ip nat outside
Marks an interface as the outside (public) side for NAT, enabling translation of source addresses for traffic leaving the inside network.
Definition: ip nat outside is a Cisco IOS interface config command. Marks an interface as the outside (public) side for NAT, enabling translation of source addresses for traffic leaving the inside network.
Overview
The `ip nat outside` command is a fundamental configuration directive in Cisco IOS that designates a router interface as the 'outside' (public) side of a Network Address Translation (NAT) boundary. This command is essential for enabling NAT to translate source addresses of IP packets as they traverse from the inside (private) network to the outside (public) network, typically the internet. Without this designation, the router cannot determine which interface connects to the external network, and NAT translation will not occur.
The command is used in conjunction with `ip nat inside` on the internal interface and an access list or route map to define which traffic should be translated. It is a critical component of both static NAT (one-to-one mapping) and dynamic NAT (pool-based) configurations, as well as Port Address Translation (PAT), also known as NAT overload. Network engineers reach for this command when designing internet connectivity for private networks, consolidating multiple internal addresses to a single public IP, or when migrating from one ISP to another.
It fits into the broader workflow of configuring NAT: first, define the inside and outside interfaces; second, create an access list to identify interesting traffic; third, configure the NAT translation (static, dynamic, or overload); and finally, verify with `show ip nat translations`. Important IOS behaviors include that the command is applied in interface configuration mode, requires privilege level 15 (enable mode), and the configuration is saved in the running-config. The command does not produce immediate output; it simply marks the interface.
Misconfiguration, such as applying `ip nat outside` on the wrong interface, can cause traffic to be incorrectly translated or not translated at all, leading to connectivity issues. Understanding this command is foundational for CCNA and CCNP candidates as NAT is a core topic in both certifications.
ip nat outsideWhen to Use This Command
- Configure the WAN interface of a router to translate private IPs to a public IP for internet access.
- Set up NAT on a DMZ interface to translate public-to-private addresses for inbound traffic.
- Define the outside interface for dynamic NAT with a pool of public addresses.
- Use with ip nat inside on the LAN interface to enable standard NAT overload (PAT).
Command Examples
Basic Outside Interface Configuration
interface GigabitEthernet0/0
ip address 203.0.113.1 255.255.255.0
ip nat outsideRouter(config)#interface GigabitEthernet0/0 Router(config-if)#ip address 203.0.113.1 255.255.255.0 Router(config-if)#ip nat outside Router(config-if)#
The command ip nat outside is entered under interface configuration mode. No output is generated; the router simply accepts the command. Use show ip nat translations to verify NAT operations.
Verifying Outside Interface Status
show ip nat statisticsTotal active translations: 5 (0 static, 5 dynamic; 5 extended) Outside interfaces: GigabitEthernet0/0 Inside interfaces: GigabitEthernet0/1 Hits: 12345 Misses: 0 CEF Translated packets: 12345, CEF Punted packets: 0 Expired translations: 0 Dynamic mappings: -- Inside Source [Id] ip nat pool POOL1 203.0.113.2 203.0.113.10 netmask 255.255.255.0 refcount 5
The 'Outside interfaces' field lists interfaces configured with ip nat outside. 'Inside interfaces' shows the inside interfaces. 'Total active translations' indicates current NAT mappings. 'Hits' are successful translations; 'Misses' should be 0 for proper operation.
Understanding the Output
The command itself produces no output. To verify, use show ip nat statistics. The 'Outside interfaces' line lists all interfaces where ip nat outside is configured.
Ensure the correct WAN interface appears. 'Inside interfaces' should show your LAN interface. 'Total active translations' indicates how many sessions are currently translated.
High 'Misses' may indicate misconfiguration or lack of inside-to-outside traffic. 'Hits' should be non-zero if traffic is flowing.
Configuration Scenarios
Configure Dynamic NAT with Overload (PAT) for Internal Users to Access the Internet
A small office has a private IP range 192.168.1.0/24 and a single public IP address 203.0.113.1 assigned by the ISP. The goal is to allow all internal users to share the public IP for internet access using PAT.
Topology
R1(Gi0/0)---192.168.1.0/24---PCs
R1(Gi0/1)---203.0.113.0/30---ISPSteps
- 1.Step 1: Enter global configuration mode: configure terminal
- 2.Step 2: Define the inside interface: interface GigabitEthernet0/0, then ip nat inside
- 3.Step 3: Define the outside interface: interface GigabitEthernet0/1, then ip nat outside
- 4.Step 4: Create an access list to match internal traffic: access-list 1 permit 192.168.1.0 0.0.0.255
- 5.Step 5: Configure dynamic NAT with overload: ip nat inside source list 1 interface GigabitEthernet0/1 overload
! Full IOS config block interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.0 ip nat inside ! interface GigabitEthernet0/1 ip address 203.0.113.2 255.255.255.252 ip nat outside ! access-list 1 permit 192.168.1.0 0.0.0.255 ! ip nat inside source list 1 interface GigabitEthernet0/1 overload
Verify: Use 'show ip nat translations' to see active translations. Expected output shows inside local (192.168.1.x) mapped to inside global (203.0.113.2) with different ports. Also use 'show ip nat statistics' to see hits and misses.
Watch out: A common mistake is forgetting to apply 'ip nat inside' on the internal interface. Without it, the router will not translate traffic from the inside network.
Configure Static NAT for a Public Web Server
A company hosts a web server at 192.168.1.10 internally and wants it accessible from the internet via a public IP 203.0.113.10. Static NAT provides a one-to-one mapping.
Topology
R1(Gi0/0)---192.168.1.0/24---Web Server (192.168.1.10)
R1(Gi0/1)---203.0.113.0/30---InternetSteps
- 1.Step 1: Enter global configuration mode: configure terminal
- 2.Step 2: Define the inside interface: interface GigabitEthernet0/0, then ip nat inside
- 3.Step 3: Define the outside interface: interface GigabitEthernet0/1, then ip nat outside
- 4.Step 4: Configure static NAT: ip nat inside source static 192.168.1.10 203.0.113.10
! Full IOS config block interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.0 ip nat inside ! interface GigabitEthernet0/1 ip address 203.0.113.2 255.255.255.252 ip nat outside ! ip nat inside source static 192.168.1.10 203.0.113.10
Verify: Use 'show ip nat translations' to see the static mapping. Expected output shows inside local 192.168.1.10 and inside global 203.0.113.10. Also test connectivity from outside to 203.0.113.10.
Watch out: Ensure the public IP (203.0.113.10) is not used elsewhere and that the ISP routes traffic for that IP to the router's outside interface. Also, verify that the web server's default gateway points to the router's inside interface IP (192.168.1.1).
Troubleshooting with This Command
When troubleshooting NAT issues, the `ip nat outside` command itself does not produce output, but its correct application is critical. A healthy configuration will show the interface marked as outside in the running-config. Problem indicators include missing `ip nat outside` on the external interface, which results in no translations occurring.
To diagnose, start by verifying the interface configuration with `show running-config interface [interface]` or `show ip nat statistics`. The latter shows the number of translations, hits, and misses. If hits are zero, the inside interface or access list may be misconfigured.
If translations appear but traffic fails, check the outside interface's IP address and routing. Use `debug ip nat` (with caution) to see real-time translations; a healthy debug shows 'NAT: s=192.168.1.10->203.0.113.10' for outgoing packets. Common symptoms include: (1) No internet access for internal users – check that both inside and outside interfaces are correctly marked and that the access list matches the internal network. (2) External users cannot reach internal servers – verify static NAT entries and that the outside interface has the correct public IP. (3) Asymmetric routing – ensure that return traffic enters through the same outside interface.
Correlate `show ip nat translations` with `show ip route` to confirm that the outside interface is the correct exit path. For PAT, check port exhaustion with `show ip nat statistics`; if the translation table is full, increase the number of available ports or add more public IPs. Always ensure that the outside interface is not also configured with `ip nat inside` – that would cause confusion.
Step-by-step diagnostic flow: 1) Verify interface NAT markings. 2) Check access list with `show access-lists`. 3) View translations. 4) Check routing. 5) Use debug if necessary. Remember that `ip nat outside` is a simple marker, but its absence is a common root cause of NAT failures.
CCNA Exam Tips
CCNA exam tip: Remember that ip nat outside must be applied on the interface facing the public network (usually the WAN interface).
CCNA exam tip: The command does not appear in show running-config unless it is explicitly configured; it is not a default setting.
CCNA exam tip: You must also configure ip nat inside on the LAN interface and define a NAT pool or use the interface's IP address with overload.
CCNA exam tip: Misplacing ip nat outside on the inside interface will break NAT; traffic will not be translated correctly.
Common Mistakes
Mistake 1: Applying ip nat outside on the wrong interface (e.g., LAN interface) — causes NAT to fail or translate incorrectly.
Mistake 2: Forgetting to also configure ip nat inside on the LAN interface — no translation occurs.
Mistake 3: Not defining a NAT rule (ip nat inside source) — the outside interface alone does not enable NAT.
ip nat outside vs ip nat inside
These two commands are commonly confused because both are required for NAT operation and are configured under interface mode, but they serve opposite roles: one marks the inside (private) network and the other the outside (public) network. Understanding their distinct purposes is essential for correct NAT configuration.
| Aspect | ip nat outside | ip nat inside |
|---|---|---|
| Interface role | Marks interface as outside (public) | Marks interface as inside (private) |
| Typical placement | WAN-facing interface (e.g., serial, GigabitEthernet to ISP) | LAN-facing interface (e.g., VLAN, Ethernet to internal network) |
| IP address role in NAT | Provides the global (public) IP address used for translation | Identifies the local (private) IP address space being translated |
| NAT configuration dependency | Used with ip nat inside source list to specify the outside interface for overload | Used with ip nat inside source list to specify the inside interface for translation |
Use ip nat outside on the interface that connects to the public network (e.g., internet) to mark it as the outside for NAT translations.
Use ip nat inside on the interface that connects to the private network (e.g., LAN) to mark it as the inside for NAT translations.
Platform Notes
In IOS-XE, the `ip nat outside` command syntax and behavior are identical to classic IOS. However, IOS-XE often runs on newer hardware and may support additional NAT features like VRF-aware NAT. The output of `show ip nat translations` is similar but may include additional fields like 'VRF' if configured.
In NX-OS (Cisco Nexus switches), NAT configuration is different; the equivalent command is `ip nat outside` under interface configuration mode as well, but NX-OS uses a zone-based approach: you must also configure `ip nat` globally and define NAT rules with `ip nat inside source` or `ip nat outside source`. The NX-OS syntax for marking an interface as outside is the same: `ip nat outside`. However, NX-OS does not support all IOS NAT features; for example, it lacks `ip nat inside source list` overload in some versions; instead, you use `ip nat inside source list` with `overload` keyword.
On Cisco ASA firewalls, NAT is configured differently using `nat` and `global` commands in older versions, or `object network` and `nat` in modern ASA code. The ASA does not use `ip nat outside`; instead, you define the outside interface with `nameif outside` and then configure NAT rules referencing the inside and outside interfaces. In IOS-XR, the command `ip nat outside` does not exist; NAT is configured using VRF and interface-level NAT statements like `nat outside` under the interface, but the paradigm is different.
For CCNA/CCNP studies, focus on classic IOS and IOS-XE as they are most common. Version differences: IOS 12.x and 15.x behave identically for this command; IOS 16.x (IOS-XE) also matches. Always verify with `show version` to know the exact IOS train.
Related Commands
ip nat inside
Designates an interface as the inside (private) interface for NAT translation, enabling the router to translate source IP addresses of packets leaving this interface.
show ip nat statistics
Displays statistics about NAT translations, including active translations, hit counts, and configuration parameters, used to verify NAT operation and troubleshoot translation issues.
show ip nat translations
Displays the current active Network Address Translation (NAT) translations on the router, used to verify NAT operations and troubleshoot connectivity issues.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions