Courseiva
NATPrivileged EXEC

show ip nat statistics

Displays statistics about NAT translations, including active translations, hit counts, and configuration parameters, used to verify NAT operation and troubleshoot translation issues.

Definition: show ip nat statistics is a Cisco IOS privileged exec command. Displays statistics about NAT translations, including active translations, hit counts, and configuration parameters, used to verify NAT operation and troubleshoot translation issues.

Overview

The 'show ip nat statistics' command is a vital diagnostic tool for any network engineer working with Network Address Translation (NAT) on Cisco IOS routers. It provides a snapshot of NAT operational status, including the number of active translations, hit counts, and configuration parameters such as translation timeouts and pool usage. This command is essential for verifying that NAT is functioning correctly, identifying resource exhaustion, and troubleshooting translation failures.

Unlike 'show ip nat translations', which lists individual translation entries, this command offers aggregated statistics that give a high-level view of NAT performance and health. It is typically used after configuring NAT to confirm that translations are being created and that traffic is being processed as expected. In a troubleshooting workflow, an engineer might first check 'show ip nat statistics' to see if the router is actively translating packets; if the hit count is zero, it indicates that no traffic is matching the NAT rules, pointing to a configuration or routing issue.

The command also displays the number of expired translations and the maximum allowed, helping to detect if the translation table is full. Output is generated in real-time and does not affect the running configuration. It requires privileged EXEC mode (enable) and is available in most IOS versions, including IOS-XE.

Understanding this command is crucial for CCNA and CCNP candidates as NAT is a core topic, and the ability to interpret its output is frequently tested in exams and real-world scenarios.

Syntax·Privileged EXEC
show ip nat statistics

When to Use This Command

  • Verify that NAT translations are being created and used correctly after configuring dynamic NAT.
  • Check for NAT overload (PAT) port exhaustion when users report connectivity issues.
  • Monitor NAT hit counts to see if traffic is being translated as expected.
  • Troubleshoot why certain inside hosts are not getting translated by examining translation counts and pool usage.

Command Examples

Basic show ip nat statistics

show ip nat statistics
Total active translations: 3 (0 static, 3 dynamic; 3 extended)
Outside interfaces: GigabitEthernet0/1
Inside interfaces: GigabitEthernet0/0
Hits: 1524  Misses: 12
CEF Translated packets: 1524, CEF Punted packets: 0
Expired translations: 45
Dynamic mappings:
-- Inside Source
[Id: 1] access-list 100 pool NAT_POOL refcount 3
 pool NAT_POOL: netmask 255.255.255.240
   start 203.0.113.10 end 203.0.113.20
   type generic, total addresses 11, allocated 3 (27%), misses 0
Total doors: 0
Appl doors: 0
Normal doors: 0
Queued Packets: 0

Total active translations: 3 (0 static, 3 dynamic; 3 extended) — Shows 3 active dynamic translations, all extended (PAT). Outside interfaces: GigabitEthernet0/1 — The NAT outside interface. Inside interfaces: GigabitEthernet0/0 — The NAT inside interface. Hits: 1524 Misses: 12 — Number of packets that matched NAT (hits) vs. those that did not (misses). CEF Translated packets: 1524, CEF Punted packets: 0 — Packets processed by CEF switching. Expired translations: 45 — Number of translations that have timed out. Dynamic mappings: — Shows the ACL and pool used. pool NAT_POOL: netmask 255.255.255.240 — Pool details. start 203.0.113.10 end 203.0.113.20 — Pool address range. type generic, total addresses 11, allocated 3 (27%), misses 0 — Pool type, total addresses, how many are currently allocated, and misses (0 means no failed allocations).

Show ip nat statistics with overload

show ip nat statistics
Total active translations: 150 (0 static, 150 dynamic; 150 extended)
Outside interfaces: GigabitEthernet0/1
Inside interfaces: GigabitEthernet0/0
Hits: 45231  Misses: 0
CEF Translated packets: 45231, CEF Punted packets: 0
Expired translations: 1200
Dynamic mappings:
-- Inside Source
[Id: 1] access-list 100 pool NAT_POOL refcount 150
 pool NAT_POOL: netmask 255.255.255.240
   start 203.0.113.10 end 203.0.113.20
   type generic, total addresses 11, allocated 11 (100%), misses 0
Total doors: 0
Appl doors: 0
Normal doors: 0
Queued Packets: 0

Total active translations: 150 — Many translations active, all extended (PAT). Hits: 45231 Misses: 0 — All packets matched NAT. allocated 11 (100%) — All pool addresses are fully utilized, meaning PAT is heavily used. This indicates high utilization but no misses, so NAT is working fine.

Understanding the Output

The 'show ip nat statistics' command provides a summary of NAT operations. The first line shows total active translations, broken down into static vs dynamic and simple vs extended (PAT). 'Outside interfaces' and 'Inside interfaces' list the interfaces where NAT is enabled.

'Hits' count packets that matched a NAT rule; 'Misses' count packets that should have been translated but failed (e.g., no pool address available). High misses indicate a problem. 'CEF Translated packets' shows hardware-switched translations.

'Expired translations' is the total number of translations that have timed out since counters were last cleared. The 'Dynamic mappings' section details each NAT rule, including the ACL, pool name, address range, and allocation statistics. 'allocated' shows how many addresses are in use; if it reaches 100% and misses are non-zero, the pool is exhausted.

'misses' in the pool line indicates failed attempts to allocate an address. This command is essential for verifying NAT configuration and troubleshooting connectivity issues related to address translation.

Configuration Scenarios

Verify Dynamic NAT with a Pool of Public Addresses

A small office uses a pool of public IP addresses (203.0.113.2-203.0.113.5) to allow internal hosts (192.168.1.0/24) to access the internet. After configuring dynamic NAT, the administrator needs to verify that translations are being created and that the pool is not exhausted.

Topology

R1(Gi0/0)---192.168.1.0/24---(Gi0/0)Hosts R1(Gi0/1)---203.0.113.1/30---(Gi0/1)ISP

Steps

  1. 1.Step 1: Enter privileged EXEC mode: Router> enable
  2. 2.Step 2: Access the router via console or SSH.
  3. 3.Step 3: Issue the command: Router# show ip nat statistics
  4. 4.Step 4: Observe the output fields: 'Total active translations', 'Peak translations', 'Hits', 'Misses', and 'Expired translations'.
  5. 5.Step 5: Check the 'Pool' section to see if the pool is defined and how many addresses are used.
  6. 6.Step 6: If hits are zero, verify that the ACL matches traffic and that the NAT configuration is correct.
Configuration
! Dynamic NAT configuration
interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/1
 ip address 203.0.113.1 255.255.255.252
 ip nat outside
!
access-list 1 permit 192.168.1.0 0.0.0.255
ip nat pool PUBLIC_POOL 203.0.113.2 203.0.113.5 netmask 255.255.255.248
ip nat inside source list 1 pool PUBLIC_POOL

Verify: Router# show ip nat statistics Total active translations: 3 (0 static, 3 dynamic; 3 extended) Peak translations: 5 Hits: 152 Misses: 10 Expired translations: 7 Dynamic mappings: -- Inside Source [Id: 1] access-list 1 pool PUBLIC_POOL refcount 3 pool PUBLIC_POOL: netmask 255.255.255.248 start 203.0.113.2 end 203.0.113.5 type generic, total addresses 4, allocated 3 (75%), misses 0 (Output truncated for brevity)

Watch out: Ensure the ACL permits the correct source addresses; a common mistake is using a standard ACL with the wrong source or forgetting to apply 'ip nat inside' and 'ip nat outside' on the correct interfaces.

Verify PAT (NAT Overload) with a Single Public IP

A home office router uses Port Address Translation (PAT) to allow multiple internal hosts (192.168.0.0/24) to share a single public IP address (198.51.100.1) for internet access. After configuration, the administrator wants to confirm that translations are using port numbers and that the router is handling traffic correctly.

Topology

R1(Gi0/0)---192.168.0.0/24---(Gi0/0)Hosts R1(Gi0/1)---198.51.100.1/30---(Gi0/1)ISP

Steps

  1. 1.Step 1: Enter privileged EXEC mode: Router> enable
  2. 2.Step 2: Issue the command: Router# show ip nat statistics
  3. 3.Step 3: Look for 'Total active translations' and note the number of extended translations (PAT entries).
  4. 4.Step 4: Check the 'Hits' count to see if traffic is being translated.
  5. 5.Step 5: Verify that the 'Inside Source' mapping shows 'overload' enabled.
  6. 6.Step 6: If the translation count is high but hits are low, there may be a routing or ACL issue.
Configuration
! PAT configuration
interface GigabitEthernet0/0
 ip address 192.168.0.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/1
 ip address 198.51.100.1 255.255.255.252
 ip nat outside
!
access-list 1 permit 192.168.0.0 0.0.0.255
ip nat inside source list 1 interface GigabitEthernet0/1 overload

Verify: Router# show ip nat statistics Total active translations: 12 (0 static, 12 dynamic; 12 extended) Peak translations: 20 Hits: 450 Misses: 5 Expired translations: 30 Dynamic mappings: -- Inside Source [Id: 1] access-list 1 interface GigabitEthernet0/1 refcount 12 (Output truncated)

Watch out: A common mistake is forgetting the 'overload' keyword, which would cause the router to use dynamic NAT instead of PAT, quickly exhausting the single public IP address.

Troubleshooting with This Command

When troubleshooting NAT issues, 'show ip nat statistics' is often the first command to examine. A healthy output shows a non-zero 'Hits' count, indicating that traffic is being matched and translated. If 'Hits' is zero, no traffic is hitting the NAT rules; check the ACL and interface configurations.

A high 'Misses' count may indicate that the router is receiving packets that do not match any translation entry, often due to asymmetric routing or missing ACL entries. The 'Total active translations' field should be below the 'Peak translations' and well under the maximum limit (default 131072 on most platforms). If the number of active translations is near the maximum, the router may be dropping new translations, causing connectivity issues.

The 'Expired translations' count shows how many translations have timed out; a rapidly increasing count could indicate that connections are being torn down prematurely, possibly due to misconfigured timeouts. The 'Pool' section (if using a pool) shows the number of allocated addresses; if 'allocated' equals 'total addresses', the pool is exhausted, and new translations will fail. For PAT, the output does not show port usage directly, but a high number of extended translations (e.g., thousands) may indicate that the router is running out of port numbers.

To correlate with other commands, use 'show ip nat translations' to see the actual translation entries, 'debug ip nat' for real-time translation events, and 'show access-lists' to verify ACL matches. A step-by-step diagnostic flow: 1) Check 'show ip nat statistics' for hits and misses. 2) If hits are zero, verify ACL with 'show access-lists'. 3) If ACL matches, check interface NAT direction with 'show ip interface'. 4) If translations are not being created, check for route to destination. 5) If translations are created but no return traffic, check for routing issues or firewall rules. Remember that NAT statistics are cumulative since the last reload or clear; use 'clear ip nat statistics' to reset counters for fresh troubleshooting.

CCNA Exam Tips

1.

CCNA exam tip 1: Remember that 'Hits' and 'Misses' are key indicators; high misses suggest a missing ACL entry or exhausted pool.

2.

CCNA exam tip 2: Know the difference between static, dynamic, and extended (PAT) translations as shown in the first line.

3.

CCNA exam tip 3: Be able to interpret pool utilization: 'allocated 11 (100%)' means all addresses are in use, which may cause new translations to fail.

4.

CCNA exam tip 4: The 'Outside interfaces' and 'Inside interfaces' lines verify correct NAT interface configuration.

Common Mistakes

Mistake 1: Confusing 'Hits' with successful translations; hits count packets that matched NAT, not necessarily successful translations.

Mistake 2: Forgetting to clear counters before troubleshooting; stale data can mislead analysis.

Mistake 3: Assuming 'allocated 0%' means NAT is not working; it may simply mean no traffic has triggered translations yet.

show ip nat statistics vs show ip nat translations

These two commands are commonly confused as both display information about NAT, but they serve distinct purposes: show ip nat statistics provides aggregate performance counters and configuration details, while show ip nat translations lists the current active translation entries.

Aspectshow ip nat statisticsshow ip nat translations
ScopeAggregate NAT performance statistics and configurationIndividual active translation entries
Output DetailCounts (active, expired, hits, misses) and config parametersPer-entry details (inside/outside addresses, protocol, ports)
Use CaseMonitoring overall NAT health and verifying settingsTroubleshooting specific connectivity issues or verifying translations
Data PersistenceCounters are cleared on reload or by clear ip nat statisticsEntries are cleared on reload or timeout; dynamic translations expire
Configuration InsightDisplays configured NAT pools, ACLs, timeoutsNo configuration details; only active translations

Use show ip nat statistics when you need to monitor NAT performance and verify configuration parameters.

Use show ip nat translations when you need to inspect specific translation entries for troubleshooting.

Platform Notes

In IOS-XE (e.g., Catalyst 9000 switches), the 'show ip nat statistics' command is available with similar output, but some fields may differ slightly; for example, the 'Hits' and 'Misses' counters are present, but the output may include additional fields like 'Outside interfaces' and 'Inside interfaces' separately. On NX-OS (Nexus switches), the equivalent command is 'show ip nat statistics' as well, but the output format is different; it shows 'Total translations', 'Static translations', 'Dynamic translations', and 'Extended translations' in a tabular format. Additionally, NX-OS uses 'ip nat' configuration under 'interface' and 'ip nat pool' commands similar to IOS.

On ASA firewalls, the equivalent is 'show xlate' for translation statistics, but 'show nat' provides NAT rule statistics. In older IOS versions (12.x), the output may not include 'Peak translations' or 'Expired translations' fields; these were added in later versions. IOS-XR does not support 'show ip nat statistics' directly; instead, use 'show nat statistics' or 'show cgn statistics' depending on the NAT implementation.

Always check the specific platform documentation for exact syntax and output interpretation.

Related Commands

clear ip nat translation *

Clears all dynamic NAT translations from the translation table, forcing the router to rebuild translations for new traffic.

show ip nat translations

Displays the current active Network Address Translation (NAT) translations on the router, used to verify NAT operations and troubleshoot connectivity issues.

show running-config

Displays the current active configuration in DRAM, showing all non-default settings.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions