aren't just any two addresses. They're specifically paired together in your configuration, and both must be defined for static NAT to work properly.

Why People Get This Wrong

I've seen countless network engineers—even some with years of experience—configure static NAT with only one address in mind. They'll set up the translation but forget that bidirectional communication requires both sides of the equation. The router needs to know not just where to send traffic from, but also where to send traffic to.

Here's what most guides don't highlight enough: static NAT is fundamentally about address pairing. You're not just translating one address—you're creating a permanent relationship between two addresses. Miss one, and the whole thing falls apart.

How Static NAT Actually Works

Let's walk through a real-world example to see how these two addresses come together.

Say you have an internal web server with IP address 192.Your ISP has assigned you a public IP address of 203.168.Even so, 113. 0.100 that needs to be accessible from the internet. 1.50 for this server Which is the point..

In your router configuration, you'd use:

ip nat inside source static 192.168.1.100 203.0.113.50

That's it. Two addresses. One internal, one external Worth keeping that in mind. And it works..

When an external user pings 203.113.168.50, the router consults its NAT table and knows to forward that traffic to 192.Consider this: 113. 100 back to 203.100. In real terms, 1. 0.1.0.In real terms, when the web server responds, the router translates 192. 168.50 before sending it out Nothing fancy..

The Translation Table in Action

Your router maintains a NAT translation table that shows exactly this pairing:

Pro Inside Local    Inside Global   Outside Local    Outside Global
tcp 192.168.1.100:80 203.0.113.50:80 203.0.113.50:54321 203.0.113.50:54321

Notice how both the inside local and outside global addresses are part of the same entry. That's not coincidence—that's the essence of static NAT It's one of those things that adds up..

Common Configuration Mistakes

Forgetting the Interface Roles

Before you even get to the addresses, make sure your interfaces are properly designated. You need:

interface GigabitEthernet0/0
 ip nat inside

interface GigabitEthernet0/1
 ip nat outside

Without these interface roles, your static NAT configuration won't work regardless of how many addresses you specify.

Mixing Up the Address Order

I can't tell you how many times I've seen this in lab environments. Engineers configure:

ip nat inside source static 203.0.113.50 192.168.1.100

Instead of the correct order:

ip nat inside source static 192.168.1.100 203.0.113.50

The syntax is inside-local-address outside-global-address. Get that backwards and you'll be troubleshooting for hours.

Assuming One Address Is Enough

This is the big one. People think static NAT just maps an internal address to... On the flip side, well, something. But they forget that the router needs to know both ends of the conversation. It's like having a mailing address but no return address on a postcard Easy to understand, harder to ignore..

Practical Applications Where Both Addresses Matter

Hosting Multiple Servers

Many organizations use static NAT to expose multiple internal servers to the internet. Each server gets its own pair of addresses:

ip nat inside source static 192.168.1.101 203.0.113.51
ip nat inside source static 192.168.1.102 203.0.113.52
ip nat inside source static 192.168.1.103 203.0.113.53

Each line creates a complete mapping between two addresses. Remove any one of them and that server becomes unreachable.

VPN Endpoint Configuration

When configuring site-to-site VPN connections, static NAT often pairs with crypto maps to ensure proper address translation for VPN traffic. The inside and outside addresses must be carefully coordinated so that VPN peers can properly initiate and respond to connections Surprisingly effective..

Troubleshooting When Things Don't Work

Check Your NAT Table

First thing I do when static NAT isn't working:

show ip nat translations

This shows you exactly what address pairs are configured. If you're only seeing one address in the translation, something's wrong with your configuration.

Verify Interface Designations

Run:

show ip nat statistics

This tells you how many translations are active and whether your interfaces are properly marked. More importantly, look at:

show running-config | include ip nat

This shows you all your NAT configurations in one place so you can verify both addresses are present That's the part that actually makes a difference..

Test Bidirectional Connectivity

The real test of static NAT is whether both directions work. Ping from inside to outside using the global address, and try to initiate connections from outside to inside using the public IP. Both should work easily.

Advanced Considerations

Using Access Lists with Static NAT

Sometimes you need to control which traffic gets translated. You can combine static NAT with access lists:

access-list 10 permit host 192.168.1.100
ip nat inside source static 192.168.1.100 203.0.113.50 extendable

But even with access lists, you're still working with that fundamental pair of addresses.

Overlapping Networks

When dealing with overlapping address spaces (same private subnet used by multiple sites), you might need to use more advanced features like route maps. But the core principle remains: you need both the inside local and outside global addresses defined.

The Bottom Line

Static NAT isn't about one address—it's about two addresses working together. The inside local address represents where the traffic originates, and the outside global address represents where it appears to come from externally. Without both, you don't have static NAT—you have an incomplete configuration that will fail in subtle and not-so

The Bottom Line (Continued)

Static NAT isn’t about one address—it’s about two addresses working in concert. The inside‑local address marks the origin of the traffic, while the outside‑global address tells the outside world where that traffic appears to come from. When either half of the pair is missing or mis‑configured, the translation either never creates a session or creates a “one‑way” entry that looks correct in the NAT table but fails the actual data exchange. The failures can be subtle— intermittent connectivity, TCP SYN‑ACK drops, or applications that appear to reach the host but then stall—making them hard to pin down without a disciplined verification process.

It sounds simple, but the gap is usually here.

Best‑Practice Checklist

Enable Debug (temporarily)

When the basic verification steps don’t reveal the problem, it’s time to turn on NAT debugging. On most IOS‑based devices you can issue a one‑off debug command that logs every translation event to the console (or to a specified logging buffer).

# Enable debugging for static NAT events
debug ip nat verbose

Why verbose?
The regular debug ip nat shows only high‑level events (add/delete), while verbose adds the full packet header details, the TCP/UDP ports, and the exact ACLs that matched. This level of detail is invaluable when a session appears in the NAT table but the data plane never reaches its destination.

Interpreting the Output

NAT: build outbound
  saddr 192.168.1.102:1234 daddr 203.0.113.52:80
  protocol TCP
  input interface GigabitEthernet0/0 (inside)
  output interface GigabitEthernet0/1 (outside)
  NAT translation: 192.168.1.102:1234 → 203.0.113.52:80
  ACL match: permit 192.168.1.0 0.0.0.255 any

• saddr / daddr – Source and destination addresses (including ports).
• input / output interface – Confirms the traffic is indeed crossing the inside‑to‑outside boundary.
• ACL match – Shows which access‑list entry permitted the flow. If the line is missing, the packet was dropped before reaching NAT.

If you see NAT: drop or NAT: no matching entry, the problem is usually an ACL mis‑configuration, a missing ip nat inside marking, or a route‑map that blocked the flow.

Disable Debug After Use

Always remember to turn the debug off; otherwise the console will be flooded and device performance will degrade.

# Stop the debug session
no debug ip nat verbose

Putting It All Together – A Troubleshooting Flowchart

1. Check Interface Marks – show running-config | include ip nat
   Both inside and outside must be present.

2. Verify Translation Entries – show ip nat translations (or verbose)
   Confirm that the inside‑local ↔ outside‑global pair exists.

3. Inspect Statistics – show ip nat statistics
   Zero hits indicate that traffic never reached NAT.

4. Test Bidirectional Reachability – Ping from inside to global and from outside to local.
   If only one direction works, focus on ACLs/route‑maps applied to the translation.

5. Review ACLs & Route‑Maps – show access-lists, show ip route, show ip nat inside source
   Ensure the source IP is permitted and a return route exists.

6. Enable Debug (if needed) – debug ip nat verbose
   Capture detailed logs, then disable immediately.

7. Document & Update Design – Record any changes, especially for overlapping‑network scenarios, and adjust the network diagram accordingly.

Common Pitfalls in Static NAT Deployments

source IP/port configuration and ensure the packet matches the translation rule. |

Advanced Scenario: NAT Overload (PAT) and Port Exhaustion

In high-density environments using Port Address Translation (PAT), a common but subtle failure occurs when the device runs out of available source ports for a single global IP address. When the NAT translation table reaches its maximum capacity or the available port range is exhausted, new connection attempts will fail silently or trigger "no matching entry" errors That's the part that actually makes a difference..

To diagnose this, use show ip nat statistics. Look specifically for the "misses" or "failed" counters. If these numbers are incrementing rapidly, you may need to:

• Increase the pool of global addresses: Instead of using a single interface IP, use a pool of public IPs. In practice, * Implement NAT Port Block Allocation: To prevent a single host from consuming all available ports. * Check for "Stuck" Translations: Use clear ip nat translation * (use with caution in production) to clear stale sessions that may be hogging port resources.

Some disagree here. Fair enough.

Conclusion

Troubleshooting Network Address Translation is a systematic process of elimination. It requires a clear understanding of the packet's journey: from the local interface marking to the ACL validation, through the translation engine, and finally to the routing table for the return path Still holds up..

By following the structured approach outlined in this guide—starting with configuration verification and moving toward granular debugging—you can efficiently isolate whether a connectivity issue is a result of a simple misconfiguration, a routing error, or a resource limitation. Remember, NAT is a critical "gatekeeper" function; ensuring its integrity is fundamental to both the security and the connectivity of any modern enterprise network.