# Inside local

> Source: Courseiva IT Certification Glossary — https://courseiva.com/glossary/inside-local

## Quick definition

When a device inside your home or office network wants to reach the internet, it has a private IP address (like 192.168.1.10). That address is called the "inside local" address. It is the real address of the device on your local network. The router then translates this address to a public one when sending traffic out to the internet.

## Simple meaning

Imagine your home has a mailbox on the street, but every person in the house has their own name for getting mail inside. When a package arrives from outside, the postal service sees only the street address, but inside the house, each person’s name is used to deliver the package to the right room. In networking, the "inside local" address is like the name or room number inside the house. It is the private IP address that a device on your local network uses to communicate with other devices on the same local network. This address is not routable on the public internet because it is reserved for internal use only. Think of it as the device's "home name" that only works within the building. When that device needs to send data to the internet, the router (like a doorman) translates that inside local address into a public IP address that works on the global internet. This process is called Network Address Translation, or NAT. The inside local address remains hidden from the outside world, keeping your internal network structure private. It helps conserve public IP addresses because many devices can share one public IP address by using different inside local addresses. In a typical home network, your laptop might have an inside local address like 192.168.1.5, while your phone has 192.168.1.6. These addresses are only meaningful within your local network and are translated by the router to a single public IP when going online. Understanding inside local addresses is crucial for network troubleshooting, configuring firewalls, and setting up NAT rules. It is one of the fundamental concepts in IP networking and is tested on many IT certification exams like CompTIA Network+ and Cisco CCNA.

## Technical definition

Inside local is a term used in the context of Network Address Translation (NAT) to describe the IP address of a host as it exists on the inside (private) network before any translation occurs. In NAT terminology, the network is divided into an inside network (the private network under the control of the organization) and an outside network (the public internet). The "inside local" address is the IP address assigned to a device on the inside network, typically from a private IP address range defined by RFC 1918: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. These addresses are non-routable on the public internet and must be translated by a NAT-enabled router or firewall before traffic can reach external destinations. The counterpart to inside local is "inside global," which is the public IP address that the inside local address is translated to when packets exit the NAT device. "outside local" and "outside global" refer to the addresses of external hosts as seen from inside and outside the network, respectively. In Cisco IOS and other networking platforms, NAT configuration involves defining access lists that identify which inside local addresses should be translated and defining a pool of inside global addresses or a single overloaded interface address. The operation of NAT with inside local addresses is typically either static (one-to-one mapping) or dynamic (many-to-one using Port Address Translation, PAT). When a packet originates from an inside local address, the router checks its NAT table. If a translation entry exists, it replaces the source IP address (and possibly the source port) with the inside global address, updates the checksum, and forwards the packet. On the return path, the router uses the NAT table to reverse the translation, delivering packets to the correct inside local host. This mechanism is transparent to end devices; they do not need to know about the translation. However, certain applications that embed IP addresses in the payload (e.g., FTP, SIP) can break NAT and require Application Layer Gateway (ALG) support. The inside local concept is essential for understanding IPv4 address conservation, network security (by hiding internal structure), and multi-homed network configurations. Modern exam objectives for certifications like Cisco CCNA (200-301), CompTIA Network+ (N10-008), and Juniper JNCIA-Junos include detailed NAT concepts, with inside local being a foundational element of those objectives.

## Real-life example

Think of a large apartment building with a single street address, say 123 Main Street. Each apartment has its own unit number, like Apartment 1A, 2B, and 3C. The street address is public and known to the outside world, but the unit numbers are private and only used inside the building. In this analogy, the outside global address is the street address 123 Main Street, which is visible to the public. The inside local address is the unit number, like Apartment 2B, which is used within the building to identify a specific apartment. When a delivery person arrives with a package for someone in Apartment 2B, the package is addressed to 123 Main Street, Apartment 2B. The building's front desk acts like a NAT router. It receives the package (incoming packet) and checks its records to know that Apartment 2B is on the second floor. The front desk then delivers the package to the correct unit. Similarly, when a resident in Apartment 2B sends a package out, they write their return address as "Apartment 2B, 123 Main Street." The front desk changes the return address to only "123 Main Street" before sending it out, hiding the specific unit number from the outside. This allows many apartments (inside local addresses) to share the same street address (inside global address). It also provides privacy and security because outsiders do not know exactly which unit is sending or receiving packages. If an outsider tries to send a package directly to "Apartment 5D" without the street address, the package will never arrive because that address is not meaningful outside the building. This is exactly how private IP addresses work: they are only valid inside the local network and must be translated by the router to a public address for internet communication.

## Why it matters

Understanding inside local addresses is critical for any IT professional managing networks, because it directly impacts how devices communicate with the internet and how networks are secured. When you configure a router or firewall, you must know which addresses are inside (private) and which are outside (public) to set up NAT rules correctly. Misidentifying an inside local address can lead to traffic not being translated, causing connectivity failures or security breaches. For example, if you accidentally treat a public IP as an inside local address, the router may try to translate it when it should not, breaking communication for that host. Inside local addresses also play a role in troubleshooting: when a user cannot access the internet, checking the inside local address configuration on the router is a first step. Inside local addresses are invisible from the outside, which provides a layer of security by obscuring the internal network structure. This makes it harder for attackers to target specific devices because they do not know the private IP scheme. In enterprise environments, inside local addresses are used with VPNs, where traffic destined for the corporate network must be correctly identified and routed. Professionals working with Cisco, Juniper, or Palo Alto firewalls need to understand the difference between inside local, inside global, outside local, and outside global addresses to configure advanced features like policy-based NAT, NAT exemption, and port forwarding. Without this knowledge, network designs can become inefficient or insecure. The inside local concept is not just academic; it is a practical tool used daily in network design, configuration, and troubleshooting.

## Why it matters in exams

Inside local is a core concept in several major IT certification exams, particularly those focusing on networking fundamentals and Cisco routing and switching. For the Cisco CCNA 200-301 exam, NAT is listed under Domain 5 (Network Access) and includes topics like static NAT, dynamic NAT, and PAT. Within these topics, the terms inside local, inside global, outside local, and outside global are explicitly tested. Exam questions may ask you to identify which address is the inside local in a given topology, or to configure NAT on a router and then verify the translation using show commands like 'show ip nat translations'. The CompTIA Network+ exam (N10-008) covers NAT under Objective 1.5 (Explain common ports and protocols, their application, and encrypted alternatives) and Objective 1.8 (Given a scenario, configure a basic network). While Network+ does not go as deep as CCNA into NAT terminology, candidates are expected to understand private vs. public addresses and the basic operation of NAT, including the concept of inside local addresses. For the Juniper JNCIA-Junos exam, NAT is part of the Routing Fundamentals section, and candidates must understand how to configure source NAT, which directly involves inside local addresses. In all these exams, you might see scenario-based questions where you are given a diagram with IP addresses and asked to identify the inside local address. For example, a router with interface fa0/0 inside (192.168.1.0/24) and interface serial0/0/0 outside (public IP). A host with IP 192.168.1.10 sends traffic; the inside local address is 192.168.1.10. Multiple-choice questions often list four IP addresses and ask which is the inside local. Also, troubleshooting questions may describe a connectivity issue where the router's NAT translation table shows an incorrect mapping, and the candidate must correct the inside local address entry. In the Microsoft Azure or AWS certification exams (like AZ-104 or AWS Certified Solutions Architect), although the term "inside local" is not used directly, the same concept applies when configuring NAT gateways or instance private IP addresses. Understanding inside local helps you grasp how cloud NAT services map private IPs to public IPs for outbound traffic. Therefore, mastering this term is not just about passing one exam, but about building a foundation that helps across multiple certification paths.

## How it appears in exam questions

In certification exams, questions about inside local addresses come in several common patterns. The first is direct definition questions: 'Which of the following best describes an inside local IP address?' You might be given four choices, and the correct answer describes the private IP address of a host on the internal network before NAT. A second pattern is scenario-based identification questions. For example: 'An administrator configures NAT on Router R1. The inside interface is Gi0/0 with IP 192.168.1.1, and the outside interface is Serial0/0/0 with IP 203.0.113.1. A host with IP 192.168.1.10 sends a packet to a web server at 8.8.8.8. What is the inside local address?' The correct answer is 192.168.1.10. A third pattern is configuration-based questions. You might be shown a partial configuration snippet: 'ip nat inside source list 1 interface Serial0/0/0 overload' and then asked: 'What does the 'inside source' keyword refer to?' The answer relates to the translation of inside local addresses to the IP of the Serial interface. Another common question type is troubleshooting: 'A user at 192.168.1.10 cannot browse the internet. The administrator runs 'show ip nat translations' and sees no translations. What is the most likely cause?' The answer could be that the inside interface has not been configured with the 'ip nat inside' command, so the router does not recognize the inside local addresses. Also, you may see compare-and-contrast questions: 'What is the difference between an inside local address and an inside global address?' where you need to explain that inside local is private before translation, and inside global is public after translation. Finally, in more advanced exams like CCNP ENCOR, you might see questions about NAT64, where the inside local address could be IPv4 or IPv6, and you must identify which addresses are being translated. In all these patterns, the key is to remember that inside local is always the original private IP of the internal host, seen from the inside network perspective.

## Example scenario

You are a network technician for a small company. The company has a router with two interfaces: one connected to the internal switch (Gi0/0) with IP 10.0.0.1, and one connected to the internet (Gi0/1) with public IP 200.1.1.1. Inside the office, there are 20 computers. Each computer has an IP address from the 10.0.0.0/24 range, for example, 10.0.0.10 for user Alice's PC. This IP address (10.0.0.10) is the inside local address for Alice's PC. When Alice opens a web browser and goes to google.com, her PC creates a packet with source IP 10.0.0.10 and destination IP 8.8.8.8 (for DNS) or the IP of Google's server. The packet travels to the router. The router looks at the packet and sees that the source IP is from the inside local network. It checks its NAT configuration and translates the source IP from 10.0.0.10 to the public IP of the router's outside interface (200.1.1.1), and also changes the source port to a unique high-numbered port. The router then sends the packet out to the internet. The web server at Google sees the packet coming from 200.1.1.1 and sends the response back to that address. When the router receives the response, it looks up its NAT table to find which inside local address (10.0.0.10) and port were mapped, and forwards the packet to Alice's PC. If Alice's PC had IP 10.0.0.10, that is the inside local address. If you were to run the command 'show ip nat translations' on the router, you would see an entry like: Pro Inside global Inside local Outside local Outside global tcp 200.1.1.1:34567 10.0.0.10:12345 8.8.8.8:53 8.8.8.8:53. In this entry, the inside local address is clearly 10.0.0.10. This example shows how inside local addresses are used in a real configuration and how they are tracked by the router.

## Common mistakes

- **Mistake:** Confusing inside local with inside global.
  - Why it is wrong: Inside local is the private IP before translation; inside global is the public IP after translation. Using the wrong term can confuse configuration and troubleshooting.
  - Fix: Always remember that 'local' means 'our side' (private), and 'global' means 'the internet side' (public). Inside local = original private IP of host.
- **Mistake:** Thinking that inside local addresses are routable on the internet.
  - Why it is wrong: Private IP addresses (RFC 1918) are non-routable on the public internet. They must be translated by NAT. Sending a packet with an inside local address directly to the internet would fail.
  - Fix: Understand that inside local addresses are only valid within the LAN. They cannot be used as source IPs on the internet without translation.
- **Mistake:** Assuming the inside local address is the same as the gateway IP.
  - Why it is wrong: The inside local address belongs to the host (e.g., PC), not the router. The gateway IP is the router's inside interface address, which is different from the host's IP.
  - Fix: Remember: inside local = host IP (like 192.168.1.10), gateway = router IP (like 192.168.1.1). They are different addresses.
- **Mistake:** Misidentifying the inside interface in a configuration.
  - Why it is wrong: Configuring 'ip nat inside' on the wrong interface can cause translation not to occur, or to translate the wrong traffic.
  - Fix: The inside interface is the one connected to the LAN where inside local hosts reside. Always verify the interface IP before applying the 'ip nat inside' command.
- **Mistake:** Forgetting that NAT also applies to return traffic, so the inside local address is the destination of return packets.
  - Why it is wrong: When the router receives a response from the internet, it translates the destination IP back to the correct inside local address. If the NAT entry is missing, the packet is dropped.
  - Fix: Always check the NAT table using 'show ip nat translations' to confirm that a translation entry exists for the session.

## Exam trap

{"trap":"An exam question may show a diagram with a router and two hosts: one with IP 10.0.0.10 and another with IP 192.168.1.20. The router's inside interface is GigabitEthernet0/0 with IP 10.0.0.1, and the outside interface is Serial0/0/0 with IP 203.0.113.1. The question asks: 'What is the inside local address of the host connected to the router?' The trap is that the diagram might show both hosts on different subnets, but only one is directly connected to the router's inside interface. Learners might pick the wrong host's IP.","why_learners_choose_it":"Learners often assume that any private IP address in the diagram is an inside local address, without considering that 'inside local' refers specifically to the host's IP as seen from the inside network. They might pick 192.168.1.20 even though that host might be on a different network segment not directly attached to the router's inside interface.","how_to_avoid_it":"Always look at which interfaces are configured as 'ip nat inside'. The inside local address is the IP of the host that is sending traffic through that inside interface. If a host is not reachable via the inside interface, its address is not considered an inside local address for that router's NAT. In the example, only the host on the 10.0.0.0/24 network (connected to Gig0/0) is using that router for NAT, so its address is the correct inside local. The other host might be using a different router."}

## Commonly confused with

- **Inside local vs Inside global:** Inside global is the public IP address that the private inside local address is translated to. While inside local is the original private address of the internal host, inside global is the address that the internet sees. For example, if a host with inside local 192.168.1.10 is translated to public IP 203.0.113.5, the inside global is 203.0.113.5. (Example: In a NAT entry, 'Inside global: 203.0.113.5:1234' and 'Inside local: 192.168.1.10:5678', the inside global is what the web server sees.)
- **Inside local vs Outside local:** Outside local is the IP address of an external host as it appears from the inside network perspective. This can be the actual public IP of the external host or a translated version. Outside local is different from inside local because inside local refers to internal hosts, while outside local refers to external hosts as seen from inside. (Example: If you ping 8.8.8.8 from a PC, the outside local address is typically 8.8.8.8. But if the router translates the destination, the outside local could be a different IP.)
- **Inside local vs Private IP address:** A private IP address is an IP address from a reserved range (RFC 1918) that is used within a private network. Inside local is a special case: it is a private IP address of a host on the local network, but only in the context of NAT. So all inside local addresses are private IP addresses, but not all private IP addresses are necessarily 'inside local' (they could be on a network that does not use NAT). (Example: A private IP like 10.0.0.10 is inside local only if it is defined as a source for NAT translation on a router. If the network uses no NAT, it is simply a private IP.)
- **Inside local vs Inside host:** Inside host is a general term referring to any device on the internal network. Inside local is specifically the IP address of that host before NAT. The host itself is physical; its address is logical. (Example: The PC with IP 192.168.1.10 is an inside host. Its inside local address is 192.168.1.10.)

## Step-by-step breakdown

1. **Device sends packet** — A host on the inside network (e.g., a PC with IP 192.168.1.10) creates a packet destined for an external server (e.g., 8.8.8.8). The source IP in the packet is the host's inside local address.
2. **Packet arrives at router on inside interface** — The packet reaches the router's interface that is configured with 'ip nat inside'. The router identifies that the source IP (192.168.1.10) is from the inside network and must be considered for translation.
3. **Router checks NAT configuration** — The router examines its NAT rule set. Typically, an access list or route map defines which inside local addresses are eligible for translation. If the source IP matches, the router proceeds with translation.
4. **Router translates source IP and port** — The router replaces the source IP (inside local) with the inside global address (e.g., public IP 203.0.113.1) and assigns a unique source port (for overload/PAT). This creates a new entry in the NAT translation table.
5. **Router forwards packet to the internet** — The translated packet is sent out the outside interface (configured with 'ip nat outside'). The public internet sees the source IP as the inside global address, not the original inside local address.
6. **Response packet arrives at router** — The external server sends a response back to the inside global address. When the router receives it on the outside interface, it looks up the destination IP and port in its NAT translation table.
7. **Router reverses the translation** — The router finds the matching entry and replaces the destination IP with the original inside local address (192.168.1.10) and port. It then forwards the packet to the correct host on the inside network.

## Practical mini-lesson

In a real-world network configuration, understanding inside local addresses is critical when setting up NAT on a router or firewall. Let's walk through a practical scenario. You are configuring a Cisco router that connects a small business network (192.168.1.0/24) to the internet via a single public IP (209.165.200.225/30). You need to allow all 50 hosts to access the internet. First, you must configure the interfaces: 'interface GigabitEthernet0/0' with 'ip address 192.168.1.1 255.255.255.0' and 'ip nat inside'. Then 'interface Serial0/0/0' with 'ip address 209.165.200.226 255.255.255.252' and 'ip nat outside'. Next, you create an access list that defines which inside local addresses will be translated: 'access-list 1 permit 192.168.1.0 0.0.0.255'. Then you enable NAT: 'ip nat inside source list 1 interface Serial0/0/0 overload'. The keyword 'overload' enables PAT, allowing all inside local addresses to share the single public IP. After configuration, you should verify the NAT operation. Use 'show ip nat translations' to see active translations. You will see entries like 'Pro Inside global Inside local Outside local Outside global', the 'Inside local' column shows the private IP of each host. If a host is not working, you can check this table: if there is no translation entry, the problem might be that the inside interface is not correctly configured, or the host's IP is not in the access list. You can use 'debug ip nat' to see translations in real time. A common issue is that the access list might be missing a subnet. For example, if you wrote 'access-list 1 permit 192.168.1.0 0.0.0.255', but a host has IP 192.168.2.10 (from a different subnet), that host will not be translated. You would fix this by modifying the access list. Another practical point: some applications (like FTP or VoIP) embed IP addresses in the payload. For these, the router might need an Application Layer Gateway (ALG) to properly translate inside local addresses inside the packet payload. Without ALG, the application may fail. As a professional, you also need to consider NAT for redundancy: if you have two public IPs, you might use a pool of inside global addresses and map them to inside local addresses dynamically. Inside local addresses are also relevant when setting up port forwarding. For example, to allow external access to a web server at inside local 192.168.1.100, you would configure 'ip nat inside source static tcp 192.168.1.100 80 interface Serial0/0/0 80'. This maps the public IP's port 80 to the inside local address 192.168.1.100 port 80. Understanding inside local addresses helps you troubleshoot such static entries. Finally, always document the mapping of inside local addresses to hosts. In a dynamic environment, the internal IPs may change if DHCP is used. To ensure consistent NAT behavior, you might use DHCP reservations to keep the inside local addresses stable, or use NAT rules based on MAC addresses. This practical knowledge separates a novice from an experienced network administrator.

## Memory tip

Think: 'Inside Local = Internal Laptop's Original IP', where 'L' stands for Local and 'O' for Original.

## FAQ

**Can an inside local address be a public IP address?**

In theory, yes, if your internal network uses public IP addresses (e.g., if you have a block of public IPs assigned internally). In that case, the inside local address could be a public IP, but then you would typically not use NAT for those addresses. In most exam scenarios, inside local addresses are private.

**What happens if two hosts have the same inside local address?**

IP addresses must be unique on a local network; otherwise, there would be an IP conflict. NAT will not function correctly if duplicate inside local addresses exist, as the router cannot distinguish between the two hosts.

**Do I need to configure inside local addresses manually?**

No, you configure the router to recognize certain interfaces as 'inside' and define which IP ranges are allowed. The inside local addresses are the actual IPs of the hosts, which are typically assigned by DHCP or static configuration.

**Is the inside local address the same as the private IP address?**

In common scenarios, yes. The inside local address is almost always a private IP address from RFC 1918 ranges. However, the term 'inside local' is strictly defined only in the context of NAT, while 'private IP address' is a broader category.

**How can I see the inside local addresses a router has translated?**

On a Cisco router, use the command 'show ip nat translations'. The output will display a table with columns for Inside global, Inside local, Outside local, and Outside global. The Inside local column shows the internal host's IP.

**Does inside local apply to IPv6?**

Yes, NAT can also be used with IPv6, though it is less common. IPv6 NAT (NAT66) uses the same terminology: inside local refers to the original IPv6 address of a host on the internal network before translation.

## Summary

Inside local is a fundamental NAT term that refers to the original private IP address of a device on the internal network before it undergoes Network Address Translation. Understanding this concept is essential for configuring and troubleshooting NAT on routers and firewalls, as it underpins how private IPs are mapped to public IPs for internet connectivity. The distinction between inside local, inside global, outside local, and outside global is a critical part of any networking curriculum, and it appears frequently on certification exams such as CompTIA Network+, Cisco CCNA, and Juniper JNCIA. By mastering inside local, you not only prepare for exam questions that ask you to identify or configure these addresses, but you also build a practical skill that helps you design secure, scalable networks. Remember the simple memory hook: Inside Local = Original Private IP. When you see a NAT table, focus on the 'Inside local' column to see which internal hosts are using NAT. Always ensure that your inside interface is correctly configured with 'ip nat inside' and that your access list includes the correct private IP range. Avoid the common mistakes of confusing inside local with inside global or with the gateway IP. With this knowledge, you can confidently approach NAT-related exam questions and real-world network scenarios.

---

Practice questions and the full interactive page: https://courseiva.com/glossary/inside-local