show ip nat translations
Displays the current active Network Address Translation (NAT) translations on the router, used to verify NAT operations and troubleshoot connectivity issues.
Definition: show ip nat translations is a Cisco IOS privileged exec command. Displays the current active Network Address Translation (NAT) translations on the router, used to verify NAT operations and troubleshoot connectivity issues.
Overview
The 'show ip nat translations' command is a critical diagnostic tool for any network engineer working with Network Address Translation (NAT) on Cisco IOS routers. It displays the current active NAT translations, showing how internal private IP addresses are being mapped to public (or other) addresses as traffic traverses the router. This command is essential for verifying that NAT is functioning as intended, troubleshooting connectivity issues where NAT might be misconfigured, and monitoring the NAT table for resource exhaustion or unexpected translations.
NAT is a fundamental networking concept that allows multiple devices on a private network (using RFC 1918 addresses like 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16) to share a single public IP address (or a pool of public addresses) when accessing external networks, typically the internet. The router maintains a translation table that maps each private IP and port to a public IP and port. This table is dynamically created when traffic from an inside host initiates a connection to an outside destination, and entries are aged out after a period of inactivity (default 24 hours for static entries, but dynamic entries may time out sooner).
You would reach for 'show ip nat translations' when users report that they cannot access external resources, or when you suspect that NAT is not translating correctly. Alternatives include 'show ip nat statistics' (which gives aggregate counts and pool usage) and 'debug ip nat' (which provides real-time translation events but is CPU-intensive). This command fits into the broader troubleshooting workflow after verifying basic connectivity (ping, traceroute) and confirming that NAT configuration (access lists, pools, interfaces) is correct. It is also used during initial NAT deployment to confirm that translations are being created as expected.
Important IOS behaviors: The output is buffered and may not reflect real-time changes if the router is under heavy load; use the 'clear ip nat translation *' command to reset the table if needed. Privilege level 15 (Privileged EXEC) is required to execute this command. The command does not modify the running configuration; it is a show command only. The output can be extensive in large networks, so filtering by specific parameters (like inside global IP) is recommended. The command also supports the 'verbose' keyword to show additional details like timeouts and whether the entry is static or dynamic.
show ip nat translationsWhen to Use This Command
- Verify that internal hosts are being translated to the correct public IP addresses when accessing the internet.
- Troubleshoot why a specific host cannot reach external resources by checking if its NAT entry exists.
- Monitor the number of active translations to ensure NAT pools are not exhausted.
- Identify stale or incomplete translations that may be causing asymmetric routing or connectivity drops.
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| verbose | verbose | Displays additional details for each translation entry, including the timeout value, whether the entry is static or dynamic, and the use count. Useful for in-depth analysis of NAT behavior. |
| inside-global-ip | A.B.C.D | Filters the output to show only translations with the specified inside global IP address. This is the public IP address seen by external hosts. Useful for isolating traffic for a specific public IP. |
| inside-local-ip | A.B.C.D | Filters the output to show only translations with the specified inside local IP address. This is the private IP address of the internal host. Useful for checking translations for a specific internal device. |
| outside-local-ip | A.B.C.D | Filters the output to show only translations with the specified outside local IP address. This is the IP address of the external host as seen from the inside network (usually the actual destination IP). |
| outside-global-ip | A.B.C.D | Filters the output to show only translations with the specified outside global IP address. This is the IP address of the external host as seen from the outside network (usually the same as outside local unless destination NAT is used). |
| interface | interface type number | Displays translations associated with a specific interface. Useful when NAT is configured on multiple interfaces and you want to focus on one. |
Command Examples
Basic NAT translation display
show ip nat translationsPro Inside global Inside local Outside local Outside global --- 192.168.1.10:1024 10.0.0.10:1024 203.0.113.5:80 203.0.113.5:80 --- 192.168.1.11:2048 10.0.0.11:2048 198.51.100.2:443 198.51.100.2:443 --- 192.168.1.12:3072 10.0.0.12:3072 203.0.113.5:80 203.0.113.5:80
Each row shows a translation entry. 'Pro' indicates protocol (TCP/UDP) but is blank here. 'Inside global' is the translated public IP:port. 'Inside local' is the original private IP:port. 'Outside local' and 'Outside global' are typically the same for outbound NAT (destination IP:port).
Verbose NAT translation display
show ip nat translations verbosePro Inside global Inside local Outside local Outside global tcp 192.168.1.10:1024 10.0.0.10:1024 203.0.113.5:80 203.0.113.5:80 create 00:01:30, use 00:00:15, timeout: 86400, left 23:59:45 Map-Id(In): 1, Mac-Address: 0000.0000.0000 Input-IDB: GigabitEthernet0/0, Output-IDB: GigabitEthernet0/1 tcp 192.168.1.11:2048 10.0.0.11:2048 198.51.100.2:443 198.51.100.2:443 create 00:05:00, use 00:02:00, timeout: 86400, left 23:55:00 Map-Id(In): 1, Mac-Address: 0000.0000.0000 Input-IDB: GigabitEthernet0/0, Output-IDB: GigabitEthernet0/1
Verbose output adds timing and interface details. 'create' shows time since translation was created, 'use' shows time since last used. 'timeout' is the idle timeout (default 86400 seconds for TCP). 'left' is remaining time before timeout. 'Map-Id' references the NAT rule. 'Input-IDB' and 'Output-IDB' show ingress and egress interfaces.
Understanding the Output
The command output lists all active NAT translations in a table format. The 'Pro' column shows the protocol (TCP, UDP, or blank for ICMP). 'Inside global' is the translated IP address and port as seen on the outside network.
'Inside local' is the original private IP and port of the internal host. 'Outside local' and 'Outside global' are typically identical for outbound NAT, representing the destination IP and port. In more complex scenarios like destination NAT or hairpinning, these may differ.
A healthy network will show translations for active sessions; missing entries indicate no translation is occurring. Excessive translations may indicate a DoS attack or misconfiguration. Stale entries (old 'create' time with recent 'use' time) are normal; entries with old 'use' time may be idle and will timeout.
In verbose mode, additional details like timers, map IDs, and interfaces help pinpoint which NAT rule is being used and on which interfaces.
Configuration Scenarios
Verify Dynamic NAT for Internal Users Accessing the Internet
A company has a pool of public IP addresses (203.0.113.1 to 203.0.113.5) and uses dynamic NAT to allow internal users (192.168.1.0/24) to access the internet. Users report intermittent connectivity issues. You need to verify that translations are being created correctly.
Topology
Internal Host (192.168.1.10)---(Gi0/0) R1 (Gi0/1)---203.0.113.0/29---InternetSteps
- 1.Step 1: Enter privileged EXEC mode: Router> enable
- 2.Step 2: View all active NAT translations: Router# show ip nat translations
- 3.Step 3: Check for translations from the internal host: Router# show ip nat translations inside-local 192.168.1.10
- 4.Step 4: If no translations appear, verify that the access list matches the internal network: Router# show access-lists
- 5.Step 5: Check NAT statistics to see if the pool is exhausted: Router# show ip nat statistics
! Configure dynamic NAT ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.5 netmask 255.255.255.248 access-list 1 permit 192.168.1.0 0.0.0.255 ip nat inside source list 1 pool PUBLIC_POOL interface GigabitEthernet0/0 ip nat inside interface GigabitEthernet0/1 ip nat outside
Verify: Router# show ip nat translations Pro Inside global Inside local Outside local Outside global --- 203.0.113.2 192.168.1.10 --- --- The output shows a dynamic translation mapping inside local 192.168.1.10 to inside global 203.0.113.2.
Watch out: If the access list does not permit the internal network, no translations will be created. Also, ensure the NAT pool has enough addresses; if all addresses are used, new translations will fail.
Verify Static NAT for a Public Server
A web server at 192.168.1.100 must be accessible from the internet via a static public IP 203.0.113.10. You need to confirm that the static NAT entry is active and that traffic is being translated correctly.
Topology
Internet---(Gi0/1) R1 (Gi0/0)---192.168.1.100 (Web Server)Steps
- 1.Step 1: Enter privileged EXEC mode: Router> enable
- 2.Step 2: View all NAT translations: Router# show ip nat translations
- 3.Step 3: Filter for the specific static entry: Router# show ip nat translations inside-global 203.0.113.10
- 4.Step 4: Check that the translation is marked as static (--- in Pro column for no protocol): Router# show ip nat translations verbose
- 5.Step 5: Test connectivity from outside: ping 203.0.113.10 from a remote host
! Configure static NAT ip nat inside source static 192.168.1.100 203.0.113.10 interface GigabitEthernet0/0 ip nat inside interface GigabitEthernet0/1 ip nat outside
Verify: Router# show ip nat translations Pro Inside global Inside local Outside local Outside global --- 203.0.113.10 192.168.1.100 --- --- The static entry shows a direct mapping without a protocol (---).
Watch out: Static NAT entries do not appear in 'show ip nat statistics' as dynamic entries. Also, ensure that the outside interface has a route back to the public IP; otherwise, return traffic will not reach the router.
Troubleshooting with This Command
When using 'show ip nat translations' for troubleshooting, a healthy output shows entries that match expected traffic flows. For dynamic NAT, you should see translations with a protocol (e.g., TCP, UDP, ICMP) and both inside and outside addresses populated. For static NAT, you see a direct mapping without protocol. Problem indicators include: no translations at all (suggests NAT configuration issue or no traffic matching the access list), only partial translations (e.g., inside local but no inside global), or many translations with the same inside global address (port exhaustion). Focus on the 'Pro' column: if it shows '---' for a dynamic entry, it may indicate an incomplete translation. Also check the 'use count' in verbose output; a high use count on a single inside global address may indicate port address translation (PAT) is working correctly, but if it reaches the limit (default 65535), new connections fail.
Common symptoms: Users cannot browse the internet. Use 'show ip nat translations' to see if translations exist for the user's IP. If not, check the access list with 'show access-lists' to ensure the user's network is permitted. If translations exist but traffic still fails, check the outside interface for correct routing and ACLs. Another symptom: external users cannot reach an internal server. Verify the static NAT entry exists and that the inside local IP is reachable from the router. Also check that the outside interface has an ACL permitting inbound traffic to the public IP.
Step-by-step diagnostic flow: 1) Identify the affected host IP. 2) Run 'show ip nat translations | include <host-ip>' to see if a translation exists. 3) If no translation, verify NAT configuration (pool, ACL, interfaces). 4) If translation exists, check the outside global address and port. 5) Use 'show ip nat statistics' to see total translations, hits, misses, and pool usage. 6) If pool is exhausted, consider increasing pool size or using PAT. 7) Correlate with 'debug ip nat' (with caution) to see real-time translation events. 8) Also check routing: 'show ip route' for the destination network. The command output can be correlated with 'show ip interface' to confirm NAT is enabled on the correct interfaces.
CCNA Exam Tips
CCNA exam tip: Remember that 'show ip nat translations' shows only dynamic translations; static NAT entries appear only when traffic flows.
CCNA exam tip: The 'Inside global' address is the one that appears in packet captures on the outside; the 'Inside local' is the real host IP.
CCNA exam tip: If you see no translations but hosts can't reach the internet, check NAT configuration with 'show ip nat statistics'.
CCNA exam tip: For PAT (overload), multiple inside locals share the same inside global IP but with different ports.
Common Mistakes
Mistake 1: Confusing 'Inside global' with 'Outside local' — remember 'Inside' refers to your network, 'Outside' to the remote.
Mistake 2: Forgetting that NAT translations are created only when traffic matches an ACL in the NAT configuration; no traffic = no output.
Mistake 3: Assuming the output shows all possible translations; entries timeout after idle period (default 24 hours for TCP, 1 minute for UDP).
show ip nat translations vs show ip nat statistics
Both 'show ip nat translations' and 'show ip nat statistics' are used to monitor NAT operations, but they provide fundamentally different information. The former lists active translation entries, while the latter displays aggregate counters and configuration details. They are commonly confused because both start with 'show ip nat' and are used in troubleshooting, yet answering different questions.
| Aspect | show ip nat translations | show ip nat statistics |
|---|---|---|
| Scope | Lists all current NAT translation entries (inside-local, inside-global, outside-local, outside-global) | Shows cumulative statistics and configuration parameters (active translations, hits, misses, expiry count) |
| Output type | Tabular list of translation mappings (one line per active translation) | Sectioned summary with numeric counters and configuration flags |
| Use case | Identifying specific IP address mappings for troubleshooting connectivity | Verifying NAT configuration and monitoring overall translation activity |
| Data persistence | Transient – entries appear only while translations are active (timeout or clear) | Cumulative – counters persist across translations until cleared manually or by reload |
| Troubleshooting focus | Pinpointing missing or incorrect translations for a specific flow | Assessing NAT engine health (e.g., high miss rate, pool exhaustion) |
Use show ip nat translations when you need to see the actual IP address mappings to diagnose connectivity problems for a specific host or session.
Use show ip nat statistics when you want to check NAT configuration parameters and overall translation activity to validate setup or detect resource issues.
Platform Notes
In IOS-XE (e.g., Catalyst 9000 switches, ASR 1000), the 'show ip nat translations' command syntax and output are largely identical to classic IOS. However, IOS-XE may support additional parameters like 'vrf' for VRF-aware NAT. The output format is the same, but some fields (like 'use count') may appear in verbose mode.
On NX-OS (Nexus switches), the equivalent command is 'show ip nat translations' as well, but the output format differs slightly: it shows 'inside' and 'outside' addresses in separate columns, and supports 'detail' keyword for verbose information. NX-OS also uses 'ip nat' configuration under interface mode. On ASA firewalls, the equivalent command is 'show xlate' (for stateful translations) or 'show nat' (for NAT rules).
The ASA does not use 'show ip nat translations'. For IOS-XR (e.g., ASR 9000, CRS), the command is 'show nat translations' (without 'ip') and the output is different, focusing on NAT64 and NPTv6. In IOS 12.x and 15.x, the command behavior is consistent, but in 16.x (IOS-XE), there may be additional fields like 'refcount' in verbose output.
Always check the specific platform documentation for exact syntax.
Related Commands
clear ip nat translation *
Clears all dynamic NAT translations from the translation table, forcing the router to rebuild translations for new traffic.
show ip nat statistics
Displays statistics about NAT translations, including active translations, hit counts, and configuration parameters, used to verify NAT operation and troubleshoot translation issues.
show running-config
Displays the current active configuration in DRAM, showing all non-default settings.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions