# Inside global

> Source: Courseiva IT Certification Glossary — https://courseiva.com/glossary/inside-global

## Quick definition

An inside global is the public IP address assigned to a device inside a private network when it communicates over the internet. It is part of Network Address Translation (NAT) and allows many private devices to share one or a few public IPs. Think of it as the return address on an envelope that the outside world sees. Network engineers configure it so internal computers can reach the outside internet securely.

## Simple meaning

Imagine you work in a huge office building with hundreds of desks, but the building only has one main door that leads to the street outside. Each desk has an internal extension number that works only inside the building. When you want to make a phone call to the outside world, the building's receptionist uses a single main phone number for your call, and the person you call sees that main number on their caller ID. That main phone number is like the "inside global", it is the public address that outsiders see, even though you are actually using a private extension inside. 

 In computer networking, every device on a private network (like your home Wi-Fi) gets a private IP address from a special range that cannot be used directly on the internet. When that device wants to talk to a website or any internet server, a router or firewall translates its private address into a public, routable address. That translated address is called the "inside global" address. It belongs to the router's pool of public IPs, which are unique across the entire internet. 

 The device inside the network never knows its own inside global address; it only knows its private address. The outside server also never knows the device's private address, it only sees the inside global address. This whole process is called Network Address Translation (NAT), and the inside global is a key concept for anyone studying IP services and security for IT certifications.

## Technical definition

Inside global is a term used in Cisco IOS and other networking contexts to describe the IP address of an inside host as it appears to devices on the outside network, typically the internet. It is one of four key NAT terms defined by Cisco: inside local, inside global, outside local, and outside global. Together, these terms describe the translation of addresses as packets traverse a NAT-enabled router or firewall. 

 Specifically, the inside global address is the globally unique, routable IP address that represents an internal (inside) host when it communicates with an external (outside) network. This address is typically allocated from a public IP address pool assigned by an Internet Service Provider (ISP). The NAT device maintains a translation table that maps each inside local (the private IP of the internal host) to an inside global (the public IP used for translation). 

 The inside global can be assigned dynamically or statically. In dynamic NAT, the router selects an inside global address from a pool of available public addresses as needed, and releases it when the session ends. In static NAT (also called port forwarding), a specific inside local is permanently mapped to a specific inside global, often used for servers that must be reachable from the internet. Port Address Translation (PAT), also known as NAT overload, is a common variation where many inside locals are mapped to a single inside global address by differentiating traffic based on TCP or UDP port numbers. 

 The standards that govern these operations are defined in RFC 3022 (Traditional IP Network Address Translator) and RFC 2663 (IP Network Address Translator Terminology). In practice, the inside global address resides on the outside-facing interface of the NAT device. When a packet leaves the inside host, the router changes the source IP from the inside local to the inside global before forwarding the packet onto the internet. In the return path, the router reverses the translation, using the port number and translation table to deliver the packet to the correct inside host. 

 Understanding inside global is critical for configuring and troubleshooting NAT on Cisco routers and other network devices. Common exam objectives include identifying the inside global in a given network topology, configuring NAT pools, verifying translations with show commands like show ip nat translations, and troubleshooting connectivity issues when the inside global pool is exhausted. It is also a foundational concept for understanding IP conservation, private addressing (RFC 1918), and network security since it hides internal addressing structures.

## Real-life example

Think of a big apartment building with many units, but only one street address for the entire building: 123 Main Street. Each apartment has an internal unit number like Apt 4B. When a delivery person arrives with a package for someone living in Apt 4B, they come to the building's main entrance (the public, global address) and the package is received by the front desk. The front desk knows that the package is actually for Apt 4B because it has the unit number written on it (the port number in networking terms). The outside world does not know that Apt 4B exists inside the building; they only know to send packages to 123 Main Street. 

 In this analogy, the building's street address is the "inside global" address, it is the public-facing identifying information that the whole outside world uses to reach someone inside. The front desk acts like the NAT router, translating the general building address into a specific apartment unit number. The people outside cannot see the internal layout; they just see the global building address. 

 Now imagine multiple apartments receive deliveries simultaneously. The front desk keeps a log (the NAT translation table) that pairs each delivery's tracking number (which corresponds to a port number) with the specific apartment. When the delivery truck arrives, the driver only needs the building address. The front desk then uses its log to route each package to the correct apartment. This is exactly how PAT (NAT overload) works, many internal hosts share a single inside global address, and the router differentiates them by port numbers. 

 The key point is that the inside global address is the mask behind which many private hosts operate. Just as the building's street address is the only identifier outsiders have, the inside global is the only IP address that external networks ever see for any host inside the private network.

## Why it matters

Understanding inside global is essential for network administrators and IT security professionals because it directly impacts internet connectivity, security, and IP address conservation. In practical IT environments, most organizations have far more internal devices than they have public IP addresses. The concept of inside global enables the use of private addressing (RFC 1918) inside the network while still providing internet access to all internal users. Without this translation, organizations would need to purchase a public IP address for every single device, which would be prohibitively expensive and inefficient. 

 From a security standpoint, inside global addresses provide a layer of obfuscation. External attackers cannot directly target internal hosts because they only see the translated public addresses, not the actual private addresses. Combined with stateful firewalls and access control lists, inside global addresses help enforce a security boundary between internal trusted networks and the untrusted internet. 

 In troubleshooting, misconfigured inside global mappings are a common source of connectivity failures. For example, if the NAT pool runs out of inside global addresses, new connections from internal hosts will fail. Network engineers must monitor the NAT pool utilization and may need to implement PAT or increase the pool size. Applications that embed IP addresses in the payload (like FTP or SIP) can break if the NAT does not perform application-level gateway (ALG) corrections. 

 For certification candidates, the concept of inside global appears in many exam scenarios, from straightforward NAT configuration questions to complex multi-protocol troubleshooting. A solid grasp of inside global helps in understanding how traffic flows through a network, how to interpret NAT translation tables, and how to design networks that scale. It is not just a theoretical term but a practical tool that underpins the modern internet for virtually every organization.

## Why it matters in exams

Inside global is a core concept in several major IT certification exams, particularly those from Cisco (CCNA, CCNP), CompTIA (Network+, Security+), and Juniper (JNCIA-Junos). For the Cisco CCNA exam (200-301), the term "inside global" appears explicitly in the IP services section, specifically under the Network Address Translation (NAT) objectives. Candidates must understand the NAT terminology, configure static and dynamic NAT, configure PAT, and verify NAT operations. Exam questions often present a network topology and ask the candidate to identify the inside global address for a given host, or to troubleshoot why a host cannot reach the internet when the inside global pool is misconfigured. 

 In the CompTIA Network+ (N10-008) exam, the concept is covered under network addressing and IP services, though the term "inside global" is less emphasized. Instead, CompTIA focuses on the general idea of NAT and port forwarding. Still, understanding the terminology helps candidates answer scenario-based questions where they must choose which address belongs to the internet-facing side of a NAT router. For Security+ (SY0-601), the security implications of NAT are more important. Questions may ask how inside global addresses contribute to hiding internal network structure from attackers, and why this is a security control. 

 For the JNCIA-Junos exam, Juniper uses slightly different terminology but the underlying concept is identical. Candidates must know how to configure source NAT (which translates inside local to inside global) on Juniper devices, and how to verify translations using show security nat source commands. 

 Question types that commonly involve inside global include: multiple-choice questions asking for the correct NAT term in a given context, drag-and-drop scenarios where you match addresses to inside local/global labels, configuration questions where you fill in missing NAT pool commands, and troubleshooting questions where you analyze debug output or show command results to determine why translation is failing. 

 The exam also tests your ability to distinguish inside global from inside local in complex network diagrams. For example, a question might show a PC with IP 192.168.1.10 sending a packet to a web server at 203.0.113.5, with a router performing NAT. The exam might ask: "What is the source IP address of the packet when it leaves the router's serial interface?" The answer would be the inside global address from the NAT pool. 

 Consequently, inside global is not a one-off term but a recurring theme. Mastery of this concept can secure points across multiple exam domains, including IP services, network security, and troubleshooting.

## How it appears in exam questions

Exam questions featuring inside global typically fall into three categories: definition/terminology, configuration/verification, and troubleshooting. In definition questions, the exam might give you a network diagram with labeled addresses and ask you to select the correct term (inside local, inside global, outside local, outside global). For example, a question might show a PC with IP 10.0.0.5 sending data to a server at 72.14.204.100, and a router with a public IP of 198.51.100.2 on its WAN interface. The question: "Which address represents the inside global?" The answer is 198.51.100.2 (the public IP that the router assigns to represent the PC). 

 Configuration questions often present a partial or incorrect NAT configuration and ask you to complete it or find the error. For instance: "A network engineer wants to translate source IP addresses from the 192.168.1.0/24 network to the public IP 203.0.113.10 when traffic goes to the internet. Which command should be added to the NAT pool configuration?" The answer would involve defining the inside global address pool, then applying an access list to match the inside local traffic. 

 Troubleshooting questions commonly present a scenario where an internal host cannot reach the internet, and the candidate must analyze show ip nat translations or debug ip nat output to identify the problem. For example, the output might show no translations, indicating that the inside local traffic was not matched by the ACL. A follow-up question might ask: "What is the most likely cause?", the answer being that the access list does not permit the inside local subnet. 

 Another pattern involves PAT (NAT overload). The question might describe a network with 100 internal hosts but only one public IP. The candidate is asked to configure NAT so that all hosts can share that single inside global address using port numbers. The correct answer would include the ip nat inside source list 1 interface serial0/0/0 overload command. 

 A more advanced question might combine inside global with other services like DHCP or DNS. For instance: "An internal web server with private address 192.168.1.10 must be reachable from the internet. The administrator configures static NAT with inside global 203.0.113.20. After configuration, external users still cannot reach the server. What could be the issue?" Possible answers include: missing DNS A record, incorrect firewall rule, or the NAT translation not including port 80. 

 These question types demand that the candidate not only memorize definitions but also understand the flow of a packet through a NAT device, the meaning of each address in the translation table, and the command syntax for different NAT implementations. Practicing with hands-on labs and simulation tools is the best way to prepare for these scenarios.

## Example scenario

Scenario: You are a junior network administrator for a small company called BrightWeb. The company has 50 employees, each with a desktop computer. All computers are on a private network using IP addresses like 192.168.1.2, 192.168.1.3, and so on. The company has only one public IP address assigned by the ISP: 72.14.200.50. Your boss asks you to configure the router so that all employees can browse the internet. 

 You log into the router and set up DHCP so that each desktop gets a private IP from the 192.168.1.0/24 range. Then you configure Dynamic NAT with PAT (overload) on the router. You create an access list that permits all traffic from the 192.168.1.0 network, and then you apply it to the NAT configuration with the command: ip nat inside source list 100 interface serial0/0/0 overload. The serial interface has the public address 72.14.200.50. 

 Now, when an employee at 192.168.1.10 opens a browser to visit a website, the router sees the packet. It recognizes that the source IP is the inside local (192.168.1.10), and it checks its NAT table. The router then translates that source IP to the inside global address which is 72.14.200.50 along with a unique port number, say 1025. The packet goes out to the web server with source 72.14.200.50:1025. The web server sees the packet coming from 72.14.200.50 and sends the response back to that same IP and port. 

 When the response arrives at the router, the router looks at the destination port (1025), finds the matching entry in the NAT table, and translates the destination IP back to 192.168.1.10. The packet then reaches the employee's computer. The employee sees the web page appear, completely unaware that their private address was translated. 

