Static NAT – Permanent One-to-One Mapping, Configuration, and Troubleshooting

1. What Is Static NAT?

Static NAT (Network Address Translation) creates a permanent, manually configured one-to-one mapping between a specific private (inside local) IP address and a specific public (inside global) IP address. Unlike Dynamic NAT or PAT, the mapping is always present — it does not depend on traffic being initiated and does not expire.

The defining characteristic that separates Static NAT from all other NAT types is bidirectionality: because the mapping is permanent, external hosts on the internet can initiate connections to the inside host by targeting the public IP. This makes Static NAT the correct and only practical NAT method for any server that must be reachable from the internet.

  Internet                   NAT Router                 Internal Network
                             Gi0/1 │ Gi0/0
  Any external host ────────────── │ ─────────────────── Web Server
  → connects to 203.0.113.5        │                     192.168.1.10
                             [static mapping]
                             203.0.113.5 ↔ 192.168.1.10  (permanent)

  Outbound: 192.168.1.10 → 203.0.113.5
  Inbound:  203.0.113.5  → 192.168.1.10   ← key difference from Dynamic NAT

2. The Four NAT Address Terms

The four NAT address terms apply equally to Static, Dynamic, and PAT. They are defined from the NAT router's perspective, combining a location (Inside / Outside) with how the address is seen (Local = as assigned/known internally, Global = as seen on the internet).

Term	Definition	Example (Static NAT)	Where Seen
Inside Local	The actual private IP of the internal host — the real address assigned in the LAN before NAT	`192.168.1.10`	Source IP of packets leaving the server toward the router; visible only within the inside network
Inside Global	The public IP that represents the inside host on the internet — what external clients connect to	`203.0.113.5`	Destination IP of packets arriving from the internet; source IP of packets forwarded out the outside interface
Outside Local	The IP address of the external host as seen from inside the network — in standard Static NAT without Destination NAT, this equals the Outside Global	`8.8.8.8`	Destination IP of packets sent from the inside host toward the internet; usually identical to Outside Global
Outside Global	The real, routable IP address of the external host on the internet	`8.8.8.8`	Source IP of packets arriving from the internet; the actual IP of the remote client or server

  Static NAT translation table entry (permanent — always present):

  Pro  Inside global    Inside local     Outside local    Outside global
  ---  203.0.113.5      192.168.1.10     ---              ---

  The "---" for Outside fields = no active session yet.
  When a session is active they populate with the remote host's IP.

  Inbound packet (external client → inside server):
    External client sends: Dst=203.0.113.5
    Router translates:     Dst=203.0.113.5 → 192.168.1.10
    Delivered to server as: Dst=192.168.1.10

  Outbound packet (inside server → external client):
    Server sends:          Src=192.168.1.10
    Router translates:     Src=192.168.1.10 → 203.0.113.5
    Forwarded to internet: Src=203.0.113.5

3. How Static NAT Works — Bidirectional Traffic Flow

Static NAT is bidirectional by design. The permanent mapping allows translation in either direction — inside-to-outside and outside-to-inside. This is the core property that makes it suitable for public-facing servers.

  ── INBOUND: External client connects to the web server ────────────

  Step 1: Client (1.2.3.4) sends HTTP request to 203.0.113.5:80
  Step 2: Packet arrives at router's outside interface (Gi0/1)
          Dst IP: 203.0.113.5  → matches static mapping
  Step 3: Router rewrites: Dst=203.0.113.5 → Dst=192.168.1.10
  Step 4: Packet forwarded to web server at 192.168.1.10:80
  Step 5: Web server processes the request and sends response
          Src: 192.168.1.10 → Dst: 1.2.3.4
  Step 6: Router translates outbound reply:
          Src=192.168.1.10 → Src=203.0.113.5
  Step 7: Client receives HTTP response from 203.0.113.5  ✓

  ── OUTBOUND: Web server initiates a connection (e.g., for updates) ──

  Step 1: Web server sends outbound packet
          Src: 192.168.1.10 → Dst: 203.0.113.1 (update server)
  Step 2: Packet arrives at router's inside interface (Gi0/0)
          Src=192.168.1.10 → matches static mapping
  Step 3: Router translates: Src=192.168.1.10 → Src=203.0.113.5
  Step 4: Packet forwarded to internet  ✓

Key point: The static mapping entry in the NAT table is present at all times — even when no traffic is flowing. This is fundamentally different from Dynamic NAT and PAT, where entries are only created when inside hosts initiate outbound traffic and expire after the session ends. A static entry persists across router reloads and is visible in show ip nat translations with empty Outside fields when idle.

4. Cisco IOS Configuration — Step by Step

Static NAT requires only two elements: interface role assignments and a static mapping command. No ACL or NAT pool is needed.

Step 1 — Assign Interface Roles

  Router(config)# interface GigabitEthernet0/0
  Router(config-if)# ip nat inside        ! LAN-facing / internal interface
  Router(config-if)# exit

  Router(config)# interface GigabitEthernet0/1
  Router(config-if)# ip nat outside       ! WAN-facing / internet interface
  Router(config-if)# exit

  ! CRITICAL: Both roles must be configured.
  ! Without ip nat inside on the LAN interface AND
  ! ip nat outside on the WAN interface, no translation occurs.

Step 2 — Create the Static Mapping

  Router(config)# ip nat inside source static 192.168.1.10 203.0.113.5

  !                                 │              │            │
  !                           inside source    Inside Local  Inside Global
  !                           (LAN→internet)   (private IP)  (public IP)

  ! This single command creates the permanent bidirectional mapping.
  ! No timeout, no pool, no ACL required.
  ! The mapping survives router reboots (saved to running/startup config).

Multiple Static NAT Entries

Each server requires its own mapping command using a separate public IP for each:

  ! Web server:
  Router(config)# ip nat inside source static 192.168.1.10 203.0.113.5

  ! Mail server:
  Router(config)# ip nat inside source static 192.168.1.11 203.0.113.6

  ! CCTV/DVR:
  Router(config)# ip nat inside source static 10.0.0.100 203.0.113.7

  ! Each inside device requires its own unique public IP address.
  ! This is the fundamental scalability limitation of Static NAT.

Complete Configuration at a Glance

  ! ── Interface roles ──────────────────────────────────────────────
  interface GigabitEthernet0/0
   ip nat inside

  interface GigabitEthernet0/1
   ip nat outside

  ! ── Static mappings ──────────────────────────────────────────────
  ip nat inside source static 192.168.1.10 203.0.113.5
  ip nat inside source static 192.168.1.11 203.0.113.6

Step 3 — Verify

  Router# show ip nat translations

  Pro  Inside global    Inside local     Outside local    Outside global
  ---  203.0.113.5      192.168.1.10     ---              ---
  ---  203.0.113.6      192.168.1.11     ---              ---

  ! Static entries show "---" in the Outside columns when no active session.
  ! When an active session exists, Outside fields show the remote IP:
  tcp  203.0.113.5      192.168.1.10     1.2.3.4          1.2.3.4
       (80)             (80)             (49320)          (49320)

See: Static NAT Configuration Lab | show running-config | show ip interface brief

5. Static NAT with Port Forwarding (Port-Level Static NAT)

Standard Static NAT maps an entire IP address. A variation — sometimes called Port Address Static NAT or port forwarding — maps a specific public IP and port combination to a specific inside IP and port. This allows multiple servers to share a single public IP while remaining individually accessible on different port numbers.

  ! Scenario: Only one public IP (203.0.113.5) but two internal servers.
  ! Forward port 80 to the web server and port 25 to the mail server.

  Router(config)# ip nat inside source static tcp 192.168.1.10 80 203.0.113.5 80
  ! External clients → 203.0.113.5:80 → translated → 192.168.1.10:80 (web)

  Router(config)# ip nat inside source static tcp 192.168.1.11 25 203.0.113.5 25
  ! External clients → 203.0.113.5:25 → translated → 192.168.1.11:25 (mail)

  ! Syntax:
  ! ip nat inside source static {tcp|udp} [inside-local-IP] [inside-port]
  !                                       [inside-global-IP] [global-port]

  ! Result in NAT table:
  Pro  Inside global          Inside local
  tcp  203.0.113.5 : 80       192.168.1.10 : 80
  tcp  203.0.113.5 : 25       192.168.1.11 : 25

Port forwarding is widely used on home routers (where a single public IP must serve multiple internal services) and in small business environments. From a CCNA perspective, it is important to understand that this combines Static NAT's permanence with port-level specificity.

6. Verifying Static NAT

Command	What It Shows	When to Use It
`show ip nat translations`	All NAT entries — static entries are always present (even with no active sessions); active sessions add Outside Local/Global fields and port numbers	Confirm the static mapping exists; verify translations are being created when traffic flows; identify active sessions to the inside server
`show ip nat translations verbose`	Adds creation timestamp and idle timer per entry	Distinguish static (no expiry) from dynamic entries (have timers); diagnose session state
`show ip nat statistics`	Total translations (static + dynamic), hit/miss counters, inside/outside interface assignments, CEF statistics	Confirm interface roles are set correctly; check translation counts; verify no misses (missed translations indicate a config problem)
`show ip interface <int>`	Shows whether `ip nat inside` or `ip nat outside` is set on the interface	Verify interface roles; check for the line "NAT: inside (if a nat inside statement is configured)"
`show running-config \| include nat`	All NAT-related config lines	Quick audit of all static mapping commands and interface role assignments
`debug ip nat`	Real-time translation events — shows every packet being translated with before/after IP addresses	Active troubleshooting when translations are suspected but not visible in the table; use on low-traffic routers only

7. Use Cases for Static NAT

Use Case	Example	Why Static NAT?
Public-facing web server	Internal `192.168.1.10` (nginx) → public `203.0.113.5`	Clients must be able to connect inbound to a fixed, predictable IP; DNS records point to this static IP
Mail server (SMTP/IMAP)	Internal `192.168.1.20` (mail) → public `203.0.113.6`	MX records require a stable public IP; mail delivery from external MTAs requires inbound connection support
Remote access / VPN endpoint	Internal `10.0.0.1` (VPN concentrator) → public `203.0.113.10`	Remote users connect to a known public IP; VPN clients are pre-configured with this address
CCTV / DVR remote viewing	Internal `10.0.0.100` (DVR) → public `203.0.113.7`	Mobile apps connect to the DVR's fixed public IP for live and recorded footage
Legacy systems with fixed IPs	Industrial control system requiring consistent IP for vendor remote support	Vendor's firewall rules and VPN are pre-configured for a specific public IP; cannot use a dynamic mapping
Database server for multi-tenant access	Internal `192.168.1.50` (DB) → public `203.0.113.8`	External application partners connect to the DB on a fixed IP/port; whitelisted in their firewalls

8. Static NAT vs Dynamic NAT vs PAT — Full Comparison

Feature	Static NAT	Dynamic NAT	PAT / NAT Overload
Mapping type	One-to-one (permanent)	Many-to-many (temporary, pool-based)	Many-to-one (port-based, temporary)
Mapping duration	Permanent — survives reboots; always in NAT table	Session-lifetime; expires on idle timeout	Session-lifetime; expires on idle timeout
Inbound connections supported?	Yes — bidirectional; external hosts can initiate connections to the fixed public IP at any time	No — translations only created by outbound traffic; no predictable address for external clients	No — without additional port forwarding rules; port forwarding can enable specific inbound ports
Public IPs required	One dedicated public IP per inside device	One pool IP per simultaneous session	Single IP for all sessions (thousands simultaneously)
ACL required?	No — the static command directly specifies the mapping	Yes — ACL identifies eligible inside hosts	Yes — ACL identifies eligible inside hosts
Translation identifier	IP address only (or IP + port for port forwarding)	IP address only	IP address + Layer 4 source port number
Key configuration command	`ip nat inside source static [local] [global]`	`ip nat inside source list [acl] pool [name]`	`ip nat inside source list [acl] interface [int] overload`
Scalability	Low — one public IP consumed per inside host	Moderate — limited by pool size	Very high — ~65,535 sessions per public IP
Typical use case	Internet-facing servers (web, mail, VPN, CCTV) that must be reachable from the internet	Medium enterprise with a small public IP block and apps that need real (unshared) public IPs	Home and office internet sharing — the overwhelming majority of real-world NAT deployments

See: NAT Overview | PAT (NAT Overload) Lab

9. Security Considerations

Static NAT exposes an inside host to the public internet by design — it is the mechanism that enables inbound access. This means the security implications are significantly different from Dynamic NAT or PAT, where inside hosts are unreachable from outside by default.

Consideration	Detail and Mitigation
Full IP exposure	The entire public IP is reachable on all ports by default. Unlike PAT (where no port is open unless specifically forwarded), a Static NAT entry with no ACL means any external host can attempt to connect to any TCP/UDP port on the inside server. Always pair Static NAT with an inbound ACL on the outside interface to restrict which ports are accessible.
ACL filtering is essential	Apply an extended ACL on the outside interface (`in` direction) to permit only the specific protocols and ports needed — e.g., only TCP/80 and TCP/443 to the web server's public IP, denying everything else.
No port-level control from NAT alone	Standard Static NAT translates the IP address only — not individual ports. Port-level control requires either port-forward static NAT entries or a firewall in front of the server.
Inside host is fully responsible for its own security	NAT is not a substitute for patching, a host-based firewall, or secure service configuration on the inside server. A vulnerable service on the server is directly exploitable once a Static NAT entry exists.
NAT does not hide the inside IP from logged traffic	Logs on the inside server show the real client IPs. Logs on the NAT router show both the public destination (Inside Global) and the inside server's real IP (Inside Local). This is useful for forensics but should be factored into privacy and logging policies.
Consider a DMZ architecture	For production internet-facing servers, place them in a dedicated DMZ segment with a firewall on both sides (internet-facing and LAN-facing). Static NAT alone provides only address translation — a full firewall provides stateful inspection and application-layer filtering.

10. Limitations of Static NAT

Limitation	Detail	Alternative
One public IP per inside device	Every server that needs to be independently reachable from the internet requires its own dedicated public IP address. With five servers, five public IPs are consumed permanently — regardless of whether they are receiving traffic.	Port-forwarding static NAT entries (Section 5) can allow multiple servers to share one IP on different ports
No scalability for outbound users	Static NAT is designed for servers, not for general internet access by many clients. Using Static NAT for 100 internal users would require 100 public IPs.	PAT Lab allows thousands of users to share a single public IP
Manual configuration and maintenance	Each mapping must be configured individually. When a server is decommissioned or its internal IP changes, the static entry must be manually updated.	Good documentation and change management processes; scripted configuration management
No IP conservation	Public IPs are consumed even when the mapped inside host is powered off or not sending any traffic. The mapping persists unconditionally.	Remove unused static entries; use Dynamic NAT when the host only needs outbound access

11. Troubleshooting Static NAT

Symptom	Likely Cause	Diagnostic Steps
Static entry not visible in `show ip nat translations`	Mapping command not entered; typo in IP address; command entered under wrong config mode	`show running-config \| include nat` to confirm the `ip nat inside source static` command is present with correct IPs
Entry is present but external clients cannot reach the server	Interface roles missing or on wrong interfaces; ISP is not routing the public IP to this router; an ACL on the outside interface is blocking inbound traffic	`show ip nat statistics` — confirm inside/outside interfaces are correct; verify ISP routing with a traceroute from an external host; check `show access-lists` for inbound ACL on Gi0/1
Inbound connections time out; server never receives traffic	Server's default gateway is not set to the NAT router; server-side firewall (iptables, Windows Firewall) blocking the service port; service is not listening	Ping the server from within the LAN; confirm gateway with `netstat -rn` on the server; confirm the service is listening with `netstat -an \| grep 80`
Outbound from the server works but inbound does not	Outside interface does not have `ip nat outside` configured; an upstream device (ISP router, firewall) is blocking the public IP	`show ip interface Gi0/1` — look for "NAT: outside" line; confirm with ISP that the public IP is routed to this router's upstream interface
Traffic appears translated in the table but replies are dropped	Asymmetric routing — reply packets are returning through a different path that does not have the NAT state	Trace the return path; ensure all traffic for a session traverses the same NAT router; use `debug ip nat` to confirm both directions are being translated

