CCNA NAT interface roles (inside vs outside) Practice Question
Exhibit
interface GigabitEthernet0/0 ip address 192.168.10.1 255.255.255.0 ip nat outside ! interface GigabitEthernet0/1 ip address 203.0.113.10 255.255.255.252 ip nat inside ! access-list 1 permit 192.168.10.0 0.0.0.255 ip nat inside source list 1 interface GigabitEthernet0/1 overload
Based on the exhibit, what is the most likely reason PAT is not working correctly?
⚠ Common exam trap
A common exam trap is confusing the NAT inside and outside interface roles. Candidates might overlook that reversing these roles causes PAT to fail silently, as translation direction depends on correct interface designation. Misunderstanding this can lead to incorrect troubleshooting steps, such as focusing on routing protocols or ACL numbering, which do not impact PAT functionality directly.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The inside and outside NAT interface roles are reversed.
PAT is not working correctly because the inside and outside NAT roles are reversed on the interfaces. In practical terms, the private LAN-facing interface should be marked as inside, and the public-facing WAN interface should be marked as outside. In the exhibit, the router has those roles backwards, so translation logic is applied in the wrong direction. This is a very realistic NAT troubleshooting item because the configuration is close to correct and the failure comes from one directional mistake.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The inside and outside NAT interface roles are reversed.
Why this is correct
For PAT (overload) to translate private addresses to a public IP, the interface facing the internal LAN must be configured as `ip nat inside` and the interface facing the ISP/WAN as `ip nat outside`. If these are reversed, the router attempts to translate traffic entering the public interface and exiting the private interface, so the source addresses of internal users are never translated, breaking PAT. This is the most likely cause given the exhibit shows mismatched interface roles.
- ✗
PAT requires OSPF to be enabled on the WAN link.
Why it's wrong here
PAT operates at Layer 3/4 and only needs the inside and outside interfaces to be correctly identified and the ACL to match traffic. Routing protocols like OSPF are used to exchange routes, not to enable NAT. As long as the router has a route to the destination (e.g., a default static route), PAT will work independently of whether OSPF is running.
When this WOULD be correct
In a different scenario where the question specifies that PAT is being implemented in a network that relies on OSPF for routing updates, and the exam asks about the necessity of OSPF for proper NAT functionality, this option could be correct if the question indicates that OSPF misconfigurations are impacting NAT operations.
- ✗
The ACL must be numbered 100 instead of 1.
Why it's wrong here
Standard ACLs (1-99) and extended ACLs (100-199) are both valid for NAT. The `access-list 1 permit` command simply defines which source addresses are eligible for translation; it does not require a specific number range. In fact, many PAT configurations use a standard ACL numbered 1, so changing to 100 would have no effect on whether PAT is working.
When this WOULD be correct
In a different scenario, if the question specifically states that the router is using a legacy configuration where only numbered ACLs are supported, and that ACL 100 is explicitly required for NAT rules, then this option would be correct.
- ✗
The router must use GRE before PAT can overload.
Why it's wrong here
PAT is a form of NAT that multiplexes many private addresses to one public IP using unique port numbers. GRE is a tunneling protocol used to encapsulate packets (e.g., for VPNs) and is not a prerequisite for NAT/PAT. The router can perform PAT directly on the physical WAN interface without any tunnel.
When this WOULD be correct
In a different scenario where the question specifies that the network is using GRE tunnels for remote site connectivity, and the configuration requires PAT to be applied to traffic traversing these tunnels, then this option could be correct. For example, if the question states that PAT is not functioning due to the absence of GRE encapsulation on the WAN link, this would validate the option.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓The inside and outside NAT interface roles are reversed.Correct answer▾
Why this is correct
For PAT (overload) to translate private addresses to a public IP, the interface facing the internal LAN must be configured as `ip nat inside` and the interface facing the ISP/WAN as `ip nat outside`. If these are reversed, the router attempts to translate traffic entering the public interface and exiting the private interface, so the source addresses of internal users are never translated, breaking PAT. This is the most likely cause given the exhibit shows mismatched interface roles.
✗PAT requires OSPF to be enabled on the WAN link.Wrong answer — click to see why▾
Why this is wrong here
PAT (Port Address Translation) operates at Layer 3/4 and does not require any dynamic routing protocol like OSPF to function. OSPF is used for route exchange, not for NAT operations.
★ When this WOULD be the correct answer
In a different scenario where the question specifies that PAT is being implemented in a network that relies on OSPF for routing updates, and the exam asks about the necessity of OSPF for proper NAT functionality, this option could be correct if the question indicates that OSPF misconfigurations are impacting NAT operations.
Why candidates choose this
Students may think that because the WAN link often runs OSPF for routing, PAT might depend on it, but PAT works independently of the routing protocol used.
✗The ACL must be numbered 100 instead of 1.Wrong answer — click to see why▾
Why this is wrong here
Standard ACLs (numbered 1-99 or 1300-1999) can be used in NAT to identify traffic for translation; they match only source IP addresses. Extended ACLs (100-199) are not required for basic PAT configuration.
★ When this WOULD be the correct answer
In a different scenario, if the question specifically states that the router is using a legacy configuration where only numbered ACLs are supported, and that ACL 100 is explicitly required for NAT rules, then this option would be correct.
Why candidates choose this
Some students confuse the ACL numbering with the requirement for extended ACLs in NAT, but standard ACLs are sufficient when only source IP matching is needed.
✗The router must use GRE before PAT can overload.Wrong answer — click to see why▾
Why this is wrong here
GRE (Generic Routing Encapsulation) is a tunneling protocol used to encapsulate packets for VPNs or routing over non-IP networks. PAT does not require any tunneling; it translates private IP addresses to a public IP using port numbers.
★ When this WOULD be the correct answer
In a different scenario where the question specifies that the network is using GRE tunnels for remote site connectivity, and the configuration requires PAT to be applied to traffic traversing these tunnels, then this option could be correct. For example, if the question states that PAT is not functioning due to the absence of GRE encapsulation on the WAN link, this would validate the option.
Why candidates choose this
Students might associate GRE with NAT because both are used in VPN scenarios, but PAT functions independently and does not rely on GRE.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Device File Management with SFTP and SCP
Key term
Interface
An interface is a point of connection or interaction between two systems, devices, or software components that allows them to exchange information or signals.
Key term
LAN
Local Area Network — a network confined to a single physical location such as an office, building, or campus.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.