Configure Static NAT in Cisco IOS Router

Network Address Translation or NAT is a mechanism of mapping local address on the inside interface of a router with global address on the outside interface. For outgoing packets, router will translate the source local address to a global address. Reversely, router will forward incoming packets for a global address to its local address. This is usually the scenario to enable hosts on LAN to communicate with the internet. In Cisco device, there are several methods to configure NAT. One of the methods will be explained in this article is to configure static NAT in Cisco IOS router.

How to Configure Static NAT in Cisco IOS Router

Static NAT is a manual mapping of local and global address as defined by the network administrator. The way to configure static NAT in Cisco IOS router consists of two steps that will be explained using example scenario with given topology as below:

Configure Static NAT in Cisco IOS Router

1. Define the inside and outside interface

Defining the inside and outside interface correctly is the key to make NAT mapping works. Simply go to the interface configuration mode and then use command ip nat inside to make the interface as an inside interface. In a similar way, use command ip nat outside to make the interface as an outside interface.

For the above scenario, the way to make f0/0 on R1 as the inside interface and f0/1 as the outside interface is shown below (assuming the IP address for each interface and default route to internet has been configured before)

R1(config)#interface f0/0
R1(config-if)#ip nat inside
R1(config-if)#exit
R1(config)#interface f0/1
R1(config-if)#ip nat outside
R1(config-if)#exit

2. Configure the static NAT mapping

The command to configure static NAT mapping is ip nat inside source static [local address] [global address]. The command can be repeated many times as required but note that in Cisco IOS router one local address can only be mapped to one global address and vice-versa. Additionally, note that the global address must be in range of the subnet on the outside interface. In real practice, the global address usually provided by the internet service provider.

For the above scenario, the command to map Server1 IP address to one of the available global IP address:

R1(config)#ip nat inside source static 10.2.2.3 172.26.10.91

Verifying the NAT sessions

To see if static NAT works as expected, try to do a ping from Server1 to address 8.8.8.8 on the internet. Before static NAT is applied, ping from Server1 to 8.8.8.8 will not work because R1 will forward the packet with source address of 10.2.2.3 and it is not known on the internet in this case.

Server> ping 8.8.8.8
8.8.8.8 icmp_seq=1 timeout

After NAT is applied, the source address of 10.2.2.3 is masked by 172.26.10.91 and it is an address that is known on the internet in this case. Therefore, ping from Server1 is success.

Server> ping 8.8.8.8
84 bytes from 8.8.8.8 icmp_seq=1 ttl=252 time=28.002 ms

Use command show ip nat translations on the router to see the NAT session. See this example output for the above scenario:

R1#sh ip nat trans
Pro Inside global Inside local Outside local Outside global
icmp 172.26.10.91:38398 10.2.2.3:38398 8.8.8.8:38398 8.8.8.8:38398
--- 172.26.10.91 10.2.2.3 --- ---

The output above shows the active sessions between local address and global address on the inside and outside interface complete with the protocol and port information. The inside global and outside global shows the IP address and ports as result of translation while the inside local and outside local shows the address and ports before the translation. From the output above we can see that static NAT mapping between local address of 10.2.2.3 and global address 172.26.10.91 on the inside interface has working successfully.

One cool thing about static NAT is that it also works for incoming packets. To confirm this, do ping from the internet to Server1 global address.

Internet>ping 172.26.10.91
84 bytes from 172.26.10.91 icmp_seq=1 ttl=252 time=28.004 ms

On R1, run command show ip nat translations again to see the session:

R1#sh ip nat trans
Pro Inside global Inside local Outside local Outside global
icmp 172.26.10.91:38910 10.2.2.3:38910 8.8.8.8:38910 8.8.8.8:38910
--- 172.26.10.91 10.2.2.3 --- ---

And that’s how you configure static NAT in Cisco IOS Router.

The following two tabs change content below.
Arranda Saputra

Arranda Saputra

ITIL Certified, CCNA, CCDA, VCP6-DCV, MCSA Administering Windows Server 2012
I am IT practitioner in real life with specialization in network and server infrastructure. I have years of experience in design, analysis, operation, and optimization of infrastructure solutions for enterprise-scaled network. You can send me a message on LinkedIn or email to arranda.saputra@outlook.com for further inquiry regarding stuffs that I wrote or opportunity to collaborate in a project.
scroll to top