Debug Commands

  ! Enable real-time NAT translation events:
  Router# debug ip nat

  ! Sample output — inbound translation (internet → server):
  NAT: s=1.2.3.4, d=203.0.113.5->192.168.1.10 [1001]

  ! Sample output — outbound translation (server → internet):
  NAT*: s=192.168.1.10->203.0.113.5, d=1.2.3.4 [1001]

  ! The asterisk (*) means CEF-switched translation (normal for high-speed)
  ! Without asterisk = process-switched translation

  ! Turn off debug:
  Router# no debug ip nat   (or: undebug all)

  ! Show statistics:
  Router# show ip nat statistics

  ! Clear dynamic entries (static entries are NOT removed by this command):
  Router# clear ip nat translation *

See: show ip route | show running-config | ACL Configuration | Troubleshooting NAT/PAT Lab

12. Complete End-to-End Scenario

A company runs three internal servers and needs each to be independently accessible from the internet on dedicated public IPs. The ISP has allocated 203.0.113.5/29 (six usable IPs: .5 through .10). The internal LAN is 192.168.1.0/24.

  Network diagram:
  Internet ── Gi0/1 [Router R1] Gi0/0 ── 192.168.1.0/24
                                           ├── 192.168.1.10 (web server)
                                           ├── 192.168.1.20 (mail server)
                                           └── 192.168.1.30 (VPN endpoint)

  ! ── Step 1: Interface roles ────────────────────────────────────
  R1(config)# interface GigabitEthernet0/0
  R1(config-if)# ip nat inside
  R1(config-if)# exit

  R1(config)# interface GigabitEthernet0/1
  R1(config-if)# ip nat outside
  R1(config-if)# exit

  ! ── Step 2: Static mappings ─────────────────────────────────────
  R1(config)# ip nat inside source static 192.168.1.10 203.0.113.5
  R1(config)# ip nat inside source static 192.168.1.20 203.0.113.6
  R1(config)# ip nat inside source static 192.168.1.30 203.0.113.7

  ! ── Step 3: ACL to restrict inbound access ──────────────────────
  R1(config)# ip access-list extended INBOUND_FILTER
  R1(config-ext-nacl)# 10 permit tcp any host 203.0.113.5 eq 80
  R1(config-ext-nacl)# 20 permit tcp any host 203.0.113.5 eq 443
  R1(config-ext-nacl)# 30 permit tcp any host 203.0.113.6 eq 25
  R1(config-ext-nacl)# 40 permit tcp any host 203.0.113.6 eq 993
  R1(config-ext-nacl)# 50 permit udp any host 203.0.113.7 eq 500
  R1(config-ext-nacl)# 60 deny ip any any log
  R1(config-ext-nacl)# exit

  R1(config)# interface GigabitEthernet0/1
  R1(config-if)# ip access-group INBOUND_FILTER in

  ! ── Step 4: Verify ───────────────────────────────────────────────
  R1# show ip nat translations
  R1# show ip nat statistics
  R1# show ip interface GigabitEthernet0/1

13. Static NAT in IPv6

Static NAT as described in this guide applies to IPv4. In IPv6, the enormous address space (2¹²⁸ addresses) eliminates the scarcity that motivated NAT in IPv4 — every device can have its own globally routable IPv6 address without translation.

However, two related IPv6 mechanisms exist for specific use cases:

NAT64 (RFC 6146) — Translates between IPv6 and IPv4 networks, allowing IPv6-only clients to access IPv4 servers and vice versa. Used during IPv4-to-IPv6 migration periods.
NPTv6 (Network Prefix Translation for IPv6) — Translates one IPv6 prefix to another, sometimes used in multi-homed networks for provider-independent addressing — conceptually similar to Static NAT but prefix-based rather than host-based.

See: IPv6

14. Exam Tips & Key Points

Static NAT creates a permanent one-to-one mapping that is always in the NAT table, survives reboots, and enables bidirectional traffic — both inside-to-outside and outside-to-inside.
The Inside Local is the private IP; the Inside Global is the public IP it maps to. Outside Local and Outside Global are both the external destination IP in standard Static NAT (equal, no Destination NAT).
Static NAT requires only two configuration elements: interface roles (ip nat inside / ip nat outside) and the mapping command (ip nat inside source static [local] [global]). No ACL or pool is needed.
Unlike Dynamic NAT, Static NAT does not require an ACL to function. The static command directly specifies which inside host is being mapped.
Inbound connections are supported — this is the key distinguishing feature from Dynamic NAT and PAT. External hosts can reach the inside server by connecting to its Inside Global (public) IP.
Static NAT entries show --- in the Outside columns of show ip nat translations when idle. When a session is active, the remote IP populates those fields.
clear ip nat translation * removes dynamic entries only — static entries are never removed by this command. Remove a static entry with no ip nat inside source static [local] [global].
For port-level control, pair Static NAT with an inbound ACL on the outside interface — Static NAT alone exposes all ports.

15. Summary Reference Table

Topic	Static NAT Detail
NAT type	One-to-one permanent mapping
Mapping command	`ip nat inside source static <inside-local> <inside-global>`
Port forwarding variant	`ip nat inside source static tcp <local-ip> <local-port> <global-ip> <global-port>`
Inside interface	`ip nat inside`
Outside interface	`ip nat outside`
ACL required?	No — static command is self-contained; ACL is recommended separately for security filtering
Inbound connections	Supported — bidirectional; external hosts initiate to Inside Global IP
Verify translations	`show ip nat translations`
Entry persistence	Permanent — present even with no active traffic; survives `clear ip nat translation *`
Remove static entry	`no ip nat inside source static <local> <global>`
Scalability limitation	One public IP consumed per inside device — low scalability
Best used for	Internet-facing servers: web, mail, VPN endpoints, CCTV/DVR, any host that must accept inbound connections from the internet

Static NAT Quiz

1. What type of IP mapping does Static NAT create, and what makes it different from Dynamic NAT?

A. Dynamic mapping — it assigns public IPs from a pool on demand B. Many-to-one mapping — many internal IPs share a single public IP using port numbers C. A pool-based temporary mapping that expires after the session ends D. A permanent one-to-one mapping between a specific private IP and a specific public IP — it is always present, supports inbound connections, and does not expire

Correct answer is D. Static NAT creates a permanent one-to-one mapping between a specific Inside Local (private) IP and a specific Inside Global (public) IP. The mapping is manually configured with the ip nat inside source static command and persists permanently — it is always present in the NAT table, survives router reboots, and does not expire regardless of whether traffic is flowing. The critical distinction from Dynamic NAT: because the mapping is always present, external hosts can initiate connections to the inside host at any time by targeting the public IP. Dynamic NAT entries are created only by outbound traffic and expire on idle timeout — external hosts cannot initiate connections through a dynamic mapping.

2. A company needs its internal web server (192.168.1.10) to be accessible from the internet. Why is Static NAT the correct NAT type to use?

A. Static NAT creates a permanent bidirectional mapping — external clients can initiate connections to the server's fixed public IP at any time, which is not possible with Dynamic NAT or standard PAT B. Static NAT conserves public IP addresses by allowing many servers to share one public IP C. Static NAT is preferred because it is simpler to configure than Dynamic NAT and requires no commands D. Static NAT encrypts all traffic to the web server for enhanced security

Correct answer is A. The fundamental requirement for a public-facing server is that external clients must be able to initiate connections to it — a client types the server's public IP into their browser and the router must be able to forward that inbound connection to the correct inside host. Static NAT is the only standard NAT type that supports this by default: the permanent mapping acts as a permanent "door" that maps inbound traffic destined for the public IP to the internal server. Dynamic NAT and PAT only create translations when inside hosts initiate outbound connections — an external client has no fixed, predictable address to connect to. Static NAT does not conserve IPs (it consumes one per server) and does not provide encryption.

3. In Static NAT terminology, what is the "Inside Local" address?

A. The public IP address that external clients connect to — what the internet sees B. The actual private IP address assigned to the inside host in the LAN — the address before NAT translation, visible only within the internal network C. The real IP address of the external host on the internet D. The IP address configured on the router's inside interface

Correct answer is B. In NAT terminology, "Local" means the address as it is known within that side of the network, and "Global" means the address as seen from the internet. Inside Local is therefore the private RFC 1918 address assigned to the internal host in the LAN — e.g., 192.168.1.10. This is the address in the source IP field of packets leaving the server before the NAT router translates them. The Inside Global (option A) is the public IP that replaces it after translation — e.g., 203.0.113.5. Option C describes the Outside Global (the real IP of the external destination). Option D is simply the router interface address, which is a separate concept from NAT terminology.

4. Which Cisco IOS command creates a permanent Static NAT mapping from private IP 192.168.1.10 to public IP 203.0.113.5?

A. ip nat pool MY_POOL 203.0.113.5 203.0.113.5 netmask 255.255.255.0 — this defines a Dynamic NAT pool, not a static entry B. ip nat inside source list 1 pool MY_POOL — this binds a Dynamic NAT pool to an ACL C. ip nat inside source static 192.168.1.10 203.0.113.5 — directly and permanently maps the private IP to the public IP without a pool or ACL D. ip nat inside source overload 192.168.1.10 203.0.113.5 — this is not valid IOS syntax

Correct answer is C. The ip nat inside source static <inside-local> <inside-global> command in global configuration mode creates a permanent static mapping between the specified private IP and the specified public IP. The keyword static is what distinguishes this from Dynamic NAT — there is no pool, no ACL, and no timeout. The single command is sufficient (along with the interface role assignments) to enable full bidirectional translation. Each additional inside device that needs its own public IP requires a separate ip nat inside source static command with its own IP pair.

5. What interface-level command is applied to the LAN-facing interface to configure it for Static NAT?

A. ip nat outside — this command is applied to the WAN/internet-facing interface, not the LAN interface B. ip nat inside — marks this interface as the inside boundary of the NAT domain; traffic arriving here is a candidate for translation toward the outside C. ip nat source — not a valid interface configuration command D. ip nat static — not a valid interface configuration command

Correct answer is B. ip nat inside is entered under the LAN-facing interface configuration and tells the router that this interface connects to the private (inside) side of the NAT boundary. The corresponding command ip nat outside is applied to the WAN or internet-facing interface. Both roles are mandatory for any NAT type — Static, Dynamic, or PAT. If either is missing, no translations occur. The router uses the "inside" and "outside" designations to determine the direction of translation: packets from inside heading outside have their source IP translated; packets from outside heading inside have their destination IP translated.

6. What is the primary scalability limitation of Static NAT that makes it unsuitable as the sole NAT method for general internet access?

A. Static NAT allows multiple devices to share one public IP, which causes address conflicts B. Static NAT dynamically assigns IPs that may conflict with DHCP C. Static NAT provides encrypted translations that consume extra memory D. Each inside device requires a unique, dedicated public IP address — with 100 internal hosts needing internet access, 100 public IPs would be permanently consumed

Correct answer is D. Static NAT's one-to-one nature means every inside host that needs a public IP presence requires its own dedicated globally routable address. For internet-facing servers (web, mail, VPN) this is acceptable because they need individual, stable public IPs. But for general outbound internet access by employees, this is completely impractical — a company with 500 employees would need to lease 500 public IP addresses just for outbound browsing, consuming a precious and costly resource. PAT (NAT Overload) solves this by allowing all 500 employees to share a single public IP using unique source port numbers to distinguish their sessions.

7. An engineer runs show ip nat translations and sees the static entry with "---" in the Outside columns. What does this indicate?

A. The static mapping exists and is working correctly — "---" means no active session is currently using the mapping; the entry will populate with remote IP details when a connection is made B. The mapping is broken — the "---" indicates a translation error that must be resolved C. The interface roles have not been configured, which prevents Outside fields from being populated D. The static NAT entry has expired and will be removed shortly

Correct answer is A. In the output of show ip nat translations, a static NAT entry always shows the Inside Global and Inside Local IP addresses. The Outside Local and Outside Global columns show "---" (or are blank) when no active session is using the mapping — there is simply no remote endpoint to record. This is expected and normal for a static entry with no current traffic. When a client connects, the Outside fields will populate with the client's IP address and port numbers. Critically, static entries cannot expire — they are permanent and remain in the table indefinitely until explicitly removed with no ip nat inside source static. This is in contrast to dynamic entries, which do expire and disappear from the table.

8. A Static NAT entry is configured for a web server but no ACL is applied to the outside interface. What is the security implication?

A. There is no security concern — Static NAT by itself only exposes port 80 and 443 B. Static NAT provides port-level translation that automatically filters unused ports C. The server's public IP is exposed on all ports — any external host can attempt to connect to any TCP/UDP service running on the inside server; an inbound ACL on the outside interface is essential to restrict access to only intended ports D. Static NAT automatically applies an implicit deny to block all ports except those explicitly permitted by the static entry

Correct answer is C. Standard Static NAT translates the IP address only — it does not provide any port-level filtering. A static mapping of 192.168.1.10 ↔ 203.0.113.5 means the entire public IP 203.0.113.5 is mapped to the inside server on all ports. Any external host that can route to 203.0.113.5 can attempt to connect on any port — SSH (22), Telnet (23), RDP (3389), database ports, etc. If the server has any vulnerable or misconfigured service listening, it is directly exploitable. The solution is to apply a strict extended ACL on the outside interface in the inbound direction permitting only the specific protocols and ports needed (e.g., TCP/80 and TCP/443 for a web server) and denying everything else.

9. What is the key operational difference between Static NAT and PAT when an external host needs to reach an internal server?

A. Static NAT shares a single public IP among many servers using port numbers; PAT uses a dedicated public IP per server B. Static NAT supports inbound connections natively because the mapping is permanent and predictable; PAT only allows outbound-initiated sessions by default and requires explicit port forwarding rules to admit inbound connections C. Static NAT dynamically assigns IPs; PAT uses permanent fixed mappings D. PAT requires a unique public IP per device; Static NAT allows sharing

Correct answer is B. The defining operational difference is how each handles inbound connections. Static NAT's permanent mapping means the public IP always resolves to the same inside host — external clients can connect at any time and the router immediately knows which inside host to forward to. PAT creates translations only when inside hosts initiate outbound connections; there is no persistent mapping for any inside host, so an external client has no stable address to target. To admit a specific inbound port through PAT, you must configure an additional port-forwarding static entry (ip nat inside source static tcp [local] [port] [global] [port]), which is effectively a Static NAT port-forward. For servers needing inbound access, Static NAT is cleaner and more appropriate.

10. Why does Static NAT have lower scalability than Dynamic NAT or PAT?

A. It requires one unique, permanently allocated public IP address per inside device — with 50 servers, 50 public IPs are permanently consumed whether or not those servers are active B. It assigns IPs dynamically which increases overhead C. It encrypts IP address translation which consumes additional CPU D. It uses port overloading which requires more memory per session

Correct answer is A. Scalability in NAT is measured by how efficiently public IP addresses are used. Static NAT is the least efficient: one public IP is permanently bound to one inside device and cannot be shared or reclaimed. Dynamic NAT improves on this by only allocating a pool IP when a session is active and returning it when idle. PAT maximises efficiency by multiplexing thousands of simultaneous sessions from different inside hosts onto a single public IP using unique source port numbers — making it the solution of choice for general internet access. Static NAT's low scalability is an acceptable trade-off for servers that need inbound reachability and a stable, predictable public IP (required for DNS A/MX records, SSL certificates, and partner firewall whitelisting).

← Back to Home