 This scenario shows how inside global works in a real office, the single public IP (the inside global) represents the entire company to the internet. It is the same concept you will see in exam scenarios, often labeled on a diagram. Recognizing that 72.14.200.50 is the inside global is a key step to answering related questions correctly.

## Common mistakes

- **Mistake:** Confusing inside global with inside local, thinking that the inside global is the private IP address of the host.
  - Why it is wrong: Inside local is the private IP address assigned to the host within the internal network (like 192.168.1.10). Inside global is the public IP that represents that host to external networks. The two are distinct and appear on different sides of the NAT router.
  - Fix: Remember: local = private (inside the house), global = public (outside the house). The host's own IP is never visible on the internet; the inside global takes its place.
- **Mistake:** Believing that every inside local must have a unique inside global address.
  - Why it is wrong: With PAT (NAT overload), many inside local hosts can share a single inside global address because the router differentiates connections by port numbers. Only one inside global is needed for many hosts, not one per host.
  - Fix: Understand that PAT is the standard way to conserve public IPs. You can have thousands of internal devices sharing one inside global IP.
- **Mistake:** Thinking that the inside global address is the IP of the router's inside interface.
  - Why it is wrong: The router's inside interface (facing the LAN) has an IP from the private range, not a public one. That private IP is the default gateway for hosts. The inside global is assigned to the outside interface (facing the internet) or drawn from a separate public pool.
  - Fix: Check which interface is the source of NAT traffic. The inside global usually belongs to the outside interface or a dedicated pool of public addresses, not the inside LAN interface.
- **Mistake:** Assuming that inside global always stays the same for a given host.
  - Why it is wrong: In dynamic NAT, the inside global can change each time a host initiates a new connection, depending on the pool availability. Only static NAT gives a permanently mapped inside global.
  - Fix: Distinguish dynamic vs static NAT. Dynamic: the inside global is assigned on demand and released. Static: the mapping is fixed in the configuration.
- **Mistake:** Forgetting that inside global is what the external server sees, not the actual host address.
  - Why it is wrong: When analyzing packet captures or firewall logs, many beginners look at the source IP and think it is the real host address. But if NAT is in use, the source IP shown on the internet side is the inside global, not the inside local.
  - Fix: Always consider the location of the packet. On the external link, the source IP is the inside global. The real host never directly appears in internet-facing traffic.

## Exam trap

{"trap":"The exam gives you a network diagram with a host (192.168.1.10), a router with inside interface 192.168.1.1 and outside interface 203.0.113.1. It says: 'What is the inside global of the host?' Many learners pick 192.168.1.1 (the router's inside interface) or 192.168.1.10 (the host itself).","why_learners_choose_it":"They see 'inside' in the phrase 'inside global' and think it refers to something on the inside network. They also confuse the router's gateway address with the translated address. Some learners mistakenly believe that NAT changes the router's interface address rather than acting as a source translation for the host.","how_to_avoid_it":"Remember that 'inside global' means the public address that represents the inside host. In the diagram, the router's outside interface (203.0.113.1) is the address that appears in the translation table as the source after NAT. That is the inside global. Train yourself to look at the interface that connects to the internet, and understand that NAT borrows that address (or another pool address) to represent internal hosts."}

## Commonly confused with

- **Inside global vs Inside local:** Inside local is the private IP address of the host within the internal network. Inside global is the public IP address that represents that host to the outside world. The inside local never leaves the local network, while the inside global appears in packets sent to the internet. (Example: A laptop at home has a private IP like 192.168.1.5 (inside local). When it visits a website, the router changes that to your home's public IP like 71.12.34.56 (inside global).)
- **Inside global vs Outside global:** Outside global is the IP address of an external host (like a web server) as it appears from the internet. It is simply the actual public IP of that server. Inside global, on the other hand, is the translated public address of an internal host. One is the real address of an outside device; the other is the translated address of an inside device. (Example: When you browse google.com, the Google server's IP (e.g., 142.250.80.14) is the outside global. Your home router's public IP (e.g., 71.12.34.56) is the inside global for your laptop.)
- **Inside global vs Outside local:** Outside local is the IP address of an external host as it appears from the internal network, often after being translated by NAT. Inside global is the translated address of your internal host as seen from outside. They are opposite sides of the same translation process. (Example: If your company uses NAT to map a public server IP to a private address, the private address seen inside your network is the outside local. Your own internal hosts' translated public addresses are inside global.)
- **Inside global vs Public IP address:** A public IP address is any globally unique IP that can be routed on the internet. Inside global is a specific kind of public IP address that is used to represent an internal host after NAT translation. While all inside global addresses are public IPs, not all public IPs are inside globals, a public IP could belong to a server on the internet, which is an outside global. (Example: The IP 8.8.8.8 is a public IP used by Google's DNS server (outside global). A home router's public IP used for NAT is an inside global for the home network.)

## Step-by-step breakdown

1. **Host sends packet** — A computer on the internal network with private IP 192.168.1.10 wants to reach a web server at 203.0.113.5. It creates a packet with source IP 192.168.1.10, source port 12345, destination IP 203.0.113.5, and destination port 80. The packet is sent to the default gateway (the router).
2. **Router receives on inside interface** — The router receives the packet on its LAN interface (e.g., GigabitEthernet0/0) which has IP 192.168.1.1. The router checks its routing table and then looks at its NAT configuration to see if this traffic should be translated. Because an access list permits traffic from 192.168.1.0/24, the router decides to apply NAT.
3. **NAT translation lookup and creation** — The router checks the NAT translation table for an existing entry for (192.168.1.10, port 12345). If none exists, it creates a new translation entry. It selects an inside global address from the configured pool (or the outside interface IP) and assigns a unique port number for the translation. For example, it selects inside global 72.14.200.50 and port 1025.
4. **Packet translation and forwarding** — The router changes the packet's source IP from 192.168.1.10 to 72.14.200.50 and the source port from 12345 to 1025. It recalculates the IP checksum. Then it forwards the modified packet out the outside interface (e.g., Serial0/0/0) towards the web server at 203.0.113.5.
5. **Server sends response** — The web server receives the packet and sends a response packet with destination IP 72.14.200.50 and destination port 1025. The response is routed back to the router's outside interface.
6. **Router receives response and reverses translation** — The router receives the response on its outside interface. It looks up the destination IP and port (72.14.200.50:1025) in the NAT translation table and finds the matching entry that maps back to inside local 192.168.1.10:12345. The router changes the packet's destination IP back to 192.168.1.10 and destination port back to 12345.
7. **Packet delivered to original host** — The router forwards the translated response out its inside interface to the original host. The host sees the packet as if it came from the web server directly, without knowing that any translation occurred. The connection continues with subsequent packets going through the same process.

## Practical mini-lesson

Inside global is a term that you must be able to identify in network diagrams, configuration files, and command output. In real-world practice, when you log into a Cisco router and type show ip nat translations, you see a table with Inside Local, Inside Global, Outside Local, and Outside Global columns. The Inside Global column shows the public IP that your internal host is using at that moment. Here is how professionals use that information: 

 First, monitoring the Inside Global column tells you which public IPs from your pool are currently in use. If you see that all available inside global addresses are consumed, new internal hosts cannot access the internet until some connections timeout. You might need to increase the pool size or switch to PAT to share a single inside global. Second, when troubleshooting a specific user's internet issue, you can verify that their private IP appears in the Inside Local column and that a corresponding Inside Global is present. If not, the traffic is not matching your NAT rule. 

 Configuration context: On a Cisco router, the commands to set up dynamic NAT with a pool include: ip nat pool MYPOOL 203.0.113.10 203.0.113.20 netmask 255.255.255.240 to define a pool of inside global addresses, access-list 1 permit 192.168.1.0 0.0.0.255 to match inside local traffic, and ip nat inside source list 1 pool MYPOOL to tie them together. For PAT overload, you would add the keyword "overload" at the end. For static NAT, you use ip nat inside source static 192.168.1.10 203.0.113.10, which permanently maps that inside local to that inside global. 

 What can go wrong? A common issue is that the inside global pool overlaps with other network segments, causing routing problems. Another issue is that the inside global addresses are not routable from the internet due to ISP filtering. Also, if you use the outside interface IP as the inside global for PAT, ensure that interface has a public IP and is not blocked by an ISP ACL. Some applications embed the inside local IP in the data payload (like FTP in active mode), causing the connection to fail because the outside server tries to connect back to a private address. This requires an application-level gateway (ALG) on the router. 

 As a professional, you should also be familiar with the concept of hairpinning when an internal host tries to reach another internal host using the inside global address. This can cause traffic to go out to the internet and back, which may be inefficient. Some routers allow NAT hairpinning, but it is not default. 

inside global is not just a test term-it is the address that your entire network wears when stepping onto the public internet. Knowing how to configure, verify, and troubleshoot it is a practical skill that every network administrator uses daily.

## Memory tip

'Inside Global = Goes Out', think of the G in Global as the address that goes out to the internet.

## FAQ

**Can one inside local have multiple inside global addresses?**

Typically no. An inside local is mapped to a specific inside global for a given session. However, a host can have different inside global addresses for different connections if the pool has multiple addresses and the router assigns them per session (though this is uncommon).

**Is the inside global always the same as the router's WAN IP?**

Not necessarily. In many home networks, the router's WAN IP is used as the inside global for PAT, but in enterprise networks, a pool of separate public IPs might be used for NAT, which are different from the router's interface IP.

**What happens if the inside global pool is exhausted?**

If all inside global addresses are in use and PAT is not configured, new connection attempts from internal hosts will fail. The router will drop the packets, and the user will see a timeout or connection error.

**How do I find the inside global address in a show command?**

Use show ip nat translations. The second column (Inside Global) shows the translated public IP for each inside local. You can also use show ip nat statistics to see pool utilization.

**Does inside global change for each connection with dynamic NAT?**

With dynamic NAT (not PAT), the same inside global might be reused for the same inside local for the duration of the session, but different sessions could use different inside globals from the pool. With PAT, each connection from the same host gets the same inside global but a different port number.

**What is the difference between inside global and outside global in a packet capture?**

Inside global is the source IP of packets leaving your network from an internal host. Outside global is the destination IP of those packets (the external server). In the return traffic, inside global becomes the destination IP of packets coming back to your network.

**Can inside global be a private IP address?**

No. By definition, inside global must be a publicly routable IP address that is globally unique. Using a private IP as inside global would not work because the internet routers would drop the packets.

## Summary

Inside global is the public-facing IP address that represents a private internal host when it communicates over the internet through NAT. It is the address that external servers see in the source IP field of packets coming from inside your network. Understanding this term is crucial for configuring, verifying, and troubleshooting NAT on routers and firewalls. It directly impacts internet connectivity, IP address conservation, and network security by hiding internal addressing schemes. 

 For IT certification exams, especially Cisco CCNA and CompTIA Network+, you must be able to identify inside global in network diagrams and configuration outputs, distinguish it from inside local, and know how to configure both dynamic and static NAT. Common exam traps include confusing inside global with the router's LAN interface IP or with the host's private IP. A strong grasp of this concept will help you answer definition questions, simulation labs, and multi-step troubleshooting scenarios. 

 In practice, inside global is the tool that allows an entire organization to connect to the internet using a handful of public IPs. As networks grow and IPv4 addresses remain scarce, the proper use of inside global addresses through PAT becomes even more important. Mastering this term is not just about passing an exam-it is about understanding a foundational element of how the internet works today.

---

Practice questions and the full interactive page: https://courseiva.com/glossary/inside-global