How to Configure Static NAT on Cisco Routers

NAT (Network Address Translation) is a service that translates IP addresses within a network. Routers provide this service. There are two types of NAT: Static and Dynamic. In static NAT, you manually map IP addresses for translation. In Dynamic NAT, routers automatically do this. This tutorial explains static NAT configurations through an example.

NAT terms

NAT terms define how addresses are mapped during the translation. The following table lists essential terms.

LAB Setup

Set up a practice lab as shown in the following image on your network simulator software. This tutorial uses Packet Tracer and provides download links for the created lab with and without configurations.

Download link for the practice lab with initial IP configurations

Initial IP Configurations

The practice lab available via the above download link includes the initial IP configurations. This configuration is required only when you build your own practice lab.

Assigning IP addresses to end devices

This lab includes two networks. The first network contains three Laptops (Laptop0, Laptop1, and Laptop2), and the second network includes one server (Server0). To assign an IP configuration to the end devices of the first network, click the device, navigate to Desktop, choose IP configuration, select Static, and enter the IP address as specified in the table above.

Configure the IP address on the server in the second network using the same procedure.

Assigning IP addresses on routers

Access the CLI prompt of the first router (R1) and run the following commands.

Router>enable
Router# configure terminal
Router(config)#hostname R1
R1#
R1(config)#interface FastEthernet0/0
R1(config-if)#ip address 10.0.0.1 255.0.0.0
R1(config-if)#no shutdown
R1(config-if)#exit
R1(config)#

The serial interface requires two additional parameters: clock rate and bandwidth. Each serial cable has two ends, DTE and DCE. These parameters must be configured at the DCE end. To know which cable side is connected, use the show controllers interface command in privileged exec mode.

R1(config)#exit
R1#show controllers serial 0/0/0
Interface Serial0/0/0
Hardware is PowerQUICC MPC860
DCE V.35, clock rate 2000000
[Output omitted]

The fourth line in the output shows the cable type. Configure the clock rate and bandwidth only if the cable type is DCE.

R1#configure terminal
R1(config)#interface Serial0/0/0
R1(config-if)#ip address 100.0.0.1 255.0.0.0
R1(config-if)#clock rate 64000
R1(config-if)#bandwidth 64
R1(config-if)#no shutdown
R1(config-if)#exit
R1(config)#

Use the same commands and assign essential IP configurations on the second router (R2).

Router>enable
Router#configure terminal
Router(config)#hostname R2
R2(config)#interface FastEthernet0/0
R2(config-if)#ip address 192.168.1.1 255.255.255.0
R2(config-if)#no shutdown
R2(config-if)#exit
R2(config)#interface Serial0/0/0
R2(config-if)#ip address 100.0.0.2 255.0.0.0
R2(config-if)#no shutdown
R2(config-if)#exit
R2(config)#

Static NAT configuration

Static NAT configuration involves three primary steps:

• Define IP address mapping.
• Define the inside local interface.
• Define the inside global interface.

Static NAT relies on manual translation. You must manually map each inside local IP address that requires translation to its corresponding inside global IP address. The following command accomplishes this mapping.

Router(config)#ip nat inside source static [inside local ip address] [inside global IP address]

For example, in this lab, Laptop1 is assigned the IP address 10.0.0.10. To map this address to 50.0.0.10, use the following command.

Router(config)#ip nat inside source static 10.0.0.10 50.0.0.10

The second step involves specifying the interface connected to the local network. On both routers, interface Fa0/0 is connected to the local network that requires IP translation. The following command designates interface Fa0/0 as an inside local interface.

Router(config-if)#ip nat inside

The third step requires specifying the interface connected to the global network. On both routers, interface serial 0/0/0 is connected to the global network. The following command designates interface serial 0/0/0 as an inside global interface.

Router(config-if)#ip nat outside

The following image illustrates these terms.

Static NAT configuration on R1

R1(config)#ip nat inside source static 10.0.0.10 50.0.0.10
R1(config)#interface FastEthernet 0/0
R1(config-if)#ip nat inside
R1(config-if)#exit
R1(config)#
R1(config)#interface Serial 0/0/0
R1(config-if)#ip nat outside
R1(config-if)#exit

To keep this exercise straightforward, only one static translation is configured. You can use the following commands to configure translations for the remaining addresses.

R1(config)#ip nat inside source static 10.0.0.20 50.0.0.20
R1(config)#ip nat inside source static 10.0.0.30 50.0.0.30

Static NAT configuration on R2

R2(config)#ip nat inside source static 192.168.1.10 200.0.0.10
R2(config)#interface FastEthernet 0/0
R2(config-if)#ip nat inside
R2(config-if)#exit
R2(config)#
R2(config)#interface Serial 0/0/0
R2(config-if)#ip nat outside
R2(config-if)#exit

NAT only handles IP translation. It does not provide IP routing. To enable communication between different networks separated by routers, you must configure IP routing on all routers that connect them. The following command configures IP routing on R1.

R1(config)#ip route 200.0.0.0 255.255.255.0 100.0.0.2

Use the following command to configure IP routing on R2.

R2(config)#ip route 50.0.0.0 255.0.0.0 100.0.0.1

Testing and Verifying Static NAT Configuration

In this lab, static NAT is configured on routers R1 and R2. On R1, the inside local IP address 10.0.0.10 is mapped to the inside global address 50.0.0.10. On R2, the inside local IP address 192.168.1.10 is mapped to the inside global IP address 200.0.0.10.

To test this configuration, click Laptop0, open the Desktop tab, and launch Command prompt.

• Run the ipconfig command.
• Run the ping 200.0.0.10 command.
• Run the ping 192.168.1.10 command.

The first command displays the host system's IP address. The second command determines whether the remote device is accessible. A successful ping reply confirms connectivity to the remote device at this IP address. The third command tests access to the remote device using its actual IP address. A ping error indicates that connectivity to the remote device at this IP address is not available.

Do one more testing. Select Laptop0, click the Desktop tab, launch the Web Browser, and access 200.0.0.10.

The above output image verifies that host 10.0.0.10 can successfully access 200.0.0.10. Since translation is configured only for one host IP, other hosts cannot access the remote host at the mapped IP address. To verify this, send ping requests to 200.0.0.10 from another network device (Laptop1 or Laptop2).

You can also verify the same by accessing the web service from this host.

The following download link provides this lab with the above configuration.

Practice Lab with the static NAT configuration

Viewing NAT translation

To view NAT translation on the router, use the show ip nat translation command. The following image shows the output of this command on R1.

The following image displays the output of this command on R2.

The outside local address field shows the translated IP address that the router receives after translation. From R1's perspective, the remote device’s IP address is 200.0.0.10. From R2’s perspective, the end device’s IP address is 50.0.0.10. It verifies that NAT hides internal IP addresses.

Conclusion

Static NAT provides consistent address mapping between private and public networks. It enables secure, predictable access while supporting troubleshooting, remote access, and network services. By following the step-by-step configuration and verification process provided in this tutorial, you can confidently implement static NAT on Cisco routers within your lab or production environment.