CCNA Network Services and Security Practice Question
Exhibit
interface GigabitEthernet0/0 ip address 192.168.10.1 255.255.255.0 ip nat outside ! interface GigabitEthernet0/1 ip address 203.0.113.10 255.255.255.252 ip nat inside ! access-list 1 permit 192.168.10.0 0.0.0.255 ip nat inside source list 1 interface GigabitEthernet0/1 overload
Refer to the exhibit. Users on the inside network can browse the web, but return traffic is failing for some sessions. A partial configuration shows:
interface GigabitEthernet0/0 ip address 192.168.10.1 255.255.255.0 ip nat outside
!
interface GigabitEthernet0/1 ip address 203.0.113.10 255.255.255.0 ip nat inside
!
ip nat inside source list 1 interface GigabitEthernet0/1 overload access-list 1 permit 192.168.10.0 0.0.0.255
Based on this configuration, which change is required to make PAT work correctly?
⚠ Common exam trap
A frequent exam trap is confusing the NAT inside and outside interface roles. Candidates may see the private IP on an interface and mistakenly assign it as 'ip nat outside' or vice versa. This reverses the translation direction, causing return traffic to fail despite correct ACLs and overload commands. The trap exploits the assumption that the public IP must be inside or that the interface with the ACL is always inside. Understanding that NAT roles depend on network topology, not just IP addresses, is crucial to avoid this error.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Swap the inside and outside NAT roles on the two interfaces.
The problem is that the router has the NAT directions backwards. In simple terms, the interface facing the private LAN should be marked as inside, and the interface facing the public or WAN side should be marked as outside. Here, GigabitEthernet0/0 uses the private address 192.168.10.1, but it is configured as outside. GigabitEthernet0/1 uses the public address 203.0.113.10, but it is configured as inside. That reverses the translation logic and breaks normal PAT behavior. Technically, the command `ip nat inside source list 1 interface GigabitEthernet0/1 overload` is otherwise reasonable for dynamic PAT using the WAN interface address. The ACL also correctly identifies the inside local subnet. The essential fix is to mark G0/0 as `ip nat inside` and G0/1 as `ip nat outside`. Once the directions are corrected, PAT can create and track translations properly for outbound traffic and returning sessions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Apply ip nat enable on both interfaces.
Why it's wrong here
Applying `ip nat enable` is the wrong fix because that command enables NAT Virtual Interface (NVI) processing, not the classic interface-role NAT/PAT used here. In standard Cisco IOS NAT, you must designate each interface with `ip nat inside` or `ip nat outside` so PAT knows which side is private and which is public. Even if `ip nat enable` were accepted, putting it on both interfaces would not correct the reversed inside/outside roles and would leave the overload translation ambiguous.
When this WOULD be correct
In a different scenario, if the question asked about enabling NAT on both interfaces for a basic NAT setup without specifying PAT, then applying 'ip nat enable' on both interfaces would be correct to allow NAT functionality on both sides of the router.
- ✗
Replace overload with pool.
Why it's wrong here
Using a pool is another NAT design option, but it is not required for PAT to work. The current command already uses interface overload, which is valid. The failure is caused by reversed inside and outside roles.
When this WOULD be correct
In a different scenario where the question specifies that a static NAT configuration is required for a specific set of internal hosts to have unique public IP addresses, replacing overload with a pool would be correct. This would indicate that each internal host needs a dedicated public IP rather than sharing one.
- ✓
Swap the inside and outside NAT roles on the two interfaces.
Why this is correct
This is correct because NAT depends on the router knowing which side is private and which side is public. The current configuration labels them the wrong way round. PAT with overload on the WAN interface is fine, but the interface roles must match the traffic direction.
- ✗
Change access-list 1 to a standard ACL numbered 100.
Why it's wrong here
Standard ACL 1 is already valid for identifying inside local addresses. There is no requirement to use ACL 100 for this kind of NAT rule. The bigger issue is that the interfaces are assigned the wrong NAT roles.
When this WOULD be correct
In a different scenario, if the question asked about configuring NAT for a specific set of protocols or services that require a standard ACL to permit traffic, then changing access-list 1 to a standard ACL numbered 100 could be correct if the original ACL was misconfigured or insufficient for the required traffic.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Swap the inside and outside NAT roles on the two interfaces.Correct answer▾
Why this is correct
This is correct because NAT depends on the router knowing which side is private and which side is public. The current configuration labels them the wrong way round. PAT with overload on the WAN interface is fine, but the interface roles must match the traffic direction.
✗Apply ip nat enable on both interfaces.Wrong answer — click to see why▾
Why this is wrong here
Applying 'ip nat enable' on both interfaces does not address the issue of return traffic failing in a Port Address Translation (PAT) setup, as PAT requires specific configurations on the inside and outside interfaces rather than just enabling NAT.
★ When this WOULD be the correct answer
In a different scenario, if the question asked about enabling NAT on both interfaces for a basic NAT setup without specifying PAT, then applying 'ip nat enable' on both interfaces would be correct to allow NAT functionality on both sides of the router.
Why candidates choose this
Candidates may choose this option because they recognize that NAT must be enabled on interfaces for translation to occur, leading them to mistakenly believe that enabling it on both interfaces is a necessary step for any NAT configuration.
✗Replace overload with pool.Wrong answer — click to see why▾
Why this is wrong here
Replacing overload with pool is incorrect because overload is necessary for Port Address Translation (PAT) to allow multiple internal hosts to share a single public IP address. In this scenario, the issue is related to NAT roles, not the type of NAT configuration used.
★ When this WOULD be the correct answer
In a different scenario where the question specifies that a static NAT configuration is required for a specific set of internal hosts to have unique public IP addresses, replacing overload with a pool would be correct. This would indicate that each internal host needs a dedicated public IP rather than sharing one.
Why candidates choose this
Candidates may find this option tempting because they might confuse the need for a pool of addresses with the functionality of PAT, thinking that changing the configuration type could resolve the NAT issues without considering the role assignments.
✗Change access-list 1 to a standard ACL numbered 100.Wrong answer — click to see why▾
Why this is wrong here
Changing access-list 1 to a standard ACL numbered 100 does not address the issue of return traffic failing for sessions using Port Address Translation (PAT). The problem lies in the NAT configuration roles, not in the access control list numbering.
★ When this WOULD be the correct answer
In a different scenario, if the question asked about configuring NAT for a specific set of protocols or services that require a standard ACL to permit traffic, then changing access-list 1 to a standard ACL numbered 100 could be correct if the original ACL was misconfigured or insufficient for the required traffic.
Why candidates choose this
Candidates may be tempted by this option because they understand that access lists are crucial for controlling traffic flow, leading them to believe that modifying the ACL could resolve NAT issues without considering the specific roles of the NAT interfaces.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Configuring AAA with TACACS+ and RADIUS on IOS XE
Key term
PAT
PAT (Port Address Translation) is a method of network address translation that maps multiple private IP addresses to a single public IP address by using different port numbers for each connection.
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.