As discussed before, NAT translates private IP addresses into public IP addresses. So in the process of translation, there are different operations involved, and understanding each of them requires understanding NAT terminology. Therefore, before understanding NAT in detail, it is important to understand basic NAT terminology. In NAT terminology, the inside network is the set of networks that is subject to translation, and the outside network refers to all other networks.
In the NAT, IPv4 addresses have assigned different designations based on the network, e.g., the private network or the public network, and also on the basis of incoming or outgoing traffic. The NAT has four types of addresses:
- Inside local address
- Inside global address
- Outside local address
- Outside global address
It is important to recall that NAT terminology is always applied from the viewpoint of the device with the translated address when determining the type of address. NAT also uses the perception of local or global concerning addresses
- Inside address—the address of the device that needs to be translated with NAT.
- Outside address—This is the address of the destination device.
- Local address—Any address that appears on the inside portion of the network.
- Global address—Any address that appears on the outside portion of the network.
Let’s understand the above terms with an example. For example, when a user is browsing a website from his computer. The network that connects him with the internet is considered a local network for him, and the network that connects the web webserver where the website is located with the internet is considered a local network for the web server. The network that connects both networks on the internet is considered a global network.
Inside and outside in the NAT depend on the direction of the data. For example, in the below topology for PC-1, router R1 is inside and router R2 is outside, as illustrated in the first image below. If we change the direction of data as illustrated in the second image. The router R2 is inside for the server, and R1 is outside for the server.
The interface of the router, which is connected with the local network, will be configured with an inside local IP address, and the interface connected with the global network will be configured with an inside global IP address.
Now, look at the below topology where we have to expand the above topology and assign an IP address to the devices. PC1 has an inside local address of 192.168.1.100, and the inside global address 172.35.10.2 has been assigned to R1’s outside interface. From the side of PC1, the web server has an outside address of 20.41.5.19. When PC-1 sends packets to the global address of the web server, the inside local address 192.168.1.100 of PC-1 is translated to the inside global address of 172.35.10.2.
The R1 is configured as a NAT router and working as the demarcation point between the inside and outside networks and between local and global addresses.
The terms “inside” and “outside” are combined with the terms “local” and “global” for specific addresses. In the above topology, the router R1 has been configured to provide NAT.
- Inside local address– In the above topology, the IP address 192.168.1.100 is assigned to PC-1. This is the inside local address of PC1.
- Inside global address—when traffic is sending from PC1 to the web server. The R1 translates the inside local address 192.168.1.100 to an inside global address, 172.35.10.20. In the terminology of NAT, the inside local address is translated to the inside global address.
- Outside global address—The outside global address is usually a Public IPv4 address assigned to a host on the Internet. For example, the web server is reachable at IPv4 address 209.165.201.1. Most often the outside local and outside global addresses are the same.
- Outside local address—The address of the destination as seen from the inside network. In this example, PC1 sends traffic to the webserver at the IPv4 address 20.41.5.19.
When PC-1 is sending traffic to a web server. Its web server also returns traffic that is initially addressed and translated. The figure below illustrates the return traffic.
The 4 NAT Address Types – Full Breakdown
| NAT Term | Definition | Location | Scope | Example | Cisco Verification |
|---|---|---|---|---|---|
| Inside Local | The private IP address assigned to a host on the internal network | On the internal device (e.g., PC, server) | Local to the inside network | 192.168.1.100 | Verify the IP address of device or router |
| Inside Global | The public IP address that represents the inside host on the external network after translation | On the NAT router’s outside interface or from a NAT pool | Globally visible on the Internet | 172.35.10.20 | show ip nat translations |
| Outside Global | The real, publicly routable IP address of the destination host on the Internet | On the external server (e.g., web server) | Globally routable | 209.165.201.1 | Ping or traceroute from outside |
| Outside Local | The IP address of the outside host as it appears to the inside network | Rarely different from outside global | Seen by inside hosts | 20.41.5.19 (only if destination also uses NAT) | Usually same as outside global |
CCNA Pro Tip: In 99% of real-world and exam scenarios, Outside Local = Outside Global. Only advanced setups (e.g., overlapping networks) use a different outside local address.
Summary of NAT Translation Process – Step by Step
Let’s walk through a real-world example:
- PC1 (192.168.1.100) wants to access https://networkustad.com (20.41.5.19).
- Packet leaves PC1 with:
- Source IP: 192.168.1.100 (Inside Local)
- Destination IP: 20.41.5.19 (Outside Global)
- R1 (NAT Router) receives the packet on its inside interface.
- R1 translates the source IP:
- Inside Local 192.168.1.100 → Inside Global 172.35.10.20
- Packet leaves R1 toward the Internet:
- Source IP: 172.35.10.20 (Inside Global)
- Destination IP: 20.41.5.19 (Outside Global)
- Return traffic arrives at R1:
- Destination IP: 172.35.10.20 (Inside Global)
- R1 reverses the translation using its NAT table:
- 172.35.10.20 → 192.168.1.100 (Inside Local)
- Packet delivered to PC1.
Common NAT Terminology Exam Questions
- What is the inside local address? → The private IP of the internal host (e.g., 192.168.1.10)
- Which command shows active NAT translations? → show ip nat translations
- Can outside local be different from outside global? → Yes, but rarely. Only in overlapping network designs.
- What does the overload keyword do? → Enables PAT — multiple inside locals share one inside global using ports.
FAQs – NAT Terminology
What is the inside local address in NAT?
The private IP assigned to a device on the internal network (e.g., 192.168.1.100). It exists only inside the local network and is translated before reaching the Internet.
What is the difference between inside global and outside global?
Inside global is the public IP used to represent an internal device on the Internet. Outside global is the real public IP of the destination server
Why is outside local address rarely different from outside global?
Outside local is how the destination appears to the inside network. It differs only if the destination also uses NAT — rare in standard setups. In most cases, they are identical.
How do I verify active NAT translations on a Cisco router?
Use the command show ip nat translations. It displays mappings between inside global:inside local and outside local:outside global, including ports when using PAT.
Is the inside global address always the router’s interface IP?
No. In static/dynamic NAT, it can be from a pool. In PAT (overload), multiple devices share the router’s outside interface IP as the inside global address.
