12.3 Network Address Translation (NAT/PAT) & VRF-Aware NAT

Key Takeaways

Network Address Translation (NAT) preserves IPv4 address space by translating private RFC 1918 addresses into globally routable public IP addresses, categorized into Inside Local, Inside Global, Outside Local, and Outside Global.
Port Address Translation (PAT / NAT Overload) maps thousands of private Inside Local IP addresses to a single or small pool of Inside Global public IPs by tracking Layer 4 TCP/UDP port multiplexing across unique 5-tuple sessions.
Cisco IOS-XE evaluates NAT in a deterministic order of operations: Inside-to-Outside traffic executes Routing lookups BEFORE Source NAT translation, whereas Outside-to-Inside traffic executes Destination NAT translation BEFORE Routing lookups.
NAT Virtual Interface (NVI) eliminates the rigid architectural requirement for dedicated 'inside' and 'outside' interface tagging by using 'ip nat enable' to route and translate across any active interface.
VRF-Aware NAT isolates address translation tables per Virtual Routing and Forwarding instance, supporting Intra-VRF translations for isolated multi-tenant segments and Inter-VRF translations for shared Internet egress.

Last updated: August 2026

12.3 Network Address Translation (NAT/PAT) & VRF-Aware NAT

Core Blueprint Focus: Cisco 350-401 ENCOR v1.2 topic 3.3.b (configure NAT/PAT) requires candidates to configure and verify Network Address Translation (NAT), including Static NAT, Dynamic NAT, Port Address Translation (PAT / NAT Overload), and VRF-Aware NAT. Candidates must master Cisco four-address terminology, NAT Virtual Interface (NVI) operations, and the strict Cisco IOS-XE NAT order of operations.

IPv4 address depletion necessitated the widespread adoption of RFC 1918 private address spaces (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). Because private IP addresses are non-routable across the public Internet, enterprise edge routers utilize Network Address Translation (NAT) to translate private IPv4 addresses into globally unique, routable public IPv4 addresses at the network boundary.

1. Cisco NAT Terminology & The Four Address Types

Cisco defines NAT address terminology based on two perspectives: Location (Inside vs. Outside) and Perspective (Local vs. Global).

+-----------------------------------------------------------------------------------+
|                             CISCO NAT ADDRESS MODEL                               |
+-----------------------------------------------------------------------------------+
|                                                                                   |
|  <--- INSIDE NETWORK (Private) ---> | <--- OUTSIDE NETWORK (Public Internet) ---> |
|                                     |                                             |
|  [ Internal Host ]                  |                      [ External Web Server ]|
|  10.1.1.50                          |                      203.0.113.100          |
|       |                             |                             |               |
|       v                             v                             v               |
|  +--------------------+   +--------------------+   +--------------------+         |
|  | INSIDE LOCAL (IL)  |   | INSIDE GLOBAL (IG) |   | OUTSIDE GLOBAL (OG)|         |
|  | IP of inside host  |-->| Public IP representing |-->| True public IP of  |      |
|  | as seen from the   |   | inside host to the |   | external server on |         |
|  | inside network.    |   | outside world.     |   | public Internet.   |         |
|  | Example:           |   | Example:           |   | Example:           |         |
|  | 10.1.1.50          |   | 198.51.100.5       |   | 203.0.113.100      |         |
|  +--------------------+   +--------------------+   +--------------------+         |
|                                     |                             |               |
|                                     |      +--------------------+ |               |
|                                     |      | OUTSIDE LOCAL (OL) | |               |
|                                     |      | IP of external host|<+               |
|                                     |      | as seen from the   |                 |
|                                     |      | inside network.    |                 |
|                                     |      | Example:           |                 |
|                                     |      | 203.0.113.100      |                 |
|                                     |      +--------------------+                 |
+-----------------------------------------------------------------------------------+

The Four Address Definitions

Inside Local (IL): The IPv4 address assigned to a host on the inside network. Typically an RFC 1918 private address (e.g., 10.1.1.50).
Inside Global (IG): The legitimate IPv4 address representing one or more Inside Local hosts to the outside world. Allocated by an ISP or Regional Internet Registry (RIR) (e.g., 198.51.100.5).
Outside Local (OL): The IPv4 address of an external host as it is known and referenced by hosts on the inside network. In standard deployments, Outside Local is identical to Outside Global.
Outside Global (OG): The globally routable public IPv4 address assigned to an external host on the public Internet or remote external network (e.g., 203.0.113.100).

2. NAT Operational Flavors: Static, Dynamic & PAT Overload

+-----------------------------------------------------------------------------------+
|                         NAT OPERATIONAL FLAVORS                                   |
+-----------------------------------------------------------------------------------+
| 1. STATIC NAT (1:1 Bidirectional Mapping):                                        |
|    [ Private IP: 10.1.1.10 ] <===================> [ Public IP: 198.51.100.10 ]   |
|    - Used for DMZ Web / Mail / Application Servers.                               |
|                                                                                   |
| 2. DYNAMIC NAT (Many-to-Many Pool Mapping):                                       |
|    [ Host A: 10.1.1.11 ] ---> [ Public Pool: 198.51.100.20-30 ] (Allocates .20)   |
|    [ Host B: 10.1.1.12 ] ---> [ Public Pool: 198.51.100.20-30 ] (Allocates .21)   |
|    - First-come, first-served; drops connections when pool is exhausted.          |
|                                                                                   |
| 3. PORT ADDRESS TRANSLATION (PAT / NAT Overload - N:1 Multiplexing):              |
|    [ Host A: 10.1.1.50:49152 ] --\                                                |
|    [ Host B: 10.1.1.51:49152 ] ---> [ 198.51.100.1:10001 ] ---> Public Internet   |
|    [ Host C: 10.1.1.52:50220 ] --/   [ 198.51.100.1:10002 ]                       |
|    - Multiplexes thousands of hosts onto a single public IP via unique L4 ports.  |
+-----------------------------------------------------------------------------------+

1. Static NAT (One-to-One Translation)

Creates a permanent, fixed bidirectional mapping between a specific Inside Local address and a specific Inside Global address.
Inbound connections initiated from the Internet to the Inside Global IP are automatically translated and forwarded to the Inside Local server.
Syntax: ip nat inside source static 10.1.1.10 198.51.100.10

2. Dynamic NAT (Pool Translation)

Maps unregistered Inside Local addresses to registered Inside Global addresses from a configured pool on a dynamic, first-come, first-served basis.
Translations are temporary and expire after a configurable inactivity timeout.
Limitation: If the pool contains 10 public IP addresses and 11 internal hosts attempt to access the Internet simultaneously, the 11th host is blocked until an active translation expires.
Syntax: ip nat pool POOL_A 198.51.100.20 198.51.100.30 netmask 255.255.255.0 paired with ip nat inside source list ACL_LAN pool POOL_A

3. Port Address Translation (PAT / NAT Overload)

Port Address Translation (PAT), also known as NAT Overload, maps multiple private Inside Local IP addresses to a single public Inside Global IP (or pool) by tracking Layer 4 TCP and UDP port numbers.
When an internal host initiates a session, the router records the 5-tuple: (Protocol, Source IP, Source Port, Destination IP, Destination Port). The router rewrites the private Source IP to the router's public interface IP and assigns a unique ephemeral port number on the public interface.
A single public IPv4 address can theoretically support up to $\approx 64,000$ concurrent translated sessions ($2^{16} = 65,536$ available port numbers minus well-known ports).
Syntax: ip nat inside source list ACL_LAN interface GigabitEthernet0/0/0 overload

Loading diagram...

Port Address Translation (PAT) 5-Tuple Session Multiplexing

3. Cisco IOS-XE NAT Order of Operations

A critical concept for CCNP ENCOR troubleshooting is the precise sequence of operations executed by the Cisco IOS-XE packet switching engine when processing packets traversing NAT boundaries.

+-----------------------------------------------------------------------------------+
|                       CISCO IOS-XE NAT ORDER OF OPERATIONS                        |
+-----------------------------------------------------------------------------------+
|                                                                                   |
|  INSIDE TO OUTSIDE PACKET PATH (LAN -> Internet):                                 |
|  1. Ingress Interface Inbound ACLs Evaluated                                      |
|  2. Ingress Interface Inbound QoS / Policy-Based Routing (PBR) Applied          |
|  3. IP ROUTING TABLE LOOKUP (Determines Egress Interface)                         |
|  4. NAT INSIDE-TO-OUTSIDE TRANSLATION (Source IP Translated: IL -> IG)            |
|  5. Egress Interface Outbound ACLs Evaluated                                      |
|  6. Egress Interface Outbound QoS / IPsec Crypto Encryption Applied               |
|  7. Layer 2 Frame Encapsulation & Transmission                                    |
|                                                                                   |
|  OUTSIDE TO INSIDE PACKET PATH (Internet -> LAN):                                 |
|  1. Ingress Interface Inbound ACLs Evaluated                                      |
|  2. Ingress Interface IPsec Crypto Decryption Applied                             |
|  3. NAT OUTSIDE-TO-INSIDE TRANSLATION (Destination IP Translated: IG -> IL)       |
|  4. IP ROUTING TABLE LOOKUP (Determines Egress Interface based on Translated IP)  |
|  5. Egress Interface Outbound ACLs Evaluated                                      |
|  6. Egress Interface Outbound QoS Applied                                         |
|  7. Layer 2 Frame Encapsulation & Transmission                                    |
+-----------------------------------------------------------------------------------+

[!WARNING] Critical Exam Rule: Notice the asymmetry between directions:

Inside to Outside: Routing lookup occurs BEFORE NAT translation. The router must have a valid route to the destination before it executes the source translation.

Outside to Inside: NAT translation occurs BEFORE Routing lookup. The router translates the public destination IP to the private inside IP first, and then routes the packet toward the internal host based on the translated inside IP.

4. NAT Virtual Interface (NVI)

Traditional NAT requires explicit designation of interface directionality via ip nat inside and ip nat outside. Packets are only translated when transitioning from an inside interface to an outside interface (or vice versa). If traffic enters an inside interface and exits another inside interface, no translation occurs.

NAT Virtual Interface (NVI) removes the requirement for dedicated inside and outside tagging. Under NVI, interfaces are enabled for NAT using the unified command ip nat enable.

+-----------------------------------------------------------------------------------+
|                       NAT VIRTUAL INTERFACE (NVI) ARCHITECTURE                    |
+-----------------------------------------------------------------------------------+
|                                                                                   |
|  Traditional NAT:                                                                 |
|  [ Gi0/0/1 (ip nat inside) ] =======> [ Gi0/0/0 (ip nat outside) ] (Translates)    |
|  [ Gi0/0/1 (ip nat inside) ] =======> [ Gi0/0/2 (ip nat inside)  ] (NO TRANSLATION)|
|                                                                                   |
|  NAT Virtual Interface (NVI):                                                     |
|  [ Gi0/0/1 (ip nat enable) ] ---\                                                 |
|  [ Gi0/0/2 (ip nat enable) ] -----> [ NVI Virtual Interface ] ---> Translates     |
|  [ Gi0/0/3 (ip nat enable) ] ---/   (Any-to-Any Translation)       Between ANY    |
|                                                                    Enabled Ports! |
+-----------------------------------------------------------------------------------+

Benefits of NVI

Allows translation between any two interfaces enabled with ip nat enable, regardless of domain.
Supports overlapping private subnets translating between two internal business units.
Simplifies Hub-and-Spoke DMVPN and multi-VRF translation deployments.

5. VRF-Aware NAT Architecture & Multi-Tenancy

In enterprise networks utilizing Virtual Routing and Forwarding (VRF) to isolate departmental, guest, IoT, or multi-tenant traffic, NAT must operate with awareness of the tenant's specific VRF routing table. VRF-Aware NAT prevents routing leakage and allows overlapping IP ranges across different VRFs to translate simultaneously.

+-----------------------------------------------------------------------------------+
|                           VRF-AWARE NAT TOPOLOGY                                  |
+-----------------------------------------------------------------------------------+
|                                                                                   |
|  +-------------------------------+                                                |
|  | VRF: TENANT_CORP (VLAN 100)   |                                                |
|  | Internal Subnet: 10.1.1.0/24  |---\                                            |
|  +-------------------------------+    \                                           |
|                                        +--> [ Edge Router ] ---> [ Internet ]     |
|  +-------------------------------+    /     (VRF-Aware NAT)     (Global Table)    |
|  | VRF: TENANT_GUEST (VLAN 200)  |---/      - Translates Corp to Public Pool A    |
|  | Internal Subnet: 10.1.1.0/24  |          - Translates Guest to Public Pool B   |
|  | (Overlapping Private Subnet!) |                                                |
|  +-------------------------------+                                                |
+-----------------------------------------------------------------------------------+

Intra-VRF vs Inter-VRF NAT

Intra-VRF NAT: Both the ingress and egress interfaces belong to the same VRF. The translation occurs entirely within the context of that specific VRF routing table.
- Syntax: ip nat inside source static 10.1.1.10 198.51.100.10 vrf TENANT_CORP
Inter-VRF NAT (Shared Services / Internet Egress): The ingress interface belongs to a tenant VRF (e.g., VRF_GUEST), while the egress interface belongs to the Global routing table or a shared WAN VRF (e.g., VRF_INTERNET). Packets are translated and routed across the VRF boundary into the destination VRF.
- Syntax: ip nat inside source list ACL_GUEST pool POOL_GUEST vrf TENANT_GUEST overload paired with route-leaking or default routes.

6. Cisco IOS-XE Configuration & Verification CLI

1. Static NAT with Port Redirection (Port Forwarding)

! Configure static 1:1 NAT for DMZ Web Server (Port 443 HTTPS only)
interface GigabitEthernet0/0/1
 description INSIDE-DMZ
 ip address 10.1.1.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/0/0
 description OUTSIDE-INTERNET
 ip address 198.51.100.1 255.255.255.0
 ip nat outside
!
ip nat inside source static tcp 10.1.1.10 443 198.51.100.10 443 extendable

2. Port Address Translation (PAT Overload) with Access List

! Step 1: Define Standard Access List matching Inside Local Subnets
ip access-list standard ACL_NAT_ALLOWED
 permit 10.10.0.0 0.0.255.255
 permit 10.20.0.0 0.0.255.255

! Step 2: Configure PAT Overload on Public Egress Interface
ip nat inside source list ACL_NAT_ALLOWED interface GigabitEthernet0/0/0 overload

3. VRF-Aware NAT Multi-Tenant Configuration

! Step 1: Define VRF Instances
vrf definition TENANT_CORP
 rd 65000:100
 address-family ipv4
  exit-address-family
!
vrf definition TENANT_GUEST
 rd 65000:200
 address-family ipv4
  exit-address-family

! Step 2: Configure VRF NAT Pools
ip nat pool POOL_CORP 198.51.100.10 198.51.100.19 netmask 255.255.255.0
ip nat pool POOL_GUEST 198.51.100.20 198.51.100.29 netmask 255.255.255.0

! Step 3: Configure VRF-Aware Dynamic PAT Translations
ip access-list standard ACL_CORP
 permit 10.1.1.0 0.0.0.255
!
ip access-list standard ACL_GUEST
 permit 10.1.1.0 0.0.0.255
!
ip nat inside source list ACL_CORP pool POOL_CORP vrf TENANT_CORP overload
ip nat inside source list ACL_GUEST pool POOL_GUEST vrf TENANT_GUEST overload

4. Verification Commands & Diagnostics

Router-Edge# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
tcp 198.51.100.1:10001 10.10.1.50:49152   203.0.113.100:443  203.0.113.100:443
tcp 198.51.100.1:10002 10.20.1.80:51234   198.51.100.50:80   198.51.100.50:80
tcp 198.51.100.10:443  10.1.1.10:443      ---                ---

Router-Edge# show ip nat translations verbose
Pro Inside global      Inside local       Outside local      Outside global
tcp 198.51.100.1:10001 10.10.1.50:49152   203.0.113.100:443  203.0.113.100:443
    create: 00:01:23, use: 00:00:05, timeout: 86400000
    flags: extended, use_count: 0, vrf: default
    w_flags: dynamic, o_flags: none

Router-Edge# show ip nat statistics
Total active translations: 3 (1 static, 2 dynamic; 2 extended)
Peak translations: 142, occurred 01:24:12 ago
Outside interfaces:
  GigabitEthernet0/0/0
Inside interfaces:
  GigabitEthernet0/0/1, GigabitEthernet0/0/2
Hits: 142859  Misses: 12
Expired translations: 2408
Dynamic mappings:
-- Inside Source
[Id: 1] access-list ACL_NAT_ALLOWED interface GigabitEthernet0/0/0 ref_count 2

Test Your Knowledge

An enterprise router is processing an incoming IP packet received on its outside interface (GigabitEthernet0/0/0) destined for an internal web server. According to the Cisco IOS-XE order of operations, what sequence of actions does the router perform on this packet?

The router routes the packet toward the internal interface first, evaluates outbound ACLs, and then applies Destination NAT translation.

The router applies Source NAT translation first, evaluates Policy-Based Routing (PBR), and then performs an IP routing lookup.

The router evaluates ingress ACLs, applies crypto decryption if applicable, executes Outside-to-Inside Destination NAT translation, and then performs the IP routing table lookup.

The router performs an IP routing lookup to determine the egress interface, applies Outside-to-Inside NAT translation, and then evaluates ingress interface ACLs.

Test Your Knowledge

A network administrator configures Port Address Translation (PAT) on a border router to allow 500 internal enterprise workstations to access the Internet using a single public IP address. How does the router distinguish between return traffic flows belonging to different internal workstations?

The router assigns a unique 802.1Q VLAN tag to each return packet.

The router tracks unique Layer 4 source port numbers allocated during translation and matches the destination port in returning packets against the NAT table.

The router encapsulates return traffic in GRE tunnels based on the client MAC address.

The router appends an MD5 hash of the host IP address to the TCP Options header.

Test Your Knowledge

An enterprise multi-tenant cloud environment uses two distinct VRFs: VRF_RED and VRF_BLUE. Both tenants use the overlapping private subnet 192.168.1.0/24 on their inside interfaces. Which NAT feature enables both tenants to translate their traffic to separate public IP pools without routing conflicts or table corruption?

Stateful NAT with HSRP preemption

Static NAT with double 802.1Q encapsulation

VRF-Aware NAT, which binds translation rules and NAT pools to specific VRF instances

NAT Virtual Interface (NVI) using global access-groups

Test Your Knowledge

An engineer needs to enable NAT translation between two internal business units whose interfaces are currently both configured within the inside network domain. Traditional NAT fails because traffic is not crossing from an inside interface to an outside interface. Which technology solves this problem without redesigning the network topology?

NAT Virtual Interface (NVI) using 'ip nat enable' on both interfaces

Configuring GLBP with Host-Dependent load balancing

Enabling 'vlan dot1q tag native' on all trunk interfaces

Applying NTP access-group serve-only to the inside interfaces

Up Next

13.1 IP Multicast Addressing, Group Management (IGMPv1/v2/v3) & IGMP Snooping

Chapter 13: IP Multicast Operations

CCNP Enterprise

CCNP Enterprise

12.3 Network Address Translation (NAT/PAT) & VRF-Aware NAT

Key Takeaways

12.3 Network Address Translation (NAT/PAT) & VRF-Aware NAT

1. Cisco NAT Terminology & The Four Address Types

The Four Address Definitions

2. NAT Operational Flavors: Static, Dynamic & PAT Overload

1. Static NAT (One-to-One Translation)

2. Dynamic NAT (Pool Translation)

3. Port Address Translation (PAT / NAT Overload)

3. Cisco IOS-XE NAT Order of Operations

4. NAT Virtual Interface (NVI)

Benefits of NVI

5. VRF-Aware NAT Architecture & Multi-Tenancy

Intra-VRF vs Inter-VRF NAT

6. Cisco IOS-XE Configuration & Verification CLI

1. Static NAT with Port Redirection (Port Forwarding)

2. Port Address Translation (PAT Overload) with Access List

3. VRF-Aware NAT Multi-Tenant Configuration

4. Verification Commands & Diagnostics

CCNP Enterprise

1Chapter 1: Enterprise Architecture & Hierarchical Design

2Chapter 2: Enterprise Quality of Service (QoS)

3Chapter 3: Software-Defined WAN (Catalyst SD-WAN)

4Chapter 4: Software-Defined Access (Catalyst SD-Access)

5Chapter 5: Device & Data Path Virtualization

6Chapter 6: Network Virtualization & Overlay Technologies

7Chapter 7: Layer 2 Infrastructure & Switching

8Chapter 8: Layer 3 Routing Foundations & EIGRP

9Chapter 9: OSPFv2 & OSPFv3 Operations

10Chapter 10: Border Gateway Protocol (BGP)

11Chapter 11: Policy-Based Routing & Route Redistribution

12Chapter 12: IP Services & High Availability

13Chapter 13: IP Multicast Operations

14Chapter 14: Network Assurance & Monitoring

15Chapter 15: Catalyst Center Assurance & Controller Operations

16Chapter 16: Enterprise Security & Access Control

17Chapter 17: Threat Defense & API Security

18Chapter 18: Network Automation, Programmability & Data Modeling

19Chapter 19: Orchestration, EEM & AI Operations

CCNP Enterprise

12.3 Network Address Translation (NAT/PAT) & VRF-Aware NAT

Key Takeaways

12.3 Network Address Translation (NAT/PAT) & VRF-Aware NAT

1. Cisco NAT Terminology & The Four Address Types

The Four Address Definitions

2. NAT Operational Flavors: Static, Dynamic & PAT Overload

1. Static NAT (One-to-One Translation)

2. Dynamic NAT (Pool Translation)

3. Port Address Translation (PAT / NAT Overload)

3. Cisco IOS-XE NAT Order of Operations

4. NAT Virtual Interface (NVI)

Benefits of NVI

5. VRF-Aware NAT Architecture & Multi-Tenancy

Intra-VRF vs Inter-VRF NAT

6. Cisco IOS-XE Configuration & Verification CLI

1. Static NAT with Port Redirection (Port Forwarding)

2. Port Address Translation (PAT Overload) with Access List

3. VRF-Aware NAT Multi-Tenant Configuration

4. Verification Commands & Diagnostics