300-410 NAT and PAT — 30 Questions

Question 1

A network engineer is troubleshooting connectivity from a host inside a corporate network to a public web server. The host has IP 10.1.1.10/24, and the router's outside interface is 203.0.113.1/24. The engineer configured a dynamic NAT pool (203.0.113.10-203.0.113.20) and an access list permitting 10.1.1.0/24. However, traffic from the host fails. A 'show ip nat translations' reveals no translations. What is the most likely cause?

Accepted Answer

The access list used in the NAT configuration does not match the source IP of the host.. If the access list does not match the source IP of the traffic, NAT will not create translations. The engineer must verify that the ACL permits the correct source subnet.

Answer

The NAT pool is exhausted.

Answer

The 'ip nat inside' and 'ip nat outside' commands are misapplied on the interfaces.

Answer

The host's default gateway is not the router's inside interface.

Question 2

A network engineer is troubleshooting PAT (overload) on a Cisco router. The inside network uses 192.168.1.0/24, and the outside interface has IP 198.51.100.1. The engineer configured 'ip nat inside source list 1 interface GigabitEthernet0/0 overload'. Traffic from inside hosts works initially, but after a few minutes, new connections fail. 'Show ip nat translations' shows many entries with the same outside global IP but different ports. 'Show ip nat statistics' indicates that the number of translations is near 500. What is the most likely cause?

Accepted Answer

The router has run out of available port numbers for PAT.. PAT uses port numbers to multiplex many inside hosts to a single outside IP. Each TCP/UDP session consumes a port; when the port range is exhausted, new translations cannot be created.

Answer

The NAT pool is not configured with overload.

Answer

The outside interface is flapping, causing translations to be cleared.

Answer

The access list is denying some inside hosts.

Question 3

An engineer configures static NAT on a router to map a public IP 203.0.113.5 to an internal server 10.0.0.5. The configuration includes 'ip nat inside source static 10.0.0.5 203.0.113.5'. The server is reachable from the outside, but the server cannot initiate connections to the outside network. 'Show ip nat translations' shows the static entry. What is the most likely cause?

Accepted Answer

Static NAT does not translate the source IP for outbound traffic initiated by the inside host.. Static NAT only translates the specified inside local to inside global. For the server to reach outside, the router must also translate the source of the server's traffic (which is 10.0.0.5) to a routable IP; without a matching NAT rule for outbound traffic, the server's source remains private.

Answer

The server's default gateway is not the router's inside interface.

Answer

The 'ip nat outside' command is missing on the outside interface.

Answer

The router's routing table does not have a route back to the server's subnet.

Question 4

A network engineer is troubleshooting NAT for a VoIP phone that uses SIP. The phone is at 192.168.2.10, and the router performs PAT to the outside interface 198.51.100.1. The phone can register with the SIP server, but calls fail after 30 seconds. The engineer notices that the SIP signaling includes the phone's private IP in the SDP body. What is the most likely cause?

Accepted Answer

The router's SIP ALG is disabled, so the private IP in the SDP is not translated.. SIP embeds IP addresses in the payload; PAT only translates the IP header, not the application layer. The SIP server sends media to the private IP, which is unreachable. The fix is to use SIP ALG or fixup to translate the embedded addresses.

Answer

The PAT port range is exhausted.

Answer

The phone's default gateway is misconfigured.

Answer

The outside interface has a firewall blocking UDP ports.

Question 5

An engineer configures NAT on a router with 'ip nat inside source list 1 interface GigabitEthernet0/0 overload'. The inside hosts are 10.0.0.0/24, and the outside interface is 203.0.113.1. Traffic works for most hosts, but one host at 10.0.0.50 cannot access the internet. 'Show ip nat translations' shows no entry for this host. 'Show access-lists' shows ACL 1 permits 10.0.0.0 0.0.0.255. What is the most likely cause?

Accepted Answer

The host has a misconfigured subnet mask or default gateway.. If the ACL and NAT configuration are correct, the issue might be that the host's traffic is not reaching the router's inside interface, or the router is not processing the traffic due to a routing or interface issue. However, since other hosts work, the problem is specific to that host.

Answer

The host's IP address is statically assigned and conflicts with another device.

Answer

The NAT pool is exhausted.

Answer

The router's inside interface is administratively down.

Question 6

A network engineer is troubleshooting NAT for a VPN tunnel. The router has a static NAT rule 'ip nat inside source static 10.0.0.10 203.0.113.10' for a server. The VPN traffic from the remote site to 203.0.113.10 is being NATed to 10.0.0.10, but the return traffic from the server to the remote site is not being translated back. The engineer sees that the server sends packets with source 10.0.0.10 to the remote site's public IP. What should the engineer do to fix this?

Accepted Answer

Ensure that the router has a route to the remote site's public IP via the outside interface, and that the static NAT entry is correctly applied.. For NAT to work bidirectionally, the router must translate the source IP of the server's outbound traffic to the public IP. Static NAT should handle this automatically, but if the traffic is not matching the NAT rule, it might be due to routing or interface NAT direction.

Answer

Add an 'ip nat outside' command on the inside interface.

Answer

Configure a route-map to exempt the VPN traffic from NAT.

Answer

Change the static NAT to 'ip nat inside source static 10.0.0.10 203.0.113.10 extendable'.

Question 7

An engineer configures NAT overload on a router. The inside network uses 172.16.0.0/16, and the outside interface is 198.51.100.1. The engineer uses 'ip nat inside source list 1 interface GigabitEthernet0/0 overload'. ACL 1 permits 172.16.0.0 0.0.255.255. Traffic works, but the engineer notices that the router's CPU utilization is high, and 'show ip nat translations' shows thousands of entries. What is the most likely cause?

Accepted Answer

The NAT translation timeout is set too high, causing old entries to remain.. High CPU and many NAT entries could indicate a DoS attack or misconfiguration causing many short-lived sessions. However, a common issue is that the NAT timeout is too long, causing stale entries to accumulate.

Answer

The router is under a DDoS attack generating many NAT translations.

Answer

The ACL is too permissive, allowing traffic from outside to initiate NAT.

Answer

The outside interface is using a different IP than configured.

Question 8

A network engineer is troubleshooting NAT for a web server that is reachable from the internet via a static NAT mapping 203.0.113.20 to 10.0.0.20. The server responds to HTTP requests, but the engineer cannot SSH to the server from the internet. 'Show ip nat translations' shows the static entry. The router's ACL on the outside interface permits TCP port 22 to 203.0.113.20. What is the most likely cause?

Accepted Answer

The router's NAT is not translating the return traffic for SSH because the server sends packets with a different source IP.. Static NAT translates the destination IP, but if the server's response uses a different source IP (e.g., due to multiple interfaces or routing), the return traffic may not be translated back. However, a common issue is that the server's firewall or local ACL blocks SSH, or the router's NAT is not translating the return traffic correctly.

Answer

The server's default gateway is not the router's inside interface.

Answer

The SSH service is not running on the server.

Answer

The router's ACL is blocking SSH traffic despite the permit statement.

Question 9

An engineer configures NAT on a router with 'ip nat inside source list 1 pool POOL overload' where POOL contains 203.0.113.1-203.0.113.5. The inside hosts are 10.0.0.0/24. Traffic works, but the engineer notices that some hosts are assigned the same public IP and port, causing conflicts. 'Show ip nat translations' shows entries with the same inside global IP and port for different inside local hosts. What is the most likely cause?

Accepted Answer

The router has a configuration that uses 'ip nat inside source static' for some hosts, conflicting with the dynamic pool.. PAT with a pool should assign unique ports per session. If two different inside hosts use the same source port and are mapped to the same public IP, the router should still assign a different port. However, if the pool has only one IP or the ports are exhausted, conflicts can occur. The most likely cause is that the pool has only one IP and the port range is exhausted, but the symptom shows the same IP and port, which indicates a misconfiguration.

Answer

The pool has only one IP address, and the router is reusing ports for different hosts.

Answer

The 'ip nat inside source' command is missing the 'overload' keyword.

Answer

The router is not performing PAT correctly because the ACL permits more than the pool can handle.

Question 10

A network engineer runs the following command on Router R1:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
--- 192.0.2.10         10.0.0.10          ---                ---
--- 192.0.2.11         10.0.0.11          ---                ---
--- 192.0.2.12         10.0.0.12          ---                ---

R1# show ip nat statistics
Total active translations: 3 (0 static, 3 dynamic; 3 extended)
Outside interfaces: GigabitEthernet0/1
Inside interfaces: GigabitEthernet0/0
Hits: 45  Misses: 0
CEF Translated packets: 45, CEF Punted packets: 0
Expired translations: 0
Dynamic mappings:
-- Inside Source
[Id] ip nat pool POOL1 192.0.2.10 192.0.2.20 netmask 255.255.255.240
   refcount 3
   map-id 1
   overload
   [Id] ip nat inside source list ACL1 pool POOL1 overload
   refcount 3

Based on this output, which statement is correct?

Accepted Answer

PAT is working correctly; translations are dynamic and overload is enabled.. The output shows dynamic NAT with overload (PAT). The pool has 16 addresses (192.0.2.10–192.0.2.20), but only 3 translations are active. The '---' in the protocol column indicates no protocol-specific translation (e.g., TCP/UDP), which is normal for PAT when only one host per inside global is used. The correct answer is that PAT is working correctly.

Answer

NAT is failing because the pool is exhausted.

Answer

Static NAT is configured, but dynamic NAT is not working.

Answer

The inside and outside interfaces are reversed.

Question 11

A network engineer runs the following command on Router R1:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
udp 192.0.2.10:1234    10.0.0.10:1234     203.0.113.5:53    203.0.113.5:53
tcp 192.0.2.10:5678    10.0.0.10:5678     198.51.100.20:80  198.51.100.20:80
--- 192.0.2.11         10.0.0.11          ---                ---

R1# show ip nat statistics
Total active translations: 3 (0 static, 3 dynamic; 3 extended)
Outside interfaces: GigabitEthernet0/1
Inside interfaces: GigabitEthernet0/0
Hits: 100  Misses: 0
CEF Translated packets: 100, CEF Punted packets: 0
Expired translations: 0
Dynamic mappings:
-- Inside Source
[Id] ip nat pool POOL1 192.0.2.10 192.0.2.20 netmask 255.255.255.240
   refcount 3
   map-id 1
   overload
   [Id] ip nat inside source list ACL1 pool POOL1 overload
   refcount 3

Based on this output, what is the problem?

Accepted Answer

The third translation is not using PAT, indicating a possible ACL or route-map misconfiguration.. The output shows two PAT translations (UDP and TCP) for 10.0.0.10 using the same inside global address 192.0.2.10, plus a dynamic NAT translation for 10.0.0.11 without protocol/port. The problem is that the third translation (10.0.0.11) is not using PAT (no port), which could indicate a misconfiguration or that ACL1 does not match traffic from 10.0.0.11 properly, or that the pool is misapplied. However, the key clue is that the third entry lacks a protocol, meaning it is a basic NAT translation, not PAT, which is inconsistent with the overload configuration. This could be due to a route-map or ACL issue.

Answer

The pool is exhausted because 192.0.2.10 is used twice.

Answer

The outside interface is misconfigured as inside.

Answer

The NAT translations are all static.

Question 12

A network engineer runs the following command on Router R1:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
--- 192.0.2.10         10.0.0.10          203.0.113.5        203.0.113.5
--- 192.0.2.11         10.0.0.11          203.0.113.5        203.0.113.5

R1# show ip nat statistics
Total active translations: 2 (0 static, 2 dynamic; 0 extended)
Outside interfaces: GigabitEthernet0/1
Inside interfaces: GigabitEthernet0/0
Hits: 20  Misses: 0
CEF Translated packets: 20, CEF Punted packets: 0
Expired translations: 0
Dynamic mappings:
-- Inside Source
[Id] ip nat pool POOL1 192.0.2.10 192.0.2.20 netmask 255.255.255.240
   refcount 2
   map-id 1
   [Id] ip nat inside source list ACL1 pool POOL1
   refcount 2

Based on this output, which statement is correct?

Accepted Answer

NAT is configured without PAT; each inside host uses a unique global address.. The output shows dynamic NAT without overload (no 'overload' keyword in the mapping, and 0 extended translations). Each inside host gets a unique inside global address. This is basic NAT, not PAT. The correct answer is that NAT is working without PAT.

Answer

PAT is enabled, but only two translations are active.

Answer

The pool is exhausted because two addresses are used.

Answer

Static NAT is configured for both hosts.

Question 13

A network engineer runs the following command on Router R1:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
--- 192.0.2.10         10.0.0.10          ---                ---

R1# show ip nat statistics
Total active translations: 1 (1 static, 0 dynamic; 0 extended)
Outside interfaces: GigabitEthernet0/1
Inside interfaces: GigabitEthernet0/0
Hits: 5  Misses: 0
CEF Translated packets: 5, CEF Punted packets: 0
Expired translations: 0

Based on this output, which statement is correct?

Accepted Answer

Static NAT is configured for host 10.0.0.10 to 192.0.2.10.. The output shows a single static NAT translation. The statistics confirm 1 static translation and 0 dynamic. This is a simple static NAT mapping.

Answer

Dynamic NAT is configured with overload.

Answer

The NAT pool is exhausted.

Answer

PAT is translating multiple hosts to the same global address.

Question 14

A network engineer runs the following command on Router R1:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
tcp 192.0.2.10:80      10.0.0.10:80       203.0.113.5:12345 203.0.113.5:12345
tcp 192.0.2.10:80      10.0.0.11:80       203.0.113.5:67890 203.0.113.5:67890

R1# show ip nat statistics
Total active translations: 2 (0 static, 2 dynamic; 2 extended)
Outside interfaces: GigabitEthernet0/1
Inside interfaces: GigabitEthernet0/0
Hits: 50  Misses: 0
CEF Translated packets: 50, CEF Punted packets: 0
Expired translations: 0
Dynamic mappings:
-- Inside Source
[Id] ip nat inside source list ACL1 interface GigabitEthernet0/1 overload
   refcount 2

Based on this output, what is the problem?

Accepted Answer

PAT is not assigning unique source ports; both translations use port 80, which will cause conflicts.. The output shows two inside hosts (10.0.0.10 and 10.0.0.11) both using the same inside global address 192.0.2.10 (the interface address) and the same port 80. This is a problem because PAT should assign unique source ports for each translation. Both translations show the same inside global port (80), which is incorrect; PAT should use different ports. This indicates a misconfiguration or a bug, as PAT normally changes the source port to a unique value. The correct answer is that PAT is not assigning unique ports, which will cause conflicts.

Answer

The NAT pool is misconfigured because it uses the interface address.

Answer

The inside and outside interfaces are swapped.

Answer

Static NAT is interfering with dynamic NAT.

Question 15

A network engineer runs the following command on Router R1:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
--- 192.0.2.10         10.0.0.10          ---                ---
--- 192.0.2.11         10.0.0.11          ---                ---

R1# show ip nat statistics
Total active translations: 2 (0 static, 2 dynamic; 0 extended)
Outside interfaces: GigabitEthernet0/1
Inside interfaces: GigabitEthernet0/0
Hits: 0  Misses: 10
CEF Translated packets: 0, CEF Punted packets: 0
Expired translations: 0
Dynamic mappings:
-- Inside Source
[Id] ip nat pool POOL1 192.0.2.10 192.0.2.20 netmask 255.255.255.240
   refcount 2
   map-id 1
   [Id] ip nat inside source list ACL1 pool POOL1
   refcount 2

Based on this output, what is the problem?

Accepted Answer

NAT translations exist but no packets are being translated (0 hits), indicating a possible routing or ACL issue.. The output shows 2 dynamic translations but 0 hits and 10 misses. This indicates that NAT translations are being created (perhaps due to control plane traffic or initial packets), but no data packets are being translated successfully. The misses suggest that packets are arriving that do not match existing translations, and new translations are being created, but hits are zero, meaning no return traffic or successful data flow. This could be due to routing issues, ACL misconfiguration, or asymmetric routing.

Answer

The NAT pool is exhausted.

Answer

PAT is enabled but not working.

Answer

The inside and outside interfaces are reversed.

Question 16

A network engineer runs the following command on Router R1:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
--- 192.0.2.10         10.0.0.10          ---                ---
--- 192.0.2.11         10.0.0.11          ---                ---
--- 192.0.2.12         10.0.0.12          ---                ---
--- 192.0.2.13         10.0.0.13          ---                ---
--- 192.0.2.14         10.0.0.14          ---                ---
--- 192.0.2.15         10.0.0.15          ---                ---
--- 192.0.2.16         10.0.0.16          ---                ---
--- 192.0.2.17         10.0.0.17          ---                ---
--- 192.0.2.18         10.0.0.18          ---                ---
--- 192.0.2.19         10.0.0.19          ---                ---
--- 192.0.2.20         10.0.0.20          ---                ---

R1# show ip nat statistics
Total active translations: 11 (0 static, 11 dynamic; 0 extended)
Outside interfaces: GigabitEthernet0/1
Inside interfaces: GigabitEthernet0/0
Hits: 200  Misses: 0
CEF Translated packets: 200, CEF Punted packets: 0
Expired translations: 0
Dynamic mappings:
-- Inside Source
[Id] ip nat pool POOL1 192.0.2.10 192.0.2.20 netmask 255.255.255.240
   refcount 11
   map-id 1
   [Id] ip nat inside source list ACL1 pool POOL1
   refcount 11

Based on this output, what is the problem?

Accepted Answer

The NAT pool is exhausted; no addresses are available for new translations.. The output shows 11 dynamic translations using all 11 addresses in the pool (192.0.2.10–192.0.2.20 inclusive = 11 addresses). The pool is fully utilized. If a new inside host attempts to communicate, it will fail because no addresses are available. This is a problem because the pool is exhausted.

Answer

PAT is not configured, causing address exhaustion.

Answer

The inside and outside interfaces are misconfigured.

Answer

Static NAT is conflicting with dynamic NAT.

Question 17

A network engineer runs the following command on Router R1:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
--- 192.0.2.10         10.0.0.10          ---                ---

R1# show ip nat statistics
Total active translations: 1 (0 static, 1 dynamic; 0 extended)
Outside interfaces: GigabitEthernet0/1
Inside interfaces: GigabitEthernet0/0
Hits: 0  Misses: 0
CEF Translated packets: 0, CEF Punted packets: 0
Expired translations: 0
Dynamic mappings:
-- Inside Source
[Id] ip nat pool POOL1 192.0.2.10 192.0.2.20 netmask 255.255.255.240
   refcount 1
   map-id 1
   [Id] ip nat inside source list ACL1 pool POOL1
   refcount 1

Based on this output, what is the problem?

Accepted Answer

The NAT translation exists but no traffic is being translated (0 hits, 0 misses), indicating a possible idle translation or no matching traffic.. The output shows 1 dynamic translation but 0 hits and 0 misses. This indicates that a translation entry exists (perhaps from a previous session or manual creation), but no packets have been translated. The 0 hits and 0 misses suggest that no traffic is flowing through the NAT. This could be due to the translation being stale or no traffic matching the ACL.

Answer

The NAT pool is exhausted.

Answer

PAT is misconfigured.

Answer

The inside and outside interfaces are reversed.

Question 18

A network engineer runs the following command on Router R1:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
udp 192.0.2.10:10000   10.0.0.10:10000    203.0.113.5:53    203.0.113.5:53
udp 192.0.2.10:10001   10.0.0.11:10000    203.0.113.5:53    203.0.113.5:53
udp 192.0.2.10:10002   10.0.0.12:10000    203.0.113.5:53    203.0.113.5:53

R1# show ip nat statistics
Total active translations: 3 (0 static, 3 dynamic; 3 extended)
Outside interfaces: GigabitEthernet0/1
Inside interfaces: GigabitEthernet0/0
Hits: 150  Misses: 0
CEF Translated packets: 150, CEF Punted packets: 0
Expired translations: 0
Dynamic mappings:
-- Inside Source
[Id] ip nat inside source list ACL1 interface GigabitEthernet0/1 overload
   refcount 3

Based on this output, which statement is correct?

Accepted Answer

PAT is working correctly; multiple inside hosts share the same global address with unique ports.. The output shows three PAT translations using the interface address (192.0.2.10) with unique source ports (10000, 10001, 10002). This is correct PAT operation. The statistics show hits and no misses, indicating proper function.

Answer

The NAT pool is exhausted because all addresses are used.

Answer

Static NAT is configured for DNS traffic.

Answer

The inside and outside interfaces are swapped.

Question 19

Consider the following partial configuration on a Cisco IOS-XE router:

interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/1
 ip address 203.0.113.1 255.255.255.0
 ip nat outside
!
ip nat inside source list 1 interface GigabitEthernet0/1 overload
access-list 1 permit 192.168.1.0 0.0.0.255

What is the effect of this configuration?

Accepted Answer

All traffic from 192.168.1.0/24 is translated to 203.0.113.1 using PAT.. The configuration enables NAT overload (PAT) for the 192.168.1.0/24 network, translating all inside addresses to the IP of GigabitEthernet0/1 (203.0.113.1) with port multiplexing.

Answer

Only traffic from 192.168.1.1 is translated to 203.0.113.1 using PAT.

Answer

Traffic is translated using static NAT to 203.0.113.1.

Answer

The configuration is incomplete; a NAT pool is required for dynamic translation.

Question 20

Given this partial configuration:

ip nat pool MYPOOL 203.0.113.10 203.0.113.20 netmask 255.255.255.0
ip nat inside source list 1 pool MYPOOL
access-list 1 permit 192.168.1.0 0.0.0.255

What is the effect?

Accepted Answer

Inside hosts are dynamically mapped to a pool address; if the pool is exhausted, new translations fail.. This configures dynamic NAT without overload, so translations are one-to-one from inside addresses to the pool. If more inside hosts than pool addresses try to communicate, some will fail.

Answer

Inside hosts are translated to addresses in the pool using PAT.

Answer

The router uses the pool address as the source for all outbound traffic, regardless of ACL.

Answer

This configuration requires the 'ip nat outside' interface command to function.