ip nat inside source static [local-ip] [global-ip]
Configures static NAT to map a single inside local IP address to a single inside global IP address, allowing internal hosts to be reachable from external networks.
Definition: ip nat inside source static [local-ip] [global-ip] is a Cisco IOS global config command. Configures static NAT to map a single inside local IP address to a single inside global IP address, allowing internal hosts to be reachable from external networks.
Overview
The `ip nat inside source static` command is a fundamental tool in Cisco IOS for implementing static Network Address Translation (NAT). It creates a permanent, one-to-one mapping between a private (inside local) IP address and a public (inside global) IP address. This allows an internal host, such as a web server or mail server, to be reachable from external networks (e.g., the internet) using a globally routable IP address.
Static NAT is essential when external devices need to initiate connections to internal resources, as it provides a fixed translation that does not change over time. Unlike dynamic NAT or PAT (Port Address Translation), which map multiple internal addresses to a pool of public addresses or a single public address with different ports, static NAT ensures that the same public IP always corresponds to the same private IP. This is critical for services that require consistent addressing, such as SSL certificates or DNS records.
In a typical enterprise network, you would use static NAT to expose a company's web server, email server, or VPN concentrator to the internet while keeping the internal addressing scheme private. The command operates in global configuration mode and requires the user to have privilege level 15 (enable mode) to execute. When applied, the translation is immediately added to the running configuration and takes effect without requiring a reload.
However, it is important to note that static NAT entries are stored in the running configuration and can be saved to the startup configuration using `copy running-config startup-config`. The command interacts with the NAT table, which can be viewed with `show ip nat translations`. A common pitfall is forgetting to configure both the inside and outside interfaces with the `ip nat inside` and `ip nat outside` commands, respectively; without these, the static NAT rule will not be applied.
Additionally, static NAT does not perform port translation by default; if you need to map a specific external port to a different internal port, you must use the extended version of the command (`ip nat inside source static tcp/udp`). Understanding static NAT is foundational for CCNA and CCNP candidates, as it appears in many network design and troubleshooting scenarios. The command is supported across all Cisco IOS platforms, including routers and Layer 3 switches, and is a key component of network address translation strategies.
ip nat inside source static [local-ip] [global-ip]When to Use This Command
- Making a web server with a private IP address accessible from the internet using a public IP.
- Mapping a mail server's private IP to a public IP for inbound email delivery.
- Providing remote access to an internal device (e.g., VPN concentrator) via a static public IP.
- Hosting multiple services on different internal servers using separate public IPs.
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| local-ip | A.B.C.D | The inside local IP address of the host that needs to be translated. This is typically a private IP address from ranges like 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16. Ensure this IP is assigned to an internal host and is reachable within the inside network. A common mistake is using an IP that is not actually configured on any device or is already used elsewhere. |
| global-ip | A.B.C.D | The inside global IP address that the local IP will be mapped to. This must be a globally unique, routable public IP address (or a private IP if used in a lab). This address should not be used by any other device on the outside network. A common mistake is using an IP that conflicts with another NAT rule or is not routable from the outside. |
Command Examples
Basic static NAT for a web server
ip nat inside source static 192.168.1.10 203.0.113.10This command creates a one-to-one mapping: any packet from inside host 192.168.1.10 going outside will have its source IP translated to 203.0.113.10, and any packet from outside destined to 203.0.113.10 will be translated to 192.168.1.10.
Verifying static NAT with show ip nat translations
show ip nat translationsPro Inside global Inside local Outside local Outside global --- --------------- --------------- ----------------- ----------------- --- 203.0.113.10 192.168.1.10 --- ---
The output shows the static NAT entry. 'Inside global' is the public IP, 'Inside local' is the private IP. The 'Outside local' and 'Outside global' fields are empty because this is a static entry without dynamic outside mapping.
Understanding the Output
The 'show ip nat translations' command displays all active NAT translations. For static NAT, you will see a permanent entry with the inside local and inside global addresses. The 'Outside local' and 'Outside global' columns are typically empty for static NAT unless you have additional dynamic translations.
A healthy static NAT entry should always be present; if it disappears, the configuration may have been removed or the router rebooted without saving. Watch for overlapping translations or incorrect IP addresses.
Configuration Scenarios
Expose an internal web server to the internet
A company hosts a web server at 192.168.1.10 internally and wants it accessible from the internet via a public IP 203.0.113.10. Static NAT ensures that any traffic destined to 203.0.113.10 is translated to the internal server.
Topology
Internet---(Gi0/1)Router(Gi0/0)---192.168.1.0/24---WebServer(192.168.1.10)Steps
- 1.Step 1: Enter global configuration mode: Router> enable, Router# configure terminal
- 2.Step 2: Configure the inside interface (Gi0/0) with ip nat inside: Router(config)# interface GigabitEthernet0/0, Router(config-if)# ip nat inside, Router(config-if)# exit
- 3.Step 3: Configure the outside interface (Gi0/1) with ip nat outside: Router(config)# interface GigabitEthernet0/1, Router(config-if)# ip nat outside, Router(config-if)# exit
- 4.Step 4: Create the static NAT mapping: Router(config)# ip nat inside source static 192.168.1.10 203.0.113.10
- 5.Step 5: Verify the configuration: Router(config)# do show ip nat translations
! Full IOS config block interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.0 ip nat inside ! interface GigabitEthernet0/1 ip address 203.0.113.1 255.255.255.0 ip nat outside ! ip nat inside source static 192.168.1.10 203.0.113.10
Verify: Use 'show ip nat translations' to see the static entry: Pro Inside global Inside local Outside local Outside global --- 203.0.113.10 192.168.1.10 --- ---
Watch out: Forgetting to apply 'ip nat inside' and 'ip nat outside' on the respective interfaces is the most common mistake. Without these, the static NAT rule will not be applied and traffic will not be translated.
Map a public IP to an internal mail server with port translation
An organization has a mail server at 10.0.0.5 and wants to use the same public IP 198.51.100.20 for both web and mail services. Since static NAT maps entire IPs, they need to use static PAT to map specific ports (e.g., TCP 25 for SMTP) to the mail server while the web server uses a different public IP or port.
Topology
Internet---(Gi0/1)Router(Gi0/0)---10.0.0.0/24---MailServer(10.0.0.5)Steps
- 1.Step 1: Enter global configuration mode: Router> enable, Router# configure terminal
- 2.Step 2: Configure inside and outside interfaces as in the previous scenario.
- 3.Step 3: Create a static PAT rule for SMTP: Router(config)# ip nat inside source static tcp 10.0.0.5 25 198.51.100.20 25
- 4.Step 4: Optionally, add additional port mappings (e.g., for IMAP): Router(config)# ip nat inside source static tcp 10.0.0.5 143 198.51.100.20 143
- 5.Step 5: Verify the translations: Router(config)# do show ip nat translations
! Full IOS config block interface GigabitEthernet0/0 ip address 10.0.0.1 255.255.255.0 ip nat inside ! interface GigabitEthernet0/1 ip address 198.51.100.1 255.255.255.0 ip nat outside ! ip nat inside source static tcp 10.0.0.5 25 198.51.100.20 25 ip nat inside source static tcp 10.0.0.5 143 198.51.100.20 143
Verify: Use 'show ip nat translations' to see the entries: Pro Inside global Inside local Outside local Outside global tcp 198.51.100.20:25 10.0.0.5:25 --- --- tcp 198.51.100.20:143 10.0.0.5:143 --- ---
Watch out: When using static PAT, ensure that the public IP and port combination is unique. If another static NAT or PAT rule uses the same public IP and port, the configuration will be rejected or cause conflicts.
Troubleshooting with This Command
When troubleshooting static NAT, the primary command is `show ip nat translations`. A healthy static NAT entry will show a permanent mapping with no outside local/global addresses (indicated by '---'). If the entry is missing, check that the static NAT command is present in the running configuration and that the inside and outside interfaces are correctly configured with `ip nat inside` and `ip nat outside`.
Use `show running-config | include ip nat` to verify. If the entry exists but traffic is not being translated, examine the NAT statistics with `show ip nat statistics`. Look for the 'Hits' counter; if it is zero, traffic is not hitting the NAT rule.
This could indicate that the routing is incorrect or that the interface ACLs are blocking traffic. Use `debug ip nat` (with caution in production) to see real-time translations. For example, `debug ip nat detailed` will show each packet being translated.
Focus on the source and destination IPs before and after translation. If the translation occurs but return traffic fails, verify that the router has a route back to the inside network for the translated source IP. Also, ensure that the outside interface has a route to the public IP (if it is not directly connected).
Another common issue is overlapping NAT rules; use `show ip nat translations verbose` to see all details. If you see 'dynamic' entries alongside static ones, ensure they are not conflicting. For static PAT, verify that the protocol (tcp/udp) is specified correctly; omitting it defaults to IP-level translation.
Correlate with `show access-lists` to ensure no ACL is denying the traffic. Finally, check the NAT timeout values with `show ip nat translations | include timeout`; static entries should not time out, but if they do, it may indicate a bug or misconfiguration. In summary, a systematic approach: verify configuration, check translations, inspect statistics, enable debugs, and validate routing.
CCNA Exam Tips
Static NAT requires both 'ip nat inside' on the internal interface and 'ip nat outside' on the external interface to function.
The command does not produce output; use 'show ip nat translations' to verify.
CCNA may test that static NAT entries are permanent and do not time out.
Remember: 'inside source' translates source addresses of packets coming from inside to outside.
Common Mistakes
Forgetting to apply 'ip nat inside' and 'ip nat outside' on the appropriate interfaces.
Using the same global IP for multiple local IPs (static NAT is one-to-one).
Typing the IP addresses in the wrong order (local vs global).
ip nat inside source static [local-ip] [global-ip] vs ip nat inside source list [acl] interface [intf] overload
Both commands configure inside-to-outside Network Address Translation (NAT) on Cisco IOS, but they serve different purposes: static NAT provides a fixed one-to-one mapping for bidirectional access, while dynamic NAT with overload (PAT) allows multiple internal hosts to share a single public IP address. They are often compared because both translate internal IPs to external ones, yet their use cases and behavior differ significantly.
| Aspect | ip nat inside source static [local-ip] [global-ip] | ip nat inside source list [acl] interface [intf] overload |
|---|---|---|
| Translation type | Static one-to-one | Dynamic many-to-one (PAT) |
| Address assignment | Fixed mapping | Dynamically uses interface IP |
| Scalability | Limited to number of public IPs | High--many hosts share one IP |
| Session initiation | Inbound and outbound | Typically outbound only (requires static PAT for inbound) |
| Configuration dependency | None (IP addresses only) | Requires access list and interface |
Use ip nat inside source static [local-ip] [global-ip] when an internal server must be reachable from the internet via a consistent public IP address.
Use ip nat inside source list [acl] interface [intf] overload when multiple internal hosts need internet access using a single public IP address, typically on a perimeter router.
Platform Notes
In IOS-XE (e.g., on Catalyst 9000 switches), the syntax is identical to classic IOS. However, the output of `show ip nat translations` may include additional fields like 'id' or 'refcount'. On NX-OS (e.g., Nexus switches), the equivalent command is `ip nat inside source static [local-ip] [global-ip]` but the configuration mode is different: you must first enter `configure terminal`, then `ip nat` sub-mode?
Actually, NX-OS uses `ip nat` commands under interface configuration, and static NAT is configured with `ip nat inside source static` in global config, similar to IOS. However, NX-OS requires the `feature nat` command to be enabled first. On ASA firewalls, static NAT is configured using `nat (inside,outside) static [local-ip] [global-ip]` or `object network` approach.
The ASA does not use the `ip nat inside source static` command. In IOS-XR, static NAT is configured using `nat static` under the interface configuration or via VRF context, and the syntax differs significantly. For example, `nat static inside source static 192.168.1.10 203.0.113.10` is used.
IOS versions 12.x and 15.x behave similarly, but 16.x (IOS-XE) may have minor differences in output formatting. Always verify with the specific platform documentation.
Related Commands
ip nat inside source list [acl] interface [intf] overload
Configures dynamic NAT overload (PAT) to translate multiple inside private IP addresses to a single public IP address using the interface's IP, based on an access list.
show ip nat translations
Displays the current active Network Address Translation (NAT) translations on the router, used to verify NAT operations and troubleshoot connectivity issues.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions