Courseiva
NATInterface Config

ip nat inside

Designates an interface as the inside (private) interface for NAT translation, enabling the router to translate source IP addresses of packets leaving this interface.

Definition: ip nat inside is a Cisco IOS interface config command. Designates an interface as the inside (private) interface for NAT translation, enabling the router to translate source IP addresses of packets leaving this interface.

Overview

The `ip nat inside` command is a fundamental configuration directive in Cisco IOS that designates a router interface as the 'inside' (private) interface for Network Address Translation (NAT). This command is essential for enabling NAT to translate source IP addresses of packets leaving the inside network toward the outside (public) network. Without this designation, the router cannot distinguish which interfaces connect to the private network versus the public network, making NAT translation impossible.

The concept behind NAT is to conserve public IPv4 addresses by allowing multiple private IP addresses (as defined in RFC 1918, e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) to share a single or few public IP addresses. The `ip nat inside` command is used in conjunction with `ip nat outside` on the external interface and a NAT rule (e.g., `ip nat inside source list ACL interface GigabitEthernet0/1 overload`) to define the translation policy. Network engineers reach for this command when configuring NAT for internet access from a private LAN, for port forwarding, or for overlapping network scenarios.

It fits into the broader configuration workflow: first, define the inside and outside interfaces; second, create an access list to identify which traffic to translate; third, apply the NAT rule. Important IOS behaviors: the command is applied in interface configuration mode, requires privileged EXEC access (enable mode), and takes effect immediately upon entry, though translation rules must also be configured. The running configuration stores the command under the respective interface.

Misconfiguration (e.g., applying `ip nat inside` on the wrong interface) can cause traffic to be translated incorrectly or not at all. This command is a cornerstone of NAT configuration and is critical for CCNA and CCNP candidates to master, as it appears in many real-world network designs, from small office/home office (SOHO) setups to large enterprise edge routers.

Syntax·Interface Config
ip nat inside

When to Use This Command

  • Configure a home or small office router to translate private IP addresses (e.g., 192.168.1.0/24) to a public IP when accessing the internet.
  • Set up NAT on a corporate edge router where internal servers use private addresses and need to communicate with external networks.
  • Enable NAT overload (PAT) on a Cisco router to allow multiple internal devices to share a single public IP address.
  • Configure static NAT for a web server on the inside network to be reachable from the outside.

Command Examples

Basic Inside Interface Configuration for Dynamic NAT

Router(config-if)# ip nat inside
Router(config-if)#

No output is displayed upon successful configuration. The command simply marks the interface as the inside NAT interface. Use 'do show ip nat translations' to verify later.

Verifying Inside Interface Status

Router# show ip nat statistics
Total active translations: 0 (0 static, 0 dynamic; 0 extended)
Outside interfaces:
  GigabitEthernet0/1
Inside interfaces:
  GigabitEthernet0/0
Hits: 0  Misses: 0
CEF Translated packets: 0, CEF Punted packets: 0
Expired translations: 0
Dynamic mappings:
-- Inside Source
[Id: 1] access-list 1 pool MYPOOL refcount 0
 pool MYPOOL: netmask 255.255.255.240
    start 203.0.113.1 end 203.0.113.14
    type generic, total addresses 14, allocated 0 (0%), misses 0

The 'Inside interfaces' line confirms that GigabitEthernet0/0 is configured as inside. 'Outside interfaces' shows the outside interface. 'Total active translations' indicates current NAT entries. 'Hits' and 'Misses' show translation success/failure. The dynamic mapping section details the ACL and pool used.

Understanding the Output

The 'ip nat inside' command itself produces no output. To verify, use 'show ip nat statistics' or 'show ip nat translations'. In 'show ip nat statistics', the 'Inside interfaces' field lists all interfaces configured with 'ip nat inside'.

The 'Outside interfaces' field lists those with 'ip nat outside'. 'Total active translations' shows the number of current NAT entries; a high number may indicate many active sessions. 'Hits' count successful translations, 'Misses' count packets that failed to translate (e.g., no ACL match or pool exhausted).

The dynamic mappings section shows the NAT pool and access list; 'allocated 0 (0%)' means no translations are currently using the pool. Watch for 'misses' increasing, which indicates traffic that cannot be translated, often due to missing ACL entries or exhausted pool addresses.

Configuration Scenarios

Configure Dynamic NAT with Overload (PAT) for Internal Users to Access the Internet

A small office has a private LAN (192.168.1.0/24) and a single public IP address (203.0.113.1) on the WAN interface. The goal is to allow all internal hosts to share the public IP for internet access using Port Address Translation (PAT).

Topology

PC1(192.168.1.10)---(Gi0/0)R1(Gi0/1)---Internet R1 Gi0/0: 192.168.1.1/24 R1 Gi0/1: 203.0.113.1/30

Steps

  1. 1.Step 1: Enter global configuration mode: configure terminal
  2. 2.Step 2: Define an access list to match private source addresses: access-list 1 permit 192.168.1.0 0.0.0.255
  3. 3.Step 3: Enter interface configuration for the inside interface (Gi0/0): interface GigabitEthernet0/0
  4. 4.Step 4: Designate the interface as NAT inside: ip nat inside
  5. 5.Step 5: Exit to global config: exit
  6. 6.Step 6: Enter interface configuration for the outside interface (Gi0/1): interface GigabitEthernet0/1
  7. 7.Step 7: Designate the interface as NAT outside: ip nat outside
  8. 8.Step 8: Exit to global config: exit
  9. 9.Step 9: Configure dynamic NAT with overload: ip nat inside source list 1 interface GigabitEthernet0/1 overload
Configuration
!
interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/1
 ip address 203.0.113.1 255.255.255.252
 ip nat outside
!
access-list 1 permit 192.168.1.0 0.0.0.255
!
ip nat inside source list 1 interface GigabitEthernet0/1 overload
!

Verify: Use 'show ip nat translations' to see active translations. Expected output shows inside local (192.168.1.x) mapped to inside global (203.0.113.1) with different ports. Use 'show ip nat statistics' to see total translations and hits.

Watch out: Forgetting to apply 'ip nat inside' on the correct interface will result in no translation. Also, ensure the access list permits all desired source networks; a common mistake is using a wildcard mask incorrectly (e.g., 0.0.0.255 for /24).

Configure Static NAT for a Public Server Behind a Private IP

A company hosts a web server at 192.168.1.100 on the internal LAN. They want to make it accessible from the internet via a public IP (203.0.113.10). Static NAT provides a one-to-one mapping.

Topology

Internet---(Gi0/1)R1(Gi0/0)---Server(192.168.1.100) R1 Gi0/0: 192.168.1.1/24 R1 Gi0/1: 203.0.113.2/30

Steps

  1. 1.Step 1: Enter global configuration mode: configure terminal
  2. 2.Step 2: Enter interface configuration for the inside interface (Gi0/0): interface GigabitEthernet0/0
  3. 3.Step 3: Designate the interface as NAT inside: ip nat inside
  4. 4.Step 4: Exit to global config: exit
  5. 5.Step 5: Enter interface configuration for the outside interface (Gi0/1): interface GigabitEthernet0/1
  6. 6.Step 6: Designate the interface as NAT outside: ip nat outside
  7. 7.Step 7: Exit to global config: exit
  8. 8.Step 8: Configure static NAT: ip nat inside source static 192.168.1.100 203.0.113.10
Configuration
!
interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/1
 ip address 203.0.113.2 255.255.255.252
 ip nat outside
!
ip nat inside source static 192.168.1.100 203.0.113.10
!

Verify: Use 'show ip nat translations' to see the static mapping: inside local 192.168.1.100, inside global 203.0.113.10. Test connectivity from outside by pinging or accessing the public IP.

Watch out: Ensure the public IP (203.0.113.10) is not used elsewhere and is routable to the router. Also, if the server needs to initiate outbound connections, static NAT does not automatically provide overload; you may need additional dynamic NAT rules.

Troubleshooting with This Command

When troubleshooting NAT issues, the `ip nat inside` command itself is not directly used for diagnostics, but verifying its presence on the correct interface is a critical first step. Use `show running-config | section interface` to confirm that `ip nat inside` appears under the intended inside interface. A common symptom of misconfiguration is that traffic from inside hosts fails to reach the internet, or that translations do not appear in `show ip nat translations`.

If `ip nat inside` is missing, the router will not consider packets from that interface for translation, even if NAT rules are correctly configured. Conversely, if `ip nat inside` is applied to the outside interface by mistake, the router may attempt to translate traffic in the wrong direction, causing asymmetric routing or no translation at all. The healthy output of `show ip nat translations` shows active entries with inside local and inside global addresses; if no entries appear for traffic that should be translated, check the interface designations first.

Use `debug ip nat` (with caution in production) to see real-time translation events; the debug output will indicate whether the router considers a packet as coming from an inside or outside interface. For example, a debug message like 'NAT: s=192.168.1.10->203.0.113.1, d=8.8.8.8 [0]' confirms that the source is being translated. If the debug shows 'NAT: no translation for s=192.168.1.10, d=8.8.8.8', it may indicate that the inside interface is not correctly designated or the access list is not matching.

Additionally, correlate with `show ip interface brief` to ensure interfaces are up/up, and with `show access-lists` to verify that the ACL is matching traffic. A step-by-step diagnostic flow: 1) Verify interface status and IP addressing. 2) Confirm `ip nat inside` and `ip nat outside` are on the correct interfaces. 3) Check NAT rule configuration (e.g., `ip nat inside source list ...`). 4) Use `show ip nat statistics` to see if translations are being attempted. 5) If still failing, enable `debug ip nat detailed` to inspect packet flow. Common symptoms: 'No translation' errors often point to ACL issues or missing interface designations; 'Translation failed' may indicate resource exhaustion (e.g., no available ports for PAT).

Remember that `ip nat inside` is a per-interface command, so it must be present on every interface that connects to the private network.

CCNA Exam Tips

1.

CCNA exam tip: Remember that 'ip nat inside' is configured on the interface facing the private network, while 'ip nat outside' is on the interface facing the public network.

2.

CCNA exam tip: You must also configure an ACL to define which traffic to translate and a NAT pool or overload statement; 'ip nat inside' alone does not enable translation.

3.

CCNA exam tip: The command is entered in interface configuration mode; verify with 'show ip nat statistics' or 'show running-config'.

4.

CCNA exam tip: For PAT (overload), you use 'ip nat inside source list ACL interface outside-interface overload' in global config, not on the interface.

Common Mistakes

Mistake 1: Applying 'ip nat inside' to the wrong interface (e.g., the outside interface), causing NAT to fail or translate incorrectly.

Mistake 2: Forgetting to also configure 'ip nat outside' on the external interface, resulting in no translation.

Mistake 3: Not defining an ACL or NAT pool, so even with 'ip nat inside', no translation occurs.

ip nat inside vs ip nat outside

Both ip nat inside and ip nat outside are interface-level commands used to define NAT boundaries, and they are commonly confused because both are required for NAT to function, yet their roles are opposite—one designates the private side, the other the public side.

Aspectip nat insideip nat outside
Role in NATMarks interface as internal (private) network sideMarks interface as external (public) network side
Impact on Source NATDefines where packets originate for source translationDefines exit interface for translated source packets
Impact on Destination NATDefines interface where destination translation is applied to incoming packetsDefines interface receiving packets before destination translation
Configuration RequirementRequired on inside interface for any NATRequired on outside interface for any NAT
Typical PlacementUsually on LAN-facing interfacesUsually on WAN-facing interfaces
Direction of InterestTraffic inbound from this interface is subject to inside-to-outside translationTraffic outbound to this interface is subject to inside-to-outside translation

Use ip nat inside when configuring an interface that connects to your private network, such as a LAN segment, to designate it as the source side for NAT translations.

Use ip nat outside when configuring an interface that connects to the public network, such as an Internet-facing WAN link, to designate it as the destination side for NAT translations.

Platform Notes

In Cisco IOS-XE (e.g., on Catalyst 9000 switches), the `ip nat inside` command syntax is identical to classic IOS. However, on some IOS-XE platforms, NAT is handled in hardware (Cisco Express Forwarding) and the command may have additional options like `ip nat inside source list ...` with VRF awareness. On NX-OS (Cisco Nexus switches), the equivalent command is `ip nat inside` under interface configuration mode, but NAT configuration differs significantly: NX-OS uses a zone-based approach with `ip nat` commands under a VRF context.

For example, to designate an interface as inside on NX-OS: `interface ethernet 1/1; ip nat inside`. However, NX-OS requires a NAT policy (e.g., `ip nat source list ACL interface ethernet 1/2 overload`) under the VRF. On Cisco ASA firewalls, the concept is different: inside interfaces are designated via security levels (e.g., `nameif inside` and `security-level 100`), and NAT is configured using object NAT or twice NAT commands (e.g., `nat (inside,outside) source dynamic ...`).

The ASA does not use `ip nat inside`; instead, the interface role is defined by the `nameif` command. In IOS-XR (e.g., on ASR 9000), NAT is configured using the `nat` command under interface configuration, but the syntax is `nat inside` (without the `ip` prefix). For example: `interface GigabitEthernet0/0/0/0; nat inside`.

IOS-XR also uses a service policy for NAT translation. Between IOS versions, the command has remained consistent from 12.x through 16.x, but newer versions (15.x and later) introduced VRF-aware NAT, where `ip nat inside` can be applied per VRF. Always check the specific platform documentation, as hardware acceleration may affect NAT behavior and troubleshooting commands.

Related Commands

ip nat inside source list [acl] interface [intf] overload

Configures dynamic NAT overload (PAT) to translate multiple inside private IP addresses to a single public IP address using the interface's IP, based on an access list.

ip nat outside

Marks an interface as the outside (public) side for NAT, enabling translation of source addresses for traffic leaving the inside network.

show ip nat statistics

Displays statistics about NAT translations, including active translations, hit counts, and configuration parameters, used to verify NAT operation and troubleshoot translation issues.

show ip nat translations

Displays the current active Network Address Translation (NAT) translations on the router, used to verify NAT operations and troubleshoot connectivity issues.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions