ip nat pool [name] [start-ip] [end-ip] netmask [mask]

Overview

The `ip nat pool` command is a cornerstone of dynamic Network Address Translation (NAT) and Port Address Translation (PAT) configurations on Cisco IOS routers. It defines a contiguous range of global (outside) IP addresses that can be dynamically assigned to inside hosts when they initiate traffic to external networks. This command is essential for conserving public IPv4 addresses, as it allows multiple internal devices to share a smaller pool of external addresses, typically through PAT (also known as NAT overload).

The concept behind it is straightforward: internal hosts use private IP addresses (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) that are not routable on the public internet. When a host sends traffic to an external destination, the router translates the source IP address (and often port) to one from the defined pool. The pool is referenced in a dynamic NAT rule using `ip nat inside source list <acl> pool <pool-name>`.

Without this command, you would need to configure static NAT entries for each internal host, which is impractical for large networks. Alternatively, you could use a single interface IP address for PAT with `ip nat inside source list <acl> interface <interface> overload`, which is simpler but offers less flexibility in address assignment. The `ip nat pool` command is typically used when you have a dedicated block of public IP addresses (e.g., from your ISP) and want to distribute them among internal users.

It fits into the broader NAT configuration workflow: first, define the pool; second, create an access list to identify which inside addresses are eligible; third, apply the translation rule under global config; and finally, designate inside and outside interfaces with `ip nat inside` and `ip nat outside`. Important IOS behaviors: the pool is stored in the running configuration and persists across reloads if saved. There is no buffered output; the command either succeeds or returns an error (e.g., overlapping addresses).

Privilege level 15 (privileged EXEC) is required to enter global configuration mode. The pool name is case-sensitive and must match exactly when referenced. If the pool is exhausted, new translations are dropped unless PAT is enabled (via the `overload` keyword in the NAT rule).

The netmask defines the subnet of the pool; all addresses in the range must belong to the same subnet. A common mistake is using a netmask that does not encompass the start and end IPs, or forgetting to include the `overload` keyword when PAT is intended. This command is fundamental for CCNA and CCNP candidates to understand, as NAT is a core topic in both certifications and a daily reality for network engineers managing internet connectivity.