Cisco IOS NAT: Static NAT, PAT Overload and Port Forward

Almost every branch router runs some form of NAT: PAT overload to let a whole LAN share one public IP, static NAT so inbound traffic reaches an internal server, or port forwarding to expose different services behind a single address. The Cisco IOS model is simple once you internalize it - mark your interfaces ip nat inside and ip nat outside, then declare translations between them. This guide covers the three NAT flavors you will actually use, with a complete working configuration and verification commands.

Step 1: Mark Inside and Outside Interfaces

R1(config)# interface gigabitEthernet 0/0
R1(config-if)# ip address 50.50.50.1 255.255.255.0
R1(config-if)# ip nat outside
R1(config-if)# exit
R1(config)# interface gigabitEthernet 0/1
R1(config-if)# ip address 192.168.1.1 255.255.255.0
R1(config-if)# ip nat inside

Step 2: PAT Overload for Outbound Internet Access

An access-list selects the inside networks, and overload multiplexes them onto the outside interface IP using TCP/UDP ports:

R1(config)# access-list 1 permit 192.168.1.0 0.0.0.255
R1(config)# ip nat inside source list 1 interface GigabitEthernet0/0 overload

Step 3: Static NAT (One-to-One)

Permanent one-to-one mapping for a server that must be reachable from outside:

R1(config)# ip nat inside source static 192.168.1.10 203.0.113.10

Step 4: Port Forwarding (Static PAT)

Map specific TCP/UDP ports on the public IP to internal servers - several services can share one public address this way:

! Web server reachable on the outside IP, port 80
R1(config)# ip nat inside source static tcp 192.168.1.10 80 50.50.50.1 80
! Redirect outside port 8080 to internal port 80 of another server
R1(config)# ip nat inside source static tcp 192.168.1.11 80 50.50.50.1 8080
! DNS: UDP 53 to the internal DNS server
R1(config)# ip nat inside source static udp 192.168.1.12 53 50.50.50.1 53
! SSH on an alternate port
R1(config)# ip nat inside source static tcp 192.168.1.10 22 50.50.50.1 2222

Static entries always take precedence over PAT/dynamic translations, so a server with a static mapping is unaffected by the overload rule. Note that PAT only supports protocols with port numbers (TCP/UDP/ICMP) - other protocols consume a whole pool address.

Verification Commands

R1# show ip nat translations
R1# show ip nat statistics
R1# debug ip nat detailed    # then: term mon

Related Guides on This Site

NAT usually shares the router with other services: see Cisco ASA CLI basics including NAT for the firewall version, IOS VRF-Lite for segmented routing contexts, and IOS DHCP server for handing out addresses on the inside.

原文链接：https://www.networkstraining.com/configuring-nat-on-cisco-routers/