debug ip nat
Use debug ip nat to monitor and troubleshoot NAT translations in real time on a Cisco router, displaying each packet's translation details as they occur.
Definition: debug ip nat is a Cisco IOS privileged exec command. Use debug ip nat to monitor and troubleshoot NAT translations in real time on a Cisco router, displaying each packet's translation details as they occur.
Overview
The `debug ip nat` command is a powerful real-time troubleshooting tool used on Cisco IOS routers to monitor Network Address Translation (NAT) operations. It displays detailed information about each packet as it undergoes translation, including the source and destination IP addresses before and after translation, the NAT translation type (static, dynamic, PAT), and any errors. This command is essential for diagnosing NAT-related issues such as failed translations, incorrect address pools, or misconfigured access lists.
Unlike static `show` commands that provide a snapshot of the NAT table, `debug ip nat` offers a dynamic view of packet flow, allowing engineers to observe translations as they happen. It is particularly useful when troubleshooting connectivity problems in scenarios where internal private IP addresses are translated to public addresses for internet access, or when multiple internal hosts share a single public IP via Port Address Translation (PAT). The command outputs are verbose and can generate significant console traffic, so it should be used selectively in production environments.
It requires privileged EXEC mode (enable) and does not affect the running configuration. The output is buffered by default, meaning it may be delayed if the router is busy; using `terminal monitor` can help display debug output on remote sessions. Alternatives include `show ip nat translations` for a static view, `show ip nat statistics` for counters, and `debug ip nat detailed` for even more granular information.
This command fits into the broader troubleshooting workflow after verifying basic connectivity and NAT configuration, often used in conjunction with `ping` and `traceroute` to correlate packet flow. Understanding its output is critical for CCNA and CCNP candidates to master NAT troubleshooting.
debug ip natWhen to Use This Command
- Verify that internal hosts are correctly translating to public IP addresses when accessing the internet.
- Troubleshoot why certain traffic is not being translated or is being dropped by NAT.
- Monitor NAT pool exhaustion or overload (PAT) behavior during peak usage.
- Identify misconfigured access-lists or route-maps that affect NAT translations.
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| access-list-number | <1-99> or <1300-1999> | Standard IP access list number to filter debug output for packets matching the ACL. Only packets permitted by the ACL will be displayed. Common mistake: using an extended ACL number instead of standard; only standard ACLs are supported. |
| host-ip-address | A.B.C.D | Specific IP address to monitor NAT translations for. Only packets with this IP address as source or destination will be displayed. Useful for isolating traffic to a single host. Common mistake: forgetting to specify the address and getting flooded with all NAT traffic. |
| detailed | detailed | Provides more verbose output including packet details like TCP/UDP ports, ICMP type/code, and translation creation/deletion events. Use when basic debug does not give enough information. Common mistake: using this on a busy router can overwhelm the console. |
Command Examples
Basic NAT translation debug
debug ip natNAT: s=192.168.1.10->10.0.0.10, d=8.8.8.8 [12345] NAT: s=8.8.8.8, d=10.0.0.10->192.168.1.10 [54321]
First line: Outbound packet from inside host 192.168.1.10 is translated to 10.0.0.10 (inside global) destined to 8.8.8.8. Second line: Return packet from 8.8.8.8 to 10.0.0.10 is translated back to 192.168.1.10. The numbers in brackets are IP identification fields.
Debug with verbose output
debug ip nat verboseNAT: i: icmp (192.168.1.10, 1) -> (10.0.0.10, 1) [12345] NAT: o: icmp (8.8.8.8, 1) -> (192.168.1.10, 1) [54321]
The 'i:' indicates an inside-to-outside translation, 'o:' indicates outside-to-inside. Protocol (icmp), source IP and port/ICMP ID, translated IP and port/ID are shown. Useful for seeing protocol details.
Understanding the Output
The debug ip nat output shows each packet as it is translated. The format is: NAT: s=source_address->translated_source, d=destination_address->translated_destination [IP_ID]. For inside-to-outside, the source is translated; for outside-to-inside, the destination is translated.
The IP identification number helps correlate packets. In verbose mode, you see direction (i: inside, o: outside), protocol, and port/ICMP ID. A healthy NAT shows consistent translations; missing translations or 'NAT: *' errors indicate problems like ACL misconfiguration or pool exhaustion.
Watch for 'NAT: translation failed' messages which mean no translation entry could be created.
Configuration Scenarios
Monitor Dynamic NAT for Internal Users Accessing the Internet
A company uses dynamic NAT to translate internal private IP addresses (192.168.1.0/24) to a public IP pool (203.0.113.10-203.0.113.20) for internet access. Users report intermittent connectivity issues. Use debug ip nat to verify translations are occurring correctly.
Topology
R1(Gi0/0)---192.168.1.0/24---(Gi0/0) R1 (Gi0/1)---203.0.113.0/29---InternetSteps
- 1.Step 1: Enter privileged EXEC mode: enable
- 2.Step 2: Enable debugging for NAT translations from the internal subnet: debug ip nat 1 (where ACL 1 permits 192.168.1.0 0.0.0.255)
- 3.Step 3: From a host on the internal network, initiate traffic to an external destination (e.g., ping 8.8.8.8)
- 4.Step 4: Observe the debug output to see the translation: source inside 192.168.1.10 -> 203.0.113.10, destination outside 8.8.8.8 -> 8.8.8.8
- 5.Step 5: Disable debugging when done: undebug all
! Configure ACL to match internal traffic access-list 1 permit 192.168.1.0 0.0.0.255 ! ! Enable dynamic NAT with a pool ip nat pool MYPOOL 203.0.113.10 203.0.113.20 netmask 255.255.255.248 ip nat inside source list 1 pool MYPOOL ! ! Apply NAT to interfaces interface GigabitEthernet0/0 ip nat inside ! interface GigabitEthernet0/1 ip nat outside
Verify: Use 'show ip nat translations' to see active translations. Expected output includes entries like 'Pro Inside global Inside local Outside local Outside global' with IP addresses.
Watch out: Ensure the ACL permits only the desired traffic; otherwise, debug output may be overwhelming or miss important translations. Also, verify that the NAT pool has enough addresses for concurrent translations.
Troubleshoot PAT (Overload) Translation Failures
A small office uses PAT (NAT overload) to allow multiple internal hosts to share a single public IP address (203.0.113.5). Users cannot access certain external websites. Use debug ip nat detailed to check if PAT is correctly assigning unique ports.
Topology
R1(Gi0/0)---10.0.0.0/24---(Gi0/0) R1 (Gi0/1)---203.0.113.4/30---InternetSteps
- 1.Step 1: Enter privileged EXEC mode: enable
- 2.Step 2: Enable detailed debugging: debug ip nat detailed
- 3.Step 3: From an internal host, attempt to access the problematic website (e.g., curl http://example.com)
- 4.Step 4: Look for lines like 'NAT: creating port mapping' and check if the translation includes a unique port number. If you see 'NAT: translation failed (no resources)', it indicates port exhaustion.
- 5.Step 5: Disable debugging: undebug all
! Configure PAT with overload ip nat inside source list 1 interface GigabitEthernet0/1 overload ! access-list 1 permit 10.0.0.0 0.0.0.255 ! interface GigabitEthernet0/0 ip nat inside ! interface GigabitEthernet0/1 ip nat outside
Verify: Use 'show ip nat statistics' to check total translations and hits. Expected output shows 'Total translations: 10', 'Outside interfaces: GigabitEthernet0/1', etc. Also use 'show ip nat translations verbose' to see port mappings.
Watch out: PAT relies on unique source ports; if many hosts use the same source port (e.g., all using port 80 for HTTP), the router may run out of available ports. Ensure the router has enough port range (default 1024-65535) and consider increasing it with 'ip nat translation port-range'.
Troubleshooting with This Command
When using `debug ip nat` for troubleshooting, healthy output shows clear translation entries for each packet, such as 'NAT: s=192.168.1.10->203.0.113.10, d=8.8.8.8->8.8.8.8' for dynamic NAT, or 'NAT: s=10.0.0.5->203.0.113.5, d=8.8.8.8->8.8.8.8 [0]' for PAT (with port mapping). Problem indicators include 'NAT: translation failed (no resources)' indicating port or address exhaustion, 'NAT: no translation' meaning the packet did not match any NAT rule, or 'NAT: invalid mapping' suggesting a misconfiguration. Focus on the source and destination IP addresses before and after the arrow; if the translation does not occur, check the ACL and NAT pool.
For PAT, ensure the port number is appended (e.g., [12345]). Common symptoms this command helps diagnose include: hosts unable to reach the internet (no translation), asymmetric routing (translations happening on wrong interface), or partial connectivity (some ports work, others fail due to port exhaustion). A step-by-step diagnostic flow: 1) Verify NAT configuration with `show running-config | include nat`. 2) Use `debug ip nat` with an ACL to filter traffic from a specific host. 3) Initiate traffic from that host. 4) Observe if a translation entry appears.
If not, check if the ACL permits the traffic and if the NAT rule is correctly applied to the inside/outside interfaces. 5) If translation appears but connectivity fails, check the return path; use `debug ip packet` to see if packets are being dropped. Correlate with `show ip nat statistics` to see hit counts and `show ip nat translations` for current mappings. Also, use `show logging` to capture debug output if the console is overwhelmed.
Remember that debug output is CPU-intensive; always disable debugging with `undebug all` after troubleshooting.
CCNA Exam Tips
Remember that debug ip nat is a privileged EXEC command and can generate high CPU load; always use with caution and disable with 'undebug all'.
The exam may ask you to identify the direction of translation (inside-to-outside vs outside-to-inside) based on the output format.
Know that verbose mode shows protocol and port information, which is useful for PAT troubleshooting.
Be aware that debug output does not show static NAT translations unless traffic is actively being translated.
Common Mistakes
Leaving debug enabled after troubleshooting, causing router performance degradation or crash.
Confusing the source and destination fields: 's=' is always the original source before translation, 'd=' is the original destination.
Using debug ip nat without first verifying NAT configuration (show ip nat translations) leading to no output and wasted time.
debug ip nat vs show ip nat translations
Both 'debug ip nat' and 'show ip nat translations' are used to troubleshoot NAT on Cisco routers, but they serve different purposes: 'debug ip nat' provides real-time packet-level translation details, while 'show ip nat translations' displays the current static/dynamic translations. They are commonly confused because both deal with NAT state, but one is a live trace and the other is a snapshot.
| Aspect | debug ip nat | show ip nat translations |
|---|---|---|
| Scope | Real-time per-packet translation events | Current translation table (static/dynamic) |
| Output | Continuous line-by-line output as packets are translated | Single table of all active translations |
| Impact | High CPU usage; can disrupt production | Minimal impact; safe for production |
| Persistence | Temporary; disabled on reload or manually | Persistent; reflects current state |
| Typical Use | Troubleshooting specific translation failures | Verifying configured translations are present |
Use debug ip nat when you need to see each packet being translated in real time to diagnose transient translation issues.
Use show ip nat translations when you need a static view of all currently active translations to verify NAT operations or check for stale entries.
Platform Notes
In IOS-XE (e.g., Catalyst 9000 switches), the `debug ip nat` command syntax and output are largely identical to classic IOS, but the output may include additional fields like VRF information if NAT is used in a VRF context. The command is available in privileged EXEC mode. In NX-OS (Cisco Nexus switches), the equivalent command is `debug ip nat` as well, but note that NX-OS uses a different NAT implementation; for example, NAT is often configured in a VRF context and the debug output may show VRF details.
The exact syntax is `debug ip nat [acl <acl-id>] [ip <ip-address>] [detailed]`. On Cisco ASA firewalls, the equivalent is `debug nat` (for ASA 8.3+), which provides similar real-time translation information. The ASA command syntax is `debug nat <id> [level]` where level can be 1 (basic) to 255 (verbose).
In IOS-XR (Cisco ASR 9000, CRS), the command `debug ip nat` is not directly available; instead, use `show nat statistics` and `show nat translations` for monitoring, and `debug nat` for real-time debugging (though it is less commonly used). IOS versions: In 12.x, the output is simpler; in 15.x and 16.x, the output includes more details like TCP state and timers. The command is consistent across IOS versions, but the `detailed` keyword was introduced in later 12.x versions.
Always check the specific platform documentation for any nuances.
Related Commands
clear ip nat translation *
Clears all dynamic NAT translations from the translation table, forcing the router to rebuild translations for new traffic.
show ip nat statistics
Displays statistics about NAT translations, including active translations, hit counts, and configuration parameters, used to verify NAT operation and troubleshoot translation issues.
show ip nat translations
Displays the current active Network Address Translation (NAT) translations on the router, used to verify NAT operations and troubleshoot connectivity issues.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions