Network Address Translation (NAT)
Also known as: nat, network address translation
Network Address Translation is a router function that rewrites IP addresses in packet headers as traffic passes between networks. It lets many devices with private IP addresses share a smaller number of public addresses when reaching the internet.
NAT exists because IPv4 provides only about 4.3 billion addresses, far fewer than the number of connected devices. Organizations assign private addresses from the RFC 1918 ranges — 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 — which are not routable on the public internet. A NAT-enabled router rewrites the source address of outbound packets to a public address, tracks the translation in a table, and reverses the substitution on the return traffic so replies reach the correct internal host.
Cisco terminology defines four address types that exam questions rely on. Inside local is the private address of an internal host as it sees itself. Inside global is the public address that host appears as on the internet. Outside local and outside global describe the external host's address as seen from inside and outside the network respectively. Getting these straight is usually the hardest part of the topic.
Three configurations cover most deployments. Static NAT maps one private address permanently to one public address, which is how an internal web or mail server is published to the internet. Dynamic NAT draws public addresses from a pool as hosts need them, releasing each mapping when the session ends — if the pool is exhausted, additional hosts cannot connect. Port Address Translation (PAT), also called NAT overload, is by far the most common: it maps many private addresses to a single public address by assigning each session a unique source port number, so one public address can support thousands of concurrent connections.
NAT conserves address space and incidentally hides the internal topology, though it is not a substitute for a firewall and it complicates protocols that embed IP addresses in their payloads or require inbound connections. IPv6's enormous address space removes the original need for NAT. The CCNA exam covers NAT under network services, expecting you to identify the four address types, distinguish static NAT from dynamic NAT and PAT, and interpret configuration and translation-table output.
Key takeaways
- NAT rewrites IP addresses in packet headers so private addresses can reach the public internet.
- Private ranges 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 are not routable on the internet.
- Cisco defines inside local, inside global, outside local, and outside global addresses.
- Static NAT is one-to-one, dynamic NAT uses a pool, and PAT overloads one public address using port numbers.
- The CCNA tests NAT under network services, including translation-table interpretation and the four address types.