In which configuration mode is ip nat inside source list [acl] pool [name] used?

The ip nat inside source list [acl] pool [name] command is entered in Global Config mode on Cisco IOS devices.

NATGlobal Config

ip nat inside source list [acl] pool [name]

Configures dynamic NAT by translating inside local IP addresses to inside global addresses from a pool, based on an access list.

Definition: ip nat inside source list [acl] pool [name] is a Cisco IOS global config command. Configures dynamic NAT by translating inside local IP addresses to inside global addresses from a pool, based on an access list.

Overview

The 'ip nat inside source list [acl] pool [name]' command is a cornerstone of dynamic Network Address Translation (NAT) configuration on Cisco IOS routers. It enables the translation of inside local IP addresses (typically private RFC 1918 addresses) to inside global addresses drawn from a predefined pool, based on a standard or extended access list. This command is essential for conserving public IP addresses in enterprise networks, allowing multiple internal hosts to share a smaller pool of public addresses when accessing external networks like the Internet.

The underlying concept is dynamic NAT: translations are created on demand when traffic from inside hosts matches the access list, and the router selects an available global address from the pool. The translation is temporary; it times out after a period of inactivity (default 24 hours for TCP, shorter for UDP). This command is typically used when you have a limited number of public IP addresses and need to provide Internet access to many internal users, but unlike Port Address Translation (PAT), it provides a one-to-one mapping during the session, which is useful for applications that require a unique public IP (e.g., some VPNs or VoIP).

Alternatives include 'ip nat inside source list [acl] interface [interface] overload' for PAT (overloading), which allows many internal hosts to share a single public IP using port multiplexing, or static NAT for fixed mappings. The choice depends on the number of available public IPs and application requirements. In the configuration workflow, this command is part of a broader NAT setup: you must first define the access list to identify which inside addresses are eligible, create the NAT pool with 'ip nat pool [name] [start-ip] [end-ip] netmask [mask]', then apply this command.

Additionally, you must designate inside and outside interfaces using 'ip nat inside' and 'ip nat outside' respectively. The command operates in global configuration mode and requires privilege level 15. It immediately affects the running configuration; the router begins translating matching traffic.

Important IOS behavior: the access list should permit only the source addresses to be translated; deny statements are ignored for NAT purposes. The pool must have enough addresses for concurrent translations; if exhausted, packets are dropped. The command does not generate buffered output; verification is done via 'show ip nat translations' and 'show ip nat statistics'.

Understanding this command is critical for CCNA and CCNP candidates as it appears in both configuration and troubleshooting scenarios.

Syntax·Global Config

ip nat inside source list [acl] pool [name]

When to Use This Command

Translating a group of private IP addresses (e.g., 192.168.1.0/24) to a public IP pool (e.g., 203.0.113.1-10) for internet access.
Allowing multiple internal hosts to share a limited number of public IPs by dynamically assigning addresses from a pool.
Enabling outbound internet connectivity for a branch office with a /28 public subnet.
Translating internal servers to specific public IPs for inbound access while using dynamic pool for other hosts.

Parameters

Parameter	Syntax	Required	Description
acl	access-list-number or access-list-name	Required	Specifies the standard or extended access list that defines which inside local IP addresses are eligible for translation. For standard ACL, use a number 1-99 or 1300-1999, or a named ACL. Common mistake: using an extended ACL with destination matching, which is unnecessary for source NAT; standard ACL is sufficient.
name	pool-name	Required	The name of the NAT pool defined with the 'ip nat pool' command. The pool defines the range of inside global addresses to be used for translation. Ensure the pool name matches exactly; a common mistake is a typo or case mismatch.

Command Examples

Basic dynamic NAT with pool

ip nat inside source list 1 pool MY_POOL

This command enables dynamic NAT: traffic matching ACL 1 will have its source IP translated to an address from the pool named MY_POOL.

Verification with show ip nat translations

show ip nat translations

Pro Inside global      Inside local       Outside local      Outside global
--- 203.0.113.2        192.168.1.10       198.51.100.1       198.51.100.1
--- 203.0.113.3        192.168.1.11       198.51.100.2       198.51.100.2

The output shows active translations: Inside local (private IP) is translated to Inside global (public IP from pool). Outside local/global are typically the same for outbound traffic. Each row represents a single translation entry.

Understanding the Output

The command itself does not produce output; it configures the router. To verify, use 'show ip nat translations'. The output shows active NAT entries.

Key columns: 'Inside global' is the translated public IP from the pool; 'Inside local' is the original private IP; 'Outside local' and 'Outside global' are typically identical for outbound traffic. A healthy translation shows a one-to-one mapping. If you see many translations with the same inside global IP, it may indicate PAT (overload) is also configured.

Watch for '---' in the protocol column indicating no protocol-specific entry. If translations are missing, check ACL and pool configuration.

Configuration Scenarios

Dynamic NAT for Branch Office Internet Access

A branch office has 50 internal hosts using private IPs (192.168.1.0/24) and a block of 10 public IPs (203.0.113.20-29). The goal is to allow internal hosts to access the Internet using dynamic NAT, translating each internal IP to a unique public IP from the pool.

Topology

R1(Gi0/0)---192.168.1.0/24---Internal Hosts
R1(Gi0/1)---203.0.113.18/30---ISP Router

Steps

1.Step 1: Enter global configuration mode: configure terminal
2.Step 2: Create a standard access list to match inside local addresses: access-list 1 permit 192.168.1.0 0.0.0.255
3.Step 3: Define the NAT pool with the public IP range: ip nat pool PUBLIC_POOL 203.0.113.20 203.0.113.29 netmask 255.255.255.240
4.Step 4: Configure dynamic NAT: ip nat inside source list 1 pool PUBLIC_POOL
5.Step 5: Designate the inside interface: interface GigabitEthernet0/0, then ip nat inside
6.Step 6: Designate the outside interface: interface GigabitEthernet0/1, then ip nat outside
7.Step 7: Exit and verify: end, show ip nat translations

Configuration

!
access-list 1 permit 192.168.1.0 0.0.0.255
!
ip nat pool PUBLIC_POOL 203.0.113.20 203.0.113.29 netmask 255.255.255.240
ip nat inside source list 1 pool PUBLIC_POOL
!
interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/1
 ip address 203.0.113.18 255.255.255.252
 ip nat outside
!

Verify: Use 'show ip nat translations' to see active translations. Expected output shows inside local IP (e.g., 192.168.1.10) mapped to an inside global IP (e.g., 203.0.113.20). Use 'show ip nat statistics' to see total translations, hits, misses, and pool usage.

Watch out: Ensure the pool has enough addresses for concurrent sessions. If all pool addresses are in use, new translations are denied and packets dropped. Monitor with 'show ip nat statistics' and consider using PAT (overload) if the pool is small.

Dynamic NAT with Extended ACL for Selective Translation

A company wants to translate only specific internal servers (e.g., 10.0.1.0/24) to a public pool, while other internal hosts use PAT. This requires an extended ACL to match source IP and optionally protocol/port.

Topology

R1(Gi0/0)---10.0.1.0/24---Servers
R1(Gi0/1)---198.51.100.1/30---Internet

Steps

1.Step 1: Create an extended ACL to match source IP: access-list 100 permit ip 10.0.1.0 0.0.0.255 any
2.Step 2: Define the NAT pool: ip nat pool SERVER_POOL 198.51.100.10 198.51.100.20 netmask 255.255.255.0
3.Step 3: Apply dynamic NAT: ip nat inside source list 100 pool SERVER_POOL
4.Step 4: Configure inside and outside interfaces as before.
5.Step 5: Verify translations.

Configuration

!
access-list 100 permit ip 10.0.1.0 0.0.0.255 any
!
ip nat pool SERVER_POOL 198.51.100.10 198.51.100.20 netmask 255.255.255.0
ip nat inside source list 100 pool SERVER_POOL
!
interface GigabitEthernet0/0
 ip address 10.0.1.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/1
 ip address 198.51.100.1 255.255.255.252
 ip nat outside
!

Verify: Use 'show ip nat translations' to confirm only traffic from 10.0.1.0/24 is translated. Use 'show access-lists 100' to see match counts.

Watch out: Extended ACLs can inadvertently block traffic if deny statements are present. For NAT, only permit statements matter; deny statements are ignored. However, the ACL is also used for routing decisions if applied elsewhere, so be careful.

Troubleshooting with This Command

When troubleshooting dynamic NAT with 'ip nat inside source list pool', the primary verification commands are 'show ip nat translations' and 'show ip nat statistics'. Healthy output from 'show ip nat translations' shows active translations with inside local, inside global, outside local, and outside global addresses. Each translation should have a valid inside global IP from the pool.

Problem indicators include: no translations at all (suggesting ACL not matching, pool exhausted, or interfaces not correctly designated), translations with '---' for outside global (indicating incomplete translation, often due to routing issues), or translations that time out quickly (check NAT timeouts). The 'show ip nat statistics' command provides aggregate data: total translations, hits (packets translated), misses (packets that could not be translated), and pool usage. A high miss count indicates packets are being dropped because no translation is available, often due to pool exhaustion or ACL mismatch.

The 'expired translations' counter shows how many translations have timed out. To diagnose, follow this step-by-step flow: 1) Verify inside and outside interface configuration with 'show ip nat statistics' — the interfaces should be listed under 'Inside interfaces' and 'Outside interfaces'. If not, check 'ip nat inside/outside' on the interfaces. 2) Check the ACL with 'show access-lists [acl]' to see if packets are matching.

The match count should increment when traffic flows. If not, the ACL may be incorrect (e.g., wrong network, wildcard mask, or extended ACL with wrong protocol). 3) Verify the pool definition with 'show ip nat pool [name]' to ensure the address range and netmask are correct. 4) Use 'debug ip nat' (with caution in production) to see real-time translation events. Look for 'NAT: translation failed' messages indicating pool exhaustion or ACL deny. 5) Check for routing issues: the inside global IPs must be routable to the outside network.

Use 'ping' from the router's outside interface to test reachability. Correlate with 'show ip route' to ensure the router knows how to reach the destination. Common symptoms: hosts can't access the Internet, but internal communication works.

This often points to NAT misconfiguration. Also, remember that dynamic NAT translations are unidirectional by default; return traffic is handled automatically. If return traffic fails, check for ACLs on the outside interface blocking inbound packets.

The 'show ip nat translations verbose' command provides additional details like timeouts and use counts. For persistent issues, consider using PAT (overload) if the pool is too small, or static NAT for critical servers.

CCNA Exam Tips

Remember that the ACL defines which inside local addresses are eligible for translation; the pool defines the inside global addresses.

The pool must have enough addresses for simultaneous translations; otherwise, packets are dropped.

CCNA often tests the difference between dynamic NAT (this command) and PAT (ip nat inside source list 1 pool MY_POOL overload).

You must also configure 'ip nat inside' on the inside interface and 'ip nat outside' on the outside interface.

Common Mistakes

Forgetting to apply 'ip nat inside' and 'ip nat outside' on the correct interfaces, causing no translation to occur.

Creating an ACL that is too permissive (e.g., permit any) or too restrictive, leading to unintended translation or no translation.

Using a pool that is too small for the number of simultaneous translations, causing packet drops.

ip nat inside source list [acl] pool [name] vs ip nat inside source static [local-ip] [global-ip]

Both commands configure inside source NAT but differ fundamentally in mapping type. 'ip nat inside source list pool' creates dynamic many-to-many mappings, while 'ip nat inside source static' creates a permanent one-to-one mapping. They are often confused because both use the same 'ip nat inside source' syntax and appear in similar configurations.

Aspect	ip nat inside source list [acl] pool [name]	ip nat inside source static [local-ip] [global-ip]
Scope	Many-to-many (ACL matched to pool)	One-to-one (single IP pair)
Address Assignment	Dynamic from pool	Fixed manual mapping
Configuration	Requires ACL and pool definition	Simple single command
Persistence	Translations time out when idle	Permanent translation
Precedence	Lower than static, overridden by static entries	Highest precedence
Typical Use	Internal hosts accessing internet	Making internal server reachable from outside

Use ip nat inside source list [acl] pool [name] when multiple internal hosts need to share a smaller pool of public addresses for outbound access.

Use ip nat inside source static [local-ip] [global-ip] when you need a fixed public address for an internal server that must be reachable from external networks.

Platform Notes

In IOS-XE (e.g., Catalyst 9000 switches), the command syntax is identical to classic IOS. However, output formats may differ slightly; for example, 'show ip nat translations' may display in a more structured format. On NX-OS (Nexus switches), the equivalent command is 'ip nat inside source list [acl] pool [name]' but note that NX-OS uses a different configuration model: NAT is configured under 'ip nat' submode.

For example: 'configure terminal', 'ip nat', then 'inside source list 1 pool POOL'. Also, NX-OS requires the 'ip nat' feature to be enabled with 'feature nat'. On ASA firewalls, dynamic NAT is configured differently using 'nat (inside,outside) dynamic [acl] pool [name]' in global configuration mode.

The ASA does not use the 'ip nat inside source list' command. For IOS-XR, the command is not directly available; NAT configuration is done via VRF or using the 'nat' configuration mode with different syntax. In older IOS versions (12.x), the command behaves the same, but the maximum number of translations may be lower.

In 15.x and 16.x, there are enhancements like NAT64 and NAT46 support, but the basic dynamic NAT command remains unchanged. Always check the specific platform documentation for any syntax variations or feature limitations.

Related Commands

ip nat inside source static [local-ip] [global-ip]

Configures static NAT to map a single inside local IP address to a single inside global IP address, allowing internal hosts to be reachable from external networks.

show ip nat statistics

Displays statistics about NAT translations, including active translations, hit counts, and configuration parameters, used to verify NAT operation and troubleshoot translation issues.

show ip nat translations

Displays the current active Network Address Translation (NAT) translations on the router, used to verify NAT operations and troubleshoot connectivity issues.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions