In which configuration mode is clear ip nat translation * used?

The clear ip nat translation * command is entered in Privileged EXEC mode on Cisco IOS devices.

NATPrivileged EXEC

clear ip nat translation *

Clears all dynamic NAT translations from the translation table, forcing the router to rebuild translations for new traffic.

Definition: clear ip nat translation * is a Cisco IOS privileged exec command. Clears all dynamic NAT translations from the translation table, forcing the router to rebuild translations for new traffic.

Overview

The `clear ip nat translation *` command is a powerful troubleshooting tool used in Cisco IOS to remove all dynamic Network Address Translation (NAT) entries from the translation table. NAT is a fundamental technology that allows private IP addresses (e.g., 192.168.x.x, 10.x.x.x) to be translated to public IP addresses for internet access, conserving global address space and enhancing security. Over time, a router builds a dynamic NAT table to map internal addresses to external ones.

However, stale or incorrect translations can cause connectivity issues, such as inability to reach external hosts, asymmetric routing, or resource exhaustion. This command clears all dynamic entries, forcing the router to rebuild translations for new traffic. It is typically used during troubleshooting when a NAT-related problem is suspected, such as after a configuration change, a firewall rule update, or when users report intermittent connectivity.

Unlike `clear ip nat translation *` which wipes all dynamic entries, the `clear ip nat translation` command with specific parameters (e.g., inside/outside IP) allows granular removal. The command does not affect static NAT entries, which must be removed manually. It runs in privileged EXEC mode (enable), and its output is immediate—no confirmation prompt is given, so caution is advised.

The command does not modify the running configuration; it only clears runtime entries. After execution, the translation table is empty, and new traffic will trigger fresh translations. This command is essential for CCNA and CCNP candidates to understand, as NAT troubleshooting is a common exam topic and real-world task.

It fits into a broader workflow: first, verify NAT translations with `show ip nat translations`, then clear them if anomalies are found, and finally test connectivity. Important IOS behavior: the command may cause a brief interruption for active sessions, as translations are removed mid-flow. Also, the router may generate syslog messages indicating the clearance.

Privilege level 15 is required. In summary, this command is a quick reset button for dynamic NAT, invaluable for restoring proper translation behavior.

Syntax·Privileged EXEC

clear ip nat translation *

When to Use This Command

After changing NAT configuration (e.g., ACL, pool, or overload rules) to apply changes immediately without reloading.
When troubleshooting connectivity issues caused by stale or incorrect NAT entries.
Before testing new NAT policies to ensure a clean state for verification.
When a NAT pool is exhausted and you need to free up entries for new sessions.

Command Examples

Clear all dynamic NAT translations

clear ip nat translation *

Router#
Router#

No output is displayed upon successful execution. The command silently clears all dynamic translations. Use 'show ip nat translations' to verify that the table is empty.

Verify cleared translations

show ip nat translations

Pro Inside global      Inside local       Outside local      Outside global
--- ---                 ---                ---                ---

Router#

After clearing, the translation table shows only headers with no entries, confirming all dynamic translations have been removed.

Understanding the Output

The 'clear ip nat translation *' command produces no output on success. To verify, use 'show ip nat translations'. The output of that command has columns: Pro (protocol, e.g., tcp, udp, icmp), Inside global (public IP:port), Inside local (private IP:port), Outside local (destination IP:port as seen from inside), Outside global (destination IP:port as seen from outside).

An empty table (no entries) confirms all dynamic translations are cleared. Static NAT entries are not affected. If translations remain, they may be static or the clear command was not executed in privileged EXEC mode.

Configuration Scenarios

Clearing All Dynamic NAT Translations After a Configuration Change

A network administrator has modified the NAT pool or access-list on a border router. Existing translations may be using old parameters, causing connectivity failures. Clearing all dynamic translations forces the router to use the new configuration.

Topology

R1(Gi0/0)---192.168.1.0/24---(Gi0/0)R2(Gi0/1)---203.0.113.0/30---Internet

Steps

1.Step 1: Access the router via console or SSH and enter privileged EXEC mode: Router> enable
2.Step 2: Verify current NAT translations to understand the existing mappings: Router# show ip nat translations
3.Step 3: Clear all dynamic NAT translations: Router# clear ip nat translation *
4.Step 4: Verify that the translation table is now empty: Router# show ip nat translations
5.Step 5: Generate new traffic from an inside host (e.g., ping 8.8.8.8) and confirm new translations appear: Router# show ip nat translations

Configuration

! No configuration change is made by this command; it only clears runtime entries.
! Example of a typical NAT configuration that might have been changed:
ip nat pool MYPOOL 203.0.113.1 203.0.113.10 netmask 255.255.255.240
access-list 100 permit ip 192.168.1.0 0.0.0.255 any
ip nat inside source list 100 pool MYPOOL overload
interface GigabitEthernet0/0
 ip nat inside
interface GigabitEthernet0/1
 ip nat outside

Verify: Use `show ip nat translations` to confirm the table is empty after the clear. Then after traffic, expect output like: Pro Inside global Inside local Outside local Outside global --- 203.0.113.2 192.168.1.10 --- --- udp 203.0.113.2:12345 192.168.1.10:12345 8.8.8.8:53 8.8.8.8:53

Watch out: Clearing translations will drop all active NAT sessions, causing disruption for users. Always schedule maintenance windows or ensure minimal impact.

Troubleshooting NAT Table Exhaustion

A router with a small NAT pool is experiencing high traffic, causing the translation table to fill up. New connections fail because no translations are available. Clearing the table frees entries, but the root cause (pool size) must be addressed.

Topology

R1(Gi0/0)---10.0.0.0/8---(Gi0/0)R2(Gi0/1)---198.51.100.0/29---Internet

Steps

1.Step 1: Enter privileged EXEC mode: Router> enable
2.Step 2: Check the number of translations and pool usage: Router# show ip nat statistics
3.Step 3: Clear all dynamic translations to free entries: Router# clear ip nat translation *
4.Step 4: Verify the translation count is zero: Router# show ip nat statistics
5.Step 5: Monitor the table as new traffic arrives to see if it fills up quickly: Router# show ip nat translations | count

Configuration

! No configuration change; this is a temporary fix.
! Example NAT configuration with a small pool:
ip nat pool SMALLPOOL 198.51.100.1 198.51.100.6 netmask 255.255.255.248
access-list 10 permit 10.0.0.0 0.255.255.255
ip nat inside source list 10 pool SMALLPOOL overload
interface GigabitEthernet0/0
 ip nat inside
interface GigabitEthernet0/1
 ip nat outside

Verify: After clearing, `show ip nat statistics` should show 0 active translations. If the table fills quickly, the pool is too small. Example output: Total active translations: 0 (0 static, 0 dynamic; 0 extended) Peak translations: 512

Watch out: This is a temporary fix; the real solution is to increase the NAT pool size or implement NAT overload with a larger address space. Repeated clearing indicates a design issue.

Troubleshooting with This Command

The `clear ip nat translation *` command is primarily used for troubleshooting NAT-related connectivity issues. A healthy NAT table shows active translations with correct inside/outside mappings. Problem indicators include: stale entries that don't match current traffic, high translation counts near the limit, or entries with unusual port numbers.

Common symptoms that prompt its use include: users unable to access the internet, asymmetric routing where return traffic is dropped, or timeouts on long-lived connections. When diagnosing, a network engineer should first run `show ip nat translations` to inspect the table. Look for entries that appear orphaned (e.g., inside local IPs that are no longer active) or entries with mismatched outside global addresses.

If the table is full, `show ip nat statistics` will show a high number of active translations and possibly a 'pool exhausted' message. The step-by-step diagnostic flow: 1) Verify connectivity from an inside host to an outside host (e.g., ping). 2) If ping fails, check NAT translations with `show ip nat translations`. 3) If no translation exists for the inside host, check NAT configuration (access-list, pool, interfaces). 4) If translations exist but connectivity fails, clear all dynamic translations with `clear ip nat translation *` and retest. 5) After clearing, generate new traffic and immediately check `show ip nat translations` to see if a new translation is created. If it is, the problem was likely stale entries.

If not, the issue is configuration or routing. Correlate with `debug ip nat` (with caution) to see translation events in real time. Also, use `show ip nat statistics` to monitor translation counts and pool usage.

In scenarios with overload (PAT), clearing translations may free up port numbers. Remember that static NAT entries are unaffected. After clearing, active sessions will break, so this should be done during maintenance windows.

In summary, this command is a quick way to reset the dynamic NAT state, but it should be used as part of a systematic troubleshooting approach, not as a first resort.

CCNA Exam Tips

Remember that 'clear ip nat translation *' only clears dynamic entries; static NAT entries remain untouched.

The command requires privileged EXEC mode (enable) — a common exam trick is to test if you know the mode.

On the CCNA exam, you may be asked to clear translations after modifying an ACL used by NAT; this command applies the change immediately.

Be aware that clearing translations can disrupt active sessions; the exam may test your understanding of when it is appropriate.

Common Mistakes

Using the command in user EXEC mode (>) instead of privileged EXEC mode (#), resulting in '% Invalid input detected'.

Confusing 'clear ip nat translation *' with 'clear ip nat translation inside/outside' which clears specific entries.

Forgetting that clearing translations does not affect the NAT configuration itself; only the active translation table is cleared.

clear ip nat translation * vs show ip nat translations

Both commands are used in NAT troubleshooting, but one clears dynamic translations while the other displays all active ones. They are often considered together because clearing translations requires verifying the state before and after.

Aspect	clear ip nat translation *	show ip nat translations
Scope	All dynamic NAT translations	All active translations (dynamic & static)
Effect	Destructive: removes entries	Non-destructive: displays only
Persistence	Translations removed immediately	Entries persist until timeout or cleared
Precedence	Only affects dynamic translations	Shows both static and dynamic
Configuration Mode	Privileged EXEC	Privileged EXEC
Typical Use	After changing NAT config or clearing stale entries	Verifying NAT operation or troubleshooting

Use clear ip nat translation * when you need to force re-establishment of dynamic translations after configuration changes or to clear hung entries.

Use show ip nat translations when you need to inspect current translations for troubleshooting connectivity issues.

Platform Notes

In IOS-XE (e.g., Catalyst 9000 switches, ISR 4000 series), the `clear ip nat translation *` command syntax and behavior are identical to classic IOS. However, output formatting in `show ip nat translations` may differ slightly (e.g., column alignment). In NX-OS (Cisco Nexus switches), NAT is not typically supported in the same way; instead, NX-OS uses VRF-aware NAT or ACL-based NAT.

The equivalent command in NX-OS is `clear ip nat translations *` if NAT is configured, but note that NX-OS NAT is often used in data center contexts and may require different configuration. For ASA firewalls, the equivalent command is `clear xlate` which clears all dynamic translations (xlate entries). The ASA uses a different NAT architecture (twice NAT, network object NAT).

In IOS-XR (Cisco ASR 9000, CRS), NAT is not natively supported; instead, it uses CGN (Carrier Grade NAT) with different commands like `clear nat translations`. For IOS versions: In 12.x, the command exists and works as described. In 15.x and 16.x, the command remains unchanged.

However, newer IOS versions may introduce additional options like `clear ip nat translation * force` (though not standard). Always check the specific IOS documentation. In summary, while the command is consistent across IOS-based platforms, engineers should be aware of platform-specific NAT implementations and equivalent commands on non-IOS devices.

Related Commands

show ip nat statistics

Displays statistics about NAT translations, including active translations, hit counts, and configuration parameters, used to verify NAT operation and troubleshoot translation issues.

show ip nat translations

Displays the current active Network Address Translation (NAT) translations on the router, used to verify NAT operations and troubleshoot connectivity issues.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions