First, the essential ideas
- NAT
- Network Address Translation changes address information as packets cross a configured boundary. This lesson uses traditional inside-source IPv4 NAT, not NAT64 or a firewall.
- Inside and outside
- These are administrator-selected sides of a NAT boundary. Inside identifies our client LAN; outside identifies the other lab network, not necessarily the public Internet.
- Inside local and inside global
- Inside local is the inside host's address in its own network. Inside global represents that same host toward the outside. Global describes the NAT role; it does not guarantee a publicly routed address.
- Outside local and outside global
- Outside global identifies the outside host in its own network. Outside local is how that host appears inside. They are identical in this lab because outside addresses are not translated.
- Static NAT and pool NAT
- Static NAT configures a fixed address mapping. Dynamic pool NAT selects an available global address for an eligible inside host; without overload, separate simultaneous hosts require separate addresses.
- PAT and overload
- Port Address Translation lets flows share a global address using protocol-specific identifiers, such as TCP/UDP ports. ICMP echo uses an identifier rather than a TCP port. IOS overload enables this sharing.
- ACL and wildcard
- An access control list used by NAT selects traffic for translation. A host entry matches exactly one address. This selection is not an interface packet-filter policy unless separately attached as one.
- Console and verification
- Right-click the named GNS3 node and choose Console. IOS > is user EXEC, # is privileged EXEC and (config)# is configuration. VPCS has different commands. Predicted output is not a measured result.
Follow the same client and remote destination through three separate translation policies. Do not leave all policies enabled and guess which one handled the packet. Each phase must remove the preceding mapping and preserve the same cables, routes and endpoint addresses.
See the idea
Static, pool and PAT change different things
Keep the client fixed; compare how its outside representation is chosen.
Fix one mapping
Static NAT maps PC1 10.40.0.10 to 198.18.0.100. The basic mapping exists even before traffic proves a successful exchange.
What this model leaves out: Conceptual policy comparison, not physical wiring or measured scale. The full lab path ends at Outside1, and only one client is exercised.
Full visual explanation and references
Three records compare static NAT's fixed mapping, dynamic NAT's pool allocation and PAT's shared address with flow identifiers.
Conceptual policy comparison, not physical wiring or measured scale. The full lab path ends at Outside1, and only one client is exercised.
- Fix one mapping
Static NAT maps PC1 10.40.0.10 to 198.18.0.100. The basic mapping exists even before traffic proves a successful exchange.
www.cisco.com - Allocate from a pool
Dynamic NAT chooses an available pool address for eligible traffic. Without overload, address capacity limits simultaneous host mappings.
www.cisco.comwww.rfc-editor.org - Share with flow state
PAT uses 198.51.100.1 plus protocol-specific state. TCP/UDP ports or ICMP identifiers help associate replies with the inside flow.
www.cisco.comwww.rfc-editor.org
One idea at a time
Start with something familiar.
Write two labels for the same inside host: its original 10.40.0.10 address and the address representing it outside. NAT does not create a second computer. Then write the unchanged destination 203.0.113.10 beside Outside1.
Why learn this?
Translation troubleshooting often fails when an operator treats routing, NAT selection and security policy as one thing. Keeping them separate lets a learner explain why a configured mapping may still produce no reply.
An everyday comparison
A receptionist can use one published contact number while maintaining a list of internal extensions. The published number and an extension identify different views of a contact.
What happens in a network
The two address views resemble inside global and inside local. Additional flow identifiers let replies be associated with the correct internal exchange when an address is shared.
Where the comparison stopsNAT is not a human screening service or an encryption method. Protocol state and routing rules, not the analogy, determine which packets can be translated and delivered.
Follow one worked example
- Prove the two local links first.
PC1 reaches NAT1 at 10.40.0.1, and NAT1 reaches Outside1. Outside1 has a return route for the translated pool, not for 10.40.0.0/24.
Why: The setup makes a translated reply path explicit without claiming translation itself installs every route.
- Read one static mapping in both directions.
10.40.0.10 is represented by 198.18.0.100. The remote destination remains 203.0.113.10 before and after the inside-source translation.
Why: The four table headings are relative roles, not four necessarily different numerical addresses.
- Change only the translation policy.
Remove static NAT, test dynamic pool allocation, then replace it with interface overload using 198.51.100.1.
Why: Separate phases keep the observed entry attributable to one known policy.
- Break the selector, not the destination.
Change the NAT ACL to select .99 instead of PC1's .10, clear only this disposable router's dynamic state, then test and restore.
Why: A wrong selector can leave routing and interfaces correct while preventing the intended translation.
Your first small task
On paper, fill four table columns for PC1 reaching Outside1 under static NAT: inside local, inside global, outside local and outside global. Use the exact address plan and explain why the last two are equal.
Show a hint
First ask which host a column describes, then which side's representation it names.
Check the expected result
The values are 10.40.0.10, 198.18.0.100, 203.0.113.10 and 203.0.113.10. This lab changes only the inside source.
Pause and explain it in your own words
Does a permit in the NAT selector authorize all traffic through a firewall?
Show a hint
Identify whether the ACL is referenced by a NAT rule or attached as an interface filter.
Show the explanation
No. The NAT rule uses this ACL to select translation candidates. Firewall policy and any separately attached interface ACL are separate controls; a NAT permit is not their approval.
Short answer
What should you understand today?
Static NAT fixes an address mapping, dynamic NAT allocates from a pool, and PAT lets flows share an address using protocol identifiers. All require the intended inside/outside boundary and working routes. A translation entry is evidence of a mapping, not proof of application success. A NAT selection ACL chooses traffic to translate; it is not automatically a firewall.
Before you begin
Learning targets
- Recall Day 31 static routes and Day 15 IOS configuration modes; a route chooses the next hop.
- Use GNS3 2.2.55 with two independently entitled C8000v IOS XE 17.12.1a routers and one VPCS 0.8 node.
- Read the address table before connecting anything; all outside addresses remain inside this disconnected lab.
- Identify inside local, inside global, outside local and outside global in one exchange.
- Configure and verify static inside-source NAT and a non-overloaded dynamic pool.
- Replace the pool rule with IOS XE interface overload and inspect protocol-specific state.
- Separate translation selection from routing and packet filtering.
- Repair one known selector fault and repeat the original traffic and table checks.
Words you will meet
Open a word when you need its meaning. You do not need to memorize the whole list before reading.
NAT
Network Address Translation changes address information as packets cross a configured boundary. This lesson uses traditional inside-source IPv4 NAT, not NAT64 or a firewall.
Inside and outside
These are administrator-selected sides of a NAT boundary. Inside identifies our client LAN; outside identifies the other lab network, not necessarily the public Internet.
Inside local and inside global
Inside local is the inside host's address in its own network. Inside global represents that same host toward the outside. Global describes the NAT role; it does not guarantee a publicly routed address.
Outside local and outside global
Outside global identifies the outside host in its own network. Outside local is how that host appears inside. They are identical in this lab because outside addresses are not translated.
Static NAT and pool NAT
Static NAT configures a fixed address mapping. Dynamic pool NAT selects an available global address for an eligible inside host; without overload, separate simultaneous hosts require separate addresses.
PAT and overload
Port Address Translation lets flows share a global address using protocol-specific identifiers, such as TCP/UDP ports. ICMP echo uses an identifier rather than a TCP port. IOS overload enables this sharing.
ACL and wildcard
An access control list used by NAT selects traffic for translation. A host entry matches exactly one address. This selection is not an interface packet-filter policy unless separately attached as one.
Console and verification
Right-click the named GNS3 node and choose Console. IOS > is user EXEC, # is privileged EXEC and (config)# is configuration. VPCS has different commands. Predicted output is not a measured result.
Names describe viewpoints, not public versus private
Inside local and inside global describe two representations of the inside host. Outside local and outside global describe the outside host. In a simple inside-source design the outside address remains unchanged, so two columns legitimately contain the same address. Do not label every private address local and every public-looking address global without checking its role.
- Read each column as host identity plus representation.
- The outside node is the final recipient, not an omitted Internet cloud.
Static mapping fixes an address relationship
Static inside-source NAT configures a stable mapping between one inside-local address and one inside-global address. Its basic entry can appear without traffic, unlike an on-demand dynamic allocation. Static mapping does not create the internal host, guarantee a route or specify all security policy. Inbound reachability also depends on routing and filtering.
- An entry that exists before traffic is not proof of a successful exchange.
- Use a reachable translation range and a known return path.
Dynamic pool NAT allocates a scarce resource
A pool defines candidate inside-global addresses. The NAT selection ACL identifies eligible inside sources. Without overload, ordinary dynamic address mapping does not allow unlimited inside hosts to share one pool address simultaneously. Pool exhaustion can therefore affect new allocations while existing translations continue. A pool name is not a route, and a NAT ACL deny means no match for that translation policy, not automatically a packet drop.
- Traffic is needed to create an on-demand mapping.
- Compare pool utilization and selection before changing unrelated routes.
PAT shares an address, not an unlimited resource
Overload permits flows to share an inside-global address using protocol-specific state. TCP and UDP use ports; ICMP echo can use identifiers. A protocol identifier is not a device's physical interface number. Capacity is finite and platform-dependent. A single ping verifies only a narrow flow, not a realistic NAT scale, throughput or application mix.
- A shared global address still needs per-flow state and correct return handling.
- PAT is not encryption and is not a substitute for an explicit security policy.
Evidence must separate mapping from successful delivery
Inspect interfaces and routes, the configured selection, translation entries and actual endpoint tests. A router-originated ping may not traverse the same inside-to-outside path as traffic from PC1, so it cannot replace the endpoint test. NAT counters can rise for traffic that later fails elsewhere. Existing state can also hide the impact of a changed policy.
- Never clear a shared production translation table for this lesson.
- Restore the exact host selector, then retest from PC1 rather than NAT1.
Treat phases and cleanup as part of the change
Stop test traffic before removing a dynamic mapping. In this disposable project only, clearing dynamic translations makes policy replacement unambiguous; the command can disrupt sessions elsewhere. If IOS says a mapping is in use, do not force an unfamiliar production procedure. Confirm the isolated boundary, stop traffic and inspect state before continuing.
- Keep one active translation policy for this client during each phase.
- v1.1 remains current through 2 February 2027; v2.0 begins 3 February 2027.
Real-world walkthrough
The NAT rule exists, but the client does not match
A fictional operator replaces an address group and accidentally selects a host ending in .99 instead of .10. Interface-overload syntax remains correct, both links are up and the destination route is present. The user still cannot reach the remote endpoint. A useful investigation must follow the actual source through the selector and compare new translation state.
- Record PC1's actual source and gateway and prove its local gateway still replies before changing the NAT policy.
- Compare the source with the NAT ACL and inspect whether a fresh endpoint test creates a matching translation.
- Check the remote return path independently. An untranslated private source may fail because no route back exists, not because the NAT selector is a firewall.
- Restore the approved host match and repeat the same endpoint destination while inspecting translation state immediately.
- Document the observed mapping and replies. Do not claim browser, DNS, Internet or multiuser capacity testing from one ICMP exchange.
Guided GNS3 lab
Three translation phases on one complete path
Compare static NAT, dynamic pool NAT and interface PAT on the same isolated IOS XE topology, then repair one selection fault. No runtime was performed by the author; preserve actual results and stop on unsupported syntax.
Addressing plan
| Device | Interface | Address | Purpose |
|---|---|---|---|
| PC1 | Ethernet0 | 10.40.0.10/24; gateway 10.40.0.1 | Inside client. |
| NAT1 | GigabitEthernet1 | 10.40.0.1/24 | Inside gateway. |
| NAT1 | GigabitEthernet2 | 198.51.100.1/30 | Outside port and PAT address. |
| Outside1 | GigabitEthernet1 | 198.51.100.2/30 | Adjacent outside router. |
| Outside1 | Loopback0 | 203.0.113.10/32 | Final destination, not an Internet host. |
| NAT policy | Static / pool | 198.18.0.100 / 198.18.0.101-102 | Routed lab translation addresses; not extra nodes. |
Set up the lab
- Start fresh nodes with the two exact links. Record releases and interfaces; stop if the image or names do not match the reference platform.
- Keep NAT1 and Outside1 Consoles open throughout. Capture prelab snapshots and do not save an intentional fault into startup configuration.
- Only this disconnected lab may use clear ip nat translation *. It clears dynamic sessions on NAT1 and would disrupt users on a shared router.
- Paper alternative: compute each table row and diagnose selector/pool/return-route faults without running IOS. Do not claim measured allocation, throughput or session sharing.
Build the inside and outside boundary
In GNS3, right-click NAT1 and choose Console before typing. Start at > or # on the fresh router. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
enable
configure terminal
interface GigabitEthernet1
ip address 10.40.0.1 255.255.255.0
ip nat inside
no shutdown
exit
interface GigabitEthernet2
ip address 198.51.100.1 255.255.255.252
ip nat outside
no shutdown
endWhat each command means
enable- Enter privileged EXEC (#) from user EXEC (>); use only your authorized lab credentials.
configure terminal- Enter global configuration mode from privileged EXEC (#); accepted changes affect the running device.
interface GigabitEthernet1- Select the port cabled to PC1.
ip address 10.40.0.1 255.255.255.0- Set the inside gateway with the /24 mask.
ip nat inside- Mark this interface as the inside side of traditional NAT.
no shutdown- Enable the selected inside port.
exit- Return to global mode before selecting the other interface.
interface GigabitEthernet2- Select the cable toward Outside1.
ip address 198.51.100.1 255.255.255.252- Set the /30 outside transit address.
ip nat outside- Mark this as the outside boundary.
no shutdown- Enable the outside port.
end- Return to privileged EXEC (#). This neither saves the configuration nor reverses accepted changes.
- What you should see
- Both ports have the intended roles and addresses.
- Why this step matters
- The boundary determines which traversing traffic is eligible for this style of NAT.
Add the destination route
In GNS3, right-click NAT1 and choose Console before typing. Start at # and inspect the initial state before any translation. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
configure terminal
ip route 203.0.113.10 255.255.255.255 198.51.100.2
end
show ip route
show ip nat translations
show ip nat statisticsWhat each command means
configure terminal- Enter global configuration mode from privileged EXEC (#); accepted changes affect the running device.
ip route 203.0.113.10 255.255.255.255 198.51.100.2- Route the exact /32 destination through the adjacent outside router.
end- Return to privileged EXEC (#). This neither saves the configuration nor reverses accepted changes.
show ip route- Record connected and static routes for the baseline.
show ip nat translations- Record the initially empty translation state.
show ip nat statistics- Check inside/outside interface identification and current statistics.
- What you should see
- The destination route exists; no client translation has yet been configured.
- Why this step matters
- A route and a translation are different objects and must be verified independently.
Build the destination and return route
In GNS3, right-click Outside1 and choose Console before typing. Start at > or #. Do not add a route to the untranslated client LAN. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
enable
configure terminal
interface GigabitEthernet1
ip address 198.51.100.2 255.255.255.252
no shutdown
exit
interface Loopback0
ip address 203.0.113.10 255.255.255.255
exit
ip route 198.18.0.0 255.255.255.0 198.51.100.1
endWhat each command means
enable- Enter privileged EXEC (#) from user EXEC (>); use only your authorized lab credentials.
configure terminal- Enter global configuration mode from privileged EXEC (#); accepted changes affect the running device.
interface GigabitEthernet1- Select the port cabled to NAT1's outside port.
ip address 198.51.100.2 255.255.255.252- Assign the adjacent transit address.
no shutdown- Enable the transit interface.
exit- Return to global configuration.
interface Loopback0- Create the logical interface serving as the final test destination.
ip address 203.0.113.10 255.255.255.255- Assign the final destination as a /32 host address.
exit- Return to global configuration before adding the return route.
ip route 198.18.0.0 255.255.255.0 198.51.100.1- Route the static/pool global range back to NAT1.
end- Return to privileged EXEC (#). This neither saves the configuration nor reverses accepted changes.
- What you should see
- Outside1 reaches the translation range through NAT1 and owns the loopback target.
- Why this step matters
- Explicit routing makes the reply path reproducible without depending on proxy ARP.
Address PC1 and establish local baseline
In GNS3, right-click PC1 and choose Console before typing. Use the VPCS prompt, not IOS configuration mode. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
ip 10.40.0.10/24 10.40.0.1
show ip
ping 10.40.0.1
ping 203.0.113.10What each command means
ip 10.40.0.10/24 10.40.0.1- Assign PC1's source, /24 mask and NAT1 gateway.
show ip- Inspect PC1's actual settings before testing.
ping 10.40.0.1- Test the inside cable and gateway.
ping 203.0.113.10- Record the untranslated attempt; Outside1 has no route back to the client LAN.
- What you should see
- The gateway should reply; the remote test should fail before NAT is configured.
- Why this step matters
- This records a limited path baseline and distinguishes local connectivity from translated return reachability.
Configure static inside-source NAT
In GNS3, right-click NAT1 and choose Console before typing. Start at #; this is the only active translation policy for PC1. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
configure terminal
ip nat inside source static 10.40.0.10 198.18.0.100
end
show ip nat translationsWhat each command means
configure terminal- Enter global configuration mode from privileged EXEC (#); accepted changes affect the running device.
ip nat inside source static 10.40.0.10 198.18.0.100- Fix the inside-local client to the inside-global lab address.
end- Return to privileged EXEC (#). This neither saves the configuration nor reverses accepted changes.
show ip nat translations- Inspect the static address relationship even before test traffic.
- What you should see
- The static relationship should appear; it does not itself prove a received reply.
- Why this step matters
- A fixed mapping can be configured without a flow, which differs from dynamic pool allocation.
Test the static mapping from the client
In GNS3, right-click PC1 and choose Console before typing. Use the VPCS prompt and the identical remote destination. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
ping 203.0.113.10What each command means
ping 203.0.113.10- Generate inside-to-outside traffic and look for replies after initial discovery.
- What you should see
- Replies should arrive through the static translated return path.
- Why this step matters
- Immediately inspect show ip nat translations in NAT1's Console at # and record actual roles; no sample output is fabricated.
Replace static mapping with a pool
In GNS3, right-click NAT1 and choose Console before typing. Start at # only after PC1's finite ping has returned to its VPCS prompt and no other node is generating traffic. Clear transient NAT state only on this exclusively owned, disconnected disposable NAT1. Check after clearing, then remove the exact static rule. Before the second configure terminal, require its absence from running-config and no remaining .100/.10 mapping. Stop on an in-use error or unexpected entry; do not answer a broad deletion prompt or continue installing the pool. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
clear ip nat translation *
show ip nat translations
configure terminal
no ip nat inside source static 10.40.0.10 198.18.0.100
end
show running-config | include ip nat inside source
show ip nat translations
configure terminal
access-list 10 permit host 10.40.0.10
ip nat pool TWO 198.18.0.101 198.18.0.102 netmask 255.255.255.0
ip nat inside source list 10 pool TWO
endWhat each command means
clear ip nat translation *- Clear transient translations only on this fully in-scope lab router; this disrupts active sessions and is not permission to clear a shared router.
show ip nat translations- Verify that transient ICMP child entries are gone. The configured static base relationship may remain at this point; stop if traffic recreates child entries.
configure terminal- Enter global configuration mode from privileged EXEC (#); accepted changes affect the running device.
no ip nat inside source static 10.40.0.10 198.18.0.100- Remove this exact static relationship after clearing its active children; stop if IOS reports it remains in use.
end- Return to privileged EXEC (#). This neither saves the configuration nor reverses accepted changes.
show running-config | include ip nat inside source- Require the old static .10-to-.100 rule to be absent before proceeding.
show ip nat translations- Require the removed mapping and its transient children to be absent. This is the mandatory checkpoint before installing a different policy.
configure terminal- Enter global configuration mode from privileged EXEC (#); accepted changes affect the running device.
access-list 10 permit host 10.40.0.10- Select only PC1 as eligible for dynamic translation; this is not an attached filter.
ip nat pool TWO 198.18.0.101 198.18.0.102 netmask 255.255.255.0- Define two routed global addresses in the /24 translation range.
ip nat inside source list 10 pool TWO- Use ACL 10 to allocate non-overloaded addresses from pool TWO only after the static-removal checkpoint passes.
end- Return to privileged EXEC (#). This neither saves the configuration nor reverses accepted changes.
- What you should see
- The old static policy and mapping must be absent before the pool and rule are installed. New PC1 traffic is still required to demonstrate dynamic allocation.
- Why this step matters
- Separate phases and explicit state checks prevent a lingering static translation from blocking removal or masking the new pool behavior.
Generate and read dynamic allocation
In GNS3, right-click PC1 and choose Console before typing. At the VPCS prompt, send the same traffic; then inspect NAT1 promptly as described. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
ping 203.0.113.10What each command means
ping 203.0.113.10- Cause the eligible inside host to request an on-demand pool mapping.
- What you should see
- Replies should arrive. In NAT1's Console at #, show ip nat translations and show ip nat statistics should identify .101 or .102, not an invented fixed choice.
- Why this step matters
- One client demonstrates allocation only; two-address exhaustion and multiuser behavior remain paper predictions.
Replace the pool rule with PAT
In GNS3, right-click NAT1 and choose Console before typing. Start at # with PC1's test stopped. Clear dynamic state only because this router is disposable and exclusively in scope. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
clear ip nat translation *
configure terminal
no ip nat inside source list 10 pool TWO
no ip nat pool TWO
ip nat inside source list 10 interface GigabitEthernet2 overload
endWhat each command means
clear ip nat translation *- Remove dynamic translation state for this isolated phase change; never run this indiscriminately on shared devices.
configure terminal- Enter global configuration mode from privileged EXEC (#); accepted changes affect the running device.
no ip nat inside source list 10 pool TWO- Remove the non-overloaded pool rule before installing overload.
no ip nat pool TWO- Delete the now-unused pool definition.
ip nat inside source list 10 interface GigabitEthernet2 overload- Translate eligible flows using the outside interface address with protocol-specific sharing.
end- Return to privileged EXEC (#). This neither saves the configuration nor reverses accepted changes.
- What you should see
- New flows use 198.51.100.1 under overload instead of the removed pool.
- Why this step matters
- Stopping traffic and clearing old state makes the new policy's effect observable.
Test and inspect PAT baseline
In GNS3, right-click PC1 and choose Console before typing. At the VPCS prompt, repeat the same destination; inspect NAT1 immediately afterward. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
ping 203.0.113.10What each command means
ping 203.0.113.10- Generate an ICMP flow through interface overload.
- What you should see
- Replies should arrive; NAT1's show ip nat translations should show the interface global address and ICMP-specific state while present.
- Why this step matters
- ICMP uses identifiers, not TCP ports; a one-client test does not measure simultaneous multiuser sharing.
Introduce the wrong selector
In GNS3, right-click NAT1 and choose Console before typing. Start at # after the test stops. Keep interfaces, routes and PAT rule unchanged. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
clear ip nat translation *
configure terminal
no access-list 10
access-list 10 permit host 10.40.0.99
endWhat each command means
clear ip nat translation *- Remove this isolated router's dynamic state so an old translation cannot hide the selector change.
configure terminal- Enter global configuration mode from privileged EXEC (#); accepted changes affect the running device.
no access-list 10- Remove only this lab's dedicated NAT selection list.
access-list 10 permit host 10.40.0.99- Deliberately select a nonexistent host instead of PC1's .10 address.
end- Return to privileged EXEC (#). This neither saves the configuration nor reverses accepted changes.
- What you should see
- PC1 no longer matches the translation selection.
- Why this step matters
- The experiment changes one policy decision; it does not install an interface deny rule.
Observe the failed translated exchange
In GNS3, right-click PC1 and choose Console before typing. At the VPCS prompt, compare local and remote tests without changing PC1. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
ping 10.40.0.1
ping 203.0.113.10What each command means
ping 10.40.0.1- Confirm the unchanged inside gateway still responds.
ping 203.0.113.10- Retry the same remote path while PC1 is not selected for translation.
- What you should see
- Gateway replies should persist; remote replies should fail because untranslated PC1 has no return route. Inspect NAT1 for the missing new translation.
- Why this step matters
- The result is not evidence of a NAT ACL firewall drop; combine selector, table and route observations.
Restore the selector and verify state
In GNS3, right-click NAT1 and choose Console before typing. Start at #. Restore the exact approved source rather than widening the match to any. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
configure terminal
no access-list 10
access-list 10 permit host 10.40.0.10
end
show access-lists 10
show ip nat statisticsWhat each command means
configure terminal- Enter global configuration mode from privileged EXEC (#); accepted changes affect the running device.
no access-list 10- Remove the deliberate wrong host selector.
access-list 10 permit host 10.40.0.10- Restore PC1's exact source selection.
end- Return to privileged EXEC (#). This neither saves the configuration nor reverses accepted changes.
show access-lists 10- Check the corrected host match in the dedicated selector.
show ip nat statistics- Confirm the intended NAT roles and overload policy remain configured.
- What you should see
- The approved source match is restored without changing routing or the outside address.
- Why this step matters
- A narrow repair preserves the reason the experiment is interpretable.
Repeat the client test and close
In PC1's Console, repeat ping 203.0.113.10. In NAT1's Console at #, immediately run show ip nat translations and show ip nat statistics. Retain the baseline, fault and restored observations, then stop all nodes.
- What you should see
- The same client flow should again receive replies and create the intended overload mapping.
- Why this step matters
- A completed repair needs both endpoint behavior and mapping evidence; neither result establishes DNS or application performance.
Verify
- Record the four address roles for static, pool and PAT phases; never invent selected ports or identifiers.
- Confirm the static rule is absent before the pool phase and the pool rule is absent before PAT.
- Match each observed entry to a PC1 test, not a router-originated ping.
- Compare the wrong-selector failure with the restored exact host match and repeat the same remote destination.
Troubleshoot
- No entry: verify PC1's source, inside/outside roles and NAT selector; a router-originated test may bypass the intended ingress path.
- Entry exists but no replies: inspect destination and return routes and outside host behavior before changing the translation rule.
- Dynamic rule reports in use: stop the disposable client's traffic and inspect state; never clear unrelated production translations to continue this exercise.
- Pool allocation absent: confirm the pool is referenced, the client matches and capacity is available. Static entries left from an earlier phase can mask the intended test.
GNS3 does not provide Cisco software images. Use Cisco images only when the applicable license or entitlement permits this environment. Do not share or redistribute image files. Cisco Modeling Labs is an official alternative; its supplied reference images are licensed for CML, not automatically for export to GNS3. Use the labeled paper alternative when authorized software is unavailable. No emulator execution is claimed by this lesson.
- Stop traffic and all three nodes after restoring the correct selector; preserve the observed table values privately.
- Revert the clean-project snapshots to remove every lab change. Do not export the configuration into a real edge router.
Practice set
Answer before you reveal
01What is PC1's inside-local address?
The client's configured address does not change merely because the router selects a different outside representation.
02Why do the outside columns match?
Both columns describe 203.0.113.10 from different viewpoints. Equal values are expected, not a broken table.
03Does ACL 10 deny nonmatching packets as a filter?
It selects translation candidates. A packet-filter role requires a separate attachment and policy; an unmatched NAT candidate may be forwarded untranslated.
04How does PAT distinguish ICMP echo flows?
ICMP does not contain TCP or UDP source ports. Read the actual protocol column before interpreting colon-separated output.
05Why clear translations only in this isolated lab?
The whole disposable router is in scope here. On a shared router the same command could affect many unrelated users and hide useful evidence.
06What does one-client pool testing not establish?
Two addresses exist in the configured pool, but one client cannot demonstrate all simultaneous allocation and failure behavior.
Knowledge check
Quiz: prove the reasoning
Keep these
Technical takeaways
- NAT roles describe viewpoint, not merely public versus private addressing.
- Static, pool and overload policies have different allocation behavior.
- A NAT selector is not automatically a packet filter.
- Translation tables and endpoint replies answer different questions.
- Routes and the reverse path remain necessary after translation.