Troubleshooting NAT / PAT

In this lesson we’ll take a look at some common NAT (Network Address Translation / PAT (Port Address Translation) issues. The configuration of NAT / PAT on Cisco IOS routers is pretty straight-forward but there are some issues. Let’s look at some scenarios…

NAT Inside / Outside

Here’s the topology I will use:

In this scenario we have 3 devices. The router on the left side is called “Host” and this is supposed to be a computer on our LAN.   The device on the right side is supposed to be some webserver, something that we are trying to reach on the Internet. In the middle we’ll find our router that is configured for NAT and/or PAT.

Users from our LAN are complaining that they are unable to reach anything on the Internet. They have confirmed that their IP address and default gateway is OK. Let’s take a look at the NAT router:

NAT#ping 192.168.23.3

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.23.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms

It’s not a bad idea to check if the NAT router can reach the webserver by trying a simple ping. If it doesn’t work you at least know that you have routing issues or that the webserver is down (or maybe just blocking ICMP traffic). Let’see if we can connect to TCP port 80:

NAT#telnet 192.168.23.3 80
Trying 192.168.23.3, 80 ... Open

You can see that this is working so routing between the NAT router and the webserver and connecting to the TCP port is no problem. Let’s focus on the NAT configuration:

NAT#show ip nat translations 
Pro Inside global      Inside local       Outside local      Outside global
icmp 192.168.23.2:1    192.168.12.2:1     192.168.12.1:1     192.168.12.1:1

We can use the show ip nat translations to see if anything is going on. We see that the NAT router is translating something but it doesn’t look quite right if you look closely. The outside local and global IP addresses refer to the IP address on the inside. Let’s take a closer look:

NAT#show ip nat statistics 
Total active translations: 0 (0 static, 0 dynamic; 0 extended)
Outside interfaces:
  FastEthernet0/0
Inside interfaces: 
  FastEthernet1/0
Hits: 5  Misses: 0
CEF Translated packets: 0, CEF Punted packets: 0
Expired translations: 1
Dynamic mappings:
-- Inside Source
[Id: 1] access-list 1 interface FastEthernet1/0 refcount 0
Queued Packets: 0

Show ip nat statistics is a nice command to verify your configuration. You can see that the inside and outside interfaces have been swapped. FastEthernet 0/0 should be the inside and FastEthernet 1/0 should be the outside. Let’s fix this: