How to Configure Static NAT on Cisco Routers

Static NAT maps inside and outside addresses one-to-one. It allows external devices to establish a session with internal devices using a statically assigned public address. For example, an internal web server is mapped to a specific inside global address, letting outside clients reach it using a public IP while the server itself keeps its private address.

The example topology below illustrates an inside network containing two web servers with private IPv4 addresses, each made accessible from the outside network using its own dedicated global IPv4 address. Router R2 is configured with static NAT, allowing devices on the outside network to reach each server using that server’s own public IP.

---

Example Topology

The topology used throughout this guide consists of:

• R2 – Cisco IOS-XE router acting as the NAT gateway
• Server1 – Web server at 192.168.11.101, connected to R2’s G0/0
• Server2 – Web server at 192.168.10.100, connected to R2’s G0/1
• PC-1 – Internet client at 201.128.35.2, reaching both servers via their public IPs
• Outside link – R2’s Serial0/0/0.100 sub-interface, connected to the ISP/cloud

Interfaces on R2:

Interface	Role	Connects To
GigabitEthernet0/0	Inside	Server1 (LAN)
GigabitEthernet0/1	Inside	Server2 (LAN)
Serial0/0/0.100	Outside	ISP / Internet

Static NAT mappings to be configured:

Server	Inside Local	Inside Global	Configured On
Server1	192.168.11.101	202.128.54.3	G0/0
Server2	192.168.10.100	202.128.54.4	G0/1

This same topology and these same four addresses (192.168.11.101, 192.168.10.100, 202.128.54.3, 202.128.54.4) are used consistently throughout every example, verification output, and walkthrough in the rest of this guide, so you can follow the packet flow end-to-end without the numbers changing between sections.

---

Static NAT Address Terminology

Term	Meaning	Example in This Lab
Inside Local	Private IP address on the internal device	192.168.11.101 (Server1)
Inside Global	Public IP address seen by the Internet	202.128.54.3 (Server1)
Outside Local	IP as seen from the inside (rarely used, usually same as Outside Global)	Usually same as global
Outside Global	Actual IP of the external client	201.128.35.2 (PC-1)

The steps for configuring static NAT, distinct from configuring a static route, are:

1. Create a mapping between the inside local address and the inside global address for each internal device that needs to be reachable from outside.
2. Configure the interfaces participating in the translation as ip nat inside or ip nat outside, relative to which side of the router they face.

When NAT is applied: packets arriving on the router’s inside interface, destined for the outside, are translated and forwarded out the outside interface. Packets arriving on the outside interface, addressed to a configured inside global IP, are translated to the corresponding inside local address and forwarded to the correct internal server.

---

Why Static NAT Still Matters

Despite widespread IPv6 adoption, static NAT remains a core skill for Cisco network engineers and certification candidates:

• CCNA 200-301 (IP Services): Essential for understanding address translation and internet-facing access to internal resources.
• CCNP ENARSI 300-410: Advanced use cases including NAT integration with redundancy protocols and hybrid IPv4/IPv6 environments.
• Real-world applications: Exposing internal servers (web, email, RDP), preserving IPv4 address space, and supporting legacy systems that can’t be readily migrated.

Exam tip: expect two to three static NAT questions on the CCNA exam. Know the exact syntax of ip nat inside source static and how to correctly interpret show ip nat translations output.

---

Configuring Static NAT

Step 1: Configure the Inside Interfaces

Server1’s inside interface (G0/0):

R2> enable
R2# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
R2(config)# interface GigabitEthernet0/0
R2(config-if)# description LAN-to-Server1
R2(config-if)# ip address 192.168.11.1 255.255.255.0
R2(config-if)# ip nat inside
R2(config-if)# no shutdown
R2(config-if)# exit

Server2’s inside interface (G0/1):

R2(config)# interface GigabitEthernet0/1
R2(config-if)# description LAN-to-Server2
R2(config-if)# ip address 192.168.10.1 255.255.255.0
R2(config-if)# ip nat inside
R2(config-if)# no shutdown
R2(config-if)# exit

Step 2: Configure the Outside Interface

Both servers share the same single outside-facing interface, Serial0/0/0.100, since both are being published to the same ISP-facing link. This interface only needs to be marked ip nat outside once, it isn’t repeated per server:

R2(config)# interface Serial0/0/0.100 point-to-point
R2(config-if)# description ISP-Link
R2(config-if)# ip address 202.128.54.1 255.255.255.0
R2(config-if)# ip nat outside
R2(config-if)# no shutdown
R2(config-if)# exit

Step 3: Create the Static NAT Mappings

R2(config)# ip nat inside source static 192.168.11.101 202.128.54.3
R2(config)# ip nat inside source static 192.168.10.100 202.128.54.4

These two commands create the permanent, one-to-one translations shown in the Example Topology table above: Server1’s private address maps to 202.128.54.3, and Server2’s private address maps to 202.128.54.4.

---

Analyzing Static NAT: Packet Flow Walkthrough

Referring back to the Example Topology above, here is exactly what happens when PC-1 (201.128.35.2) connects to Server1 via its public address, 202.128.54.3:

1. PC-1 sends a packet toward the public IPv4 destination address 202.128.54.3, the inside global address of Server1.
2. R2 receives the packet on its outside interface (Serial0/0/0.100) and checks its NAT table. The destination address 202.128.54.3 is found in the table.
3. R2 translates the inside global address 202.128.54.3 into the inside local address 192.168.11.101 and forwards the packet out G0/0 to Server1.
4. Server1 receives the packet and replies, using its own inside local address, 192.168.11.101, as the source.
5. R2 receives this reply on its inside interface, G0/0, with source address 192.168.11.101.
6. R2 checks the NAT table again, finds the matching entry, and translates the source address from the inside local address (192.168.11.101) to the inside global address (202.128.54.3), then forwards the packet out Serial0/0/0.100 toward PC-1.
7. PC-1 receives the reply, appearing to come from 202.128.54.3, and the conversation continues. R2 repeats steps 2 through 7 for every subsequent packet in the session.

The exact same flow applies to a connection toward Server2, substituting 202.128.54.4 for the destination and 192.168.10.100 for Server2’s inside local address, with G0/1 as the relevant inside interface instead of G0/0.

---

Verifying Static NAT

Use show ip nat translations to verify active NAT translations. Static translations always appear in the table, even with no active session; dynamic/port-level entries appear only while a session is active.

R2# show ip nat translations
Pro  Inside global      Inside local       Outside local      Outside global
---  202.128.54.3       192.168.11.101     ---                ---
---  202.128.54.4       192.168.10.100     ---                ---
tcp  202.128.54.3:80    192.168.11.101:80  201.128.35.2:1025  201.128.35.2:1025
tcp  202.128.54.4:80    192.168.10.100:80  201.128.35.2:1026  201.128.35.2:1026

The top two rows are the permanent static mappings, present at all times. The bottom two rows appear only while PC-1 has active TCP sessions open to each server, showing the specific port-level translation for that session.

Use show ip nat statistics for a summary view, including total translation count and hit/miss counters:

R2# show ip nat statistics
Total translations: 4 (2 static, 2 dynamic, 2 extended)
Outside Interfaces: Serial0/0/0.100
Inside Interfaces: GigabitEthernet0/0, GigabitEthernet0/1
Hits: 32  Misses: 18
Expired translations: 0
Dynamic mappings:
R2#

To confirm translation is genuinely working during testing, run clear ip nat statistics first, note the hit count is zero, then generate traffic toward one of the servers and re-run show ip nat statistics to confirm the hit count has incremented. For general background on the technology, see NAT on Wikipedia.

---

Troubleshooting Static NAT (Exam Scenarios)

Symptom	Command to Check	Likely Fix
No translation in table	show ip nat translations	Missing ip nat inside or ip nat outside on an interface
Traffic reaches R2 but not the server	show ip route	Add a missing static route, or bring up a down interface
Server replies, but client never receives it	show access-lists	An ACL is blocking the return traffic
Unexpected/duplicate mapping (“overlap”) error	show run | section nat	Check for a conflicting NAT statement already using that inside global address

CCNP tip: use ip nat translation timeout never in a lab environment specifically to prevent entries from expiring while you’re testing, though this is not typically appropriate for production use.

---

Static NAT vs Dynamic NAT vs PAT

Feature	Static NAT	Dynamic NAT	PAT (Overload)
Mapping	1:1, fixed	1:1, from a pool	Many:1, with ports
Public IPs required	One per device	Equal to pool size	Only 1
Best for	Web/DMZ servers	Temporary outbound access	Branch/SOHO outbound internet access
Command	ip nat inside source static	ip nat pool + ACL	overload keyword
Exam relevance	CCNA & CCNP	CCNA	CCNA

---

Conclusion

Static NAT provides a permanent, predictable one-to-one mapping between a private internal address and a public-facing address, making it the correct choice whenever an external client needs to reliably initiate a connection to a specific internal server. Following the example topology above end-to-end, from interface configuration through the static mapping commands, the packet-flow walkthrough, and verification with show ip nat translations, gives you the complete, consistent picture needed for both CCNA exam questions and real-world DMZ or server-publishing scenarios.

---

FAQs

What is the main command to create a static NAT mapping on a Cisco router?

The core command is ip nat inside source static [inside-local-IP] [inside-global-IP], for example ip nat inside source static 192.168.11.101 202.128.54.3. This establishes a permanent one-to-one translation, after the relevant interfaces have already been marked with ip nat inside and ip nat outside to define which side of the router each interface faces.

How do you verify active static NAT translations on a Cisco router?

Use show ip nat translations to display the permanent static entries, which are always present in the table, alongside any dynamic, port-level entries that appear only during active sessions, showing inside global/local and outside global/local addresses along with port numbers for TCP/UDP traffic. Use show ip nat statistics for a summary view showing total translation counts, hit and miss counters, and the currently configured inside and outside interfaces.

What interfaces must be configured for static NAT to work properly?

Every internal LAN-facing interface that connects to a device needing NAT translation must be marked with ip nat inside, for example GigabitEthernet0/0 and GigabitEthernet0/1 in a topology with two internal servers. The single external, ISP-facing interface must be marked with ip nat outside. This defines the direction NAT translation is applied as traffic crosses the router between the two sides.

Why is static NAT preferred for exposing internal web servers?

Static NAT provides a fixed, permanent one-to-one mapping between a public IP and a private IP, allowing external clients to reliably and consistently initiate connections to a specific internal server at any time, without needing that server to first send outbound traffic the way dynamic NAT typically requires. This predictability, combined with the ability to assign each server its own distinct public IP without port-based overload, makes static NAT the standard choice for publishing web servers, mail servers, and other services that must remain consistently reachable from the internet.

What happens during packet flow with static NAT on inbound traffic?

An external packet arrives at the router’s outside interface addressed to a configured inside global IP. The router checks its NAT table, translates the destination address to the corresponding inside local address, and forwards the packet to the correct internal server based on that translated address. When the server replies, the process reverses: the router translates the reply’s source address from the inside local address back to the inside global address before forwarding it out the outside interface toward the original external client.