Static NAT on Cisco IOS

Let’s take a look at how to configure static NAT on a Cisco router. Here’s the topology I will use:

static nat inside outside

Above you see 3 routers called Host, NAT and Web1. Imagine our host is on our LAN and the webserver is somewhere on the Internet. Our NAT router in the middle is our connection to the Internet.

There’s a cool trick on our routers that we can use. It’s possible to disable “routing” on a router which turns it into a normal host that requires a default gateway. This is very convenient because it will save you the hassle of connecting real computers/laptops to GNS3.

Host(config)#no ip routing
Web1(config)#no ip routing

Use no ip routing to disable the routing capabilities. The routing table is now gone, let me show you:

Host#show ip route 
Default gateway is not set

Host               Gateway           Last Use    Total Uses  Interface
ICMP redirect cache is empty
Web1#show ip route 
Default gateway is not set

Host               Gateway           Last Use    Total Uses  Interface
ICMP redirect cache is empty

As you can see the routing table is gone. We’ll have to configure a default gateway on router Host and Web1 or they won’t be able to reach each other:

Host(config)#ip default-gateway
Web1(config)#ip default-gateway

Both routers can use router NAT as their default gateway. Let’s see if they can reach each other:


Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to, timeout is 2 seconds:
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/8/12 ms

Reachability is no issue as you can see. Now let me show you a neat trick:

Web1#debug ip packet 
IP packet debugging is on

I can use debug ip packet to see the IP packets that I receive. DON’T do this on a production network or you’ll be overburdened with traffic! Now let’s send that ping again…

IP: s= (FastEthernet0/0), d=, len 100, rcvd 1

Above you see that our router has received an IP packet with source IP address and destination IP address

IP: tableid=0, s= (local), d= (FastEthernet0/0), routed via RIB

And it will reply with an IP packet that has source address and destination address

Now let’s configure NAT so you can see the difference:

NAT(config)#interface fastEthernet 1/0
NAT(config-if)#ip nat inside
NAT(config)#interface fastEthernet 0/0
NAT(config-if)#ip nat outside

First we’ll have to configure the inside and outside interfaces. Our host is the “LAN” side so it’s the inside. Our webserver is “on the Internet” so it’s the outside of our network. Now we can configure our static NAT rule:

We're Sorry, Full Content Access is for Members Only...

If you like to keep on reading, Become a Member Now! Here is why:

  • Learn any CCNA, CCNP and CCIE R&S Topic. Explained As Simple As Possible.
  • Try for Just $1. The Best Dollar You’ve Ever Spent on Your Cisco Career!
  • Full Access to our 739 Lessons. More Lessons Added Every Week!
  • Content created by Rene Molenaar (CCIE #41726)

542 Sign Ups in the last 30 days

100% Satisfaction Guaranteed!
You may cancel your monthly membership at any time.
No Questions Asked!

Tags: ,

Forum Replies

  1. Hello Rene.

    Fantastic lesson. I have some doubts about NAT like the one described below using your example:

    When a ping is done from the NAT server to the Webserver there is a failure.

    Logs from NAT are reporting this:

    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to, timeout is 2 seconds:
    *Mar  1 00:12:43.191: IP: tableid=0, s= (local), d= (FastEthernet0/1), routed via FIB
    *Mar  1 00:12:43.191: IP: s= (local), d= (FastEthernet0/1), len 100, sending
    *Mar  1 00:1
    ... Continue reading in our forum

  2. Hello Mohammad!

    The IP NAT INSIDE command indicates that the interface in question is on the inside network. The IP NAT OUTSIDE command indicates that the interface in question is on the ouside network. (I’m sure you got that down, I just want to start from the beginning.) Let’s say the IP address of the inside interface is and that of the outside interface is

    Any traffic that enters the router on the inside interface and exits the router on the outside interface will have the following addresses changed:

    Source address will chan

    ... Continue reading in our forum

  3. Hello AZM

    The ARP request would come from the 3560 router saying “I need the MAC address of the dev

    ... Continue reading in our forum

  4. the following config is in the C891F-K9 in a production network my Question is why they config the ip nat static with route-map option

      router#sh running-config interface g8
    Building configuration...
    Current configuration : 357 bytes
    interface GigabitEthernet8
     description WAN
     bandwidth 512
     bandwidth receive 3000
     ip address x.x.x.x
     ip access-group BLOCK_RECURSIVE in
     ip nat outside
     ip ips myips in
     ip virtual-reassembly in
     zone-member security INTERNET-ZONE
     duplex auto
     speed auto
     crypto map primarymap
     service-policy output MP_STD_4
    ... Continue reading in our forum

  5. Hi Rene/Laz,

    Can you clarify if there is any limitation of NATing on opposite sides.

    . All routers are connected using OPSF. I have 4 loopbacks on R3(1.1.1.X/32) and R4(2.2.2.X/32). I have implemented PAT on routers R1 and R2. The configs are as follows:


    interface GigabitEthernet0/0
     ip address
     ip nat outside
     ip virtual-reassembly in
     duplex auto
     speed auto
     media-type rj45
    interface GigabitEthernet0/1
     ip address 10.
    ... Continue reading in our forum

45 more replies! Ask a question or join the discussion by visiting our Community Forum