A complete guide to Network Address Translation on the Cisco 1921 ISR. PAT (overload) so the whole LAN shares one public address, static NAT for a server with its own public IP, port forwarding for a single service behind PAT, then how to verify it and what to check when translations don't appear. Seven steps, all on the router. It assumes the interfaces from the Setup guide already exist.
NAT (Network Address Translation) lets your entire private LAN share one public IP address. The 1921 sits between your LAN and WAN, rewriting source/destination IPs as packets cross.
| Type | What it does | Use case |
|---|---|---|
| PAT / Overload | Many private IPs → one public IP, differentiated by port | Internet access for all LAN clients |
| Static NAT | One private IP ↔ one public IP, permanently | Hosting a server (web, mail) |
| Port Forwarding | Specific port on public IP → private host | Expose one service behind PAT |
NAT needs an inside interface (LAN side) and an outside interface (WAN side). Every NAT config starts by marking these two roles.
Tell the router which interface faces the LAN (inside) and which faces the WAN (outside). Every NAT rule you create is processed on traffic crossing this boundary.
R1(config)# interface GigabitEthernet0/0 R1(config-if)# ip nat outside R1(config-if)# exit R1(config)# interface GigabitEthernet0/1 R1(config-if)# ip nat inside R1(config-if)# exit
If you use VLAN sub-interfaces, apply ip nat inside to each sub-interface (Gi0/1.10, Gi0/1.20, etc.), not the physical interface.
PAT is what most people mean when they say "NAT." Every device on your LAN shares the WAN IP, with ports used to track which connection belongs to which client. This is a two-part config: an ACL to define which hosts are allowed to NAT, and the NAT rule itself.
! Step 1: Define which hosts can NAT R1(config)# access-list 10 permit 192.168.10.0 0.0.0.255 ! Step 2: Link the ACL to the WAN interface (overload = PAT) R1(config)# ip nat inside source list 10 interface GigabitEthernet0/0 overload
PAT is two lines: an access-list and the ip nat inside source rule. Explain in plain words what the access-list is for — it isn't blocking anything.
The access-list is a guest list, not a bouncer. NAT reads it to decide which private addresses are allowed to be translated; anything not on the list simply passes through untranslated (and then dies at the ISP, because private addresses aren't routable). That's why it's called source list — “translate packets whose source matches this list.” Add a subnet to the list and its devices get the internet; leave one off and they don't, with no other rule needed.
Add more access-list 10 permit lines for each subnet. All lines in the same ACL are ORed — matching any one permits NAT.
R1(config)# access-list 10 permit 192.168.10.0 0.0.0.255 R1(config)# access-list 10 permit 192.168.20.0 0.0.0.255 R1(config)# access-list 10 permit 192.168.30.0 0.0.0.255 R1(config)# ip nat inside source list 10 interface GigabitEthernet0/0 overload
Static NAT permanently maps one private IP to one public IP. Traffic arriving at the public IP is always forwarded to the same internal host — useful if your ISP gives you a block of public IPs.
! Map internal server to a dedicated public IP R1(config)# ip nat inside source static 192.168.10.50 203.0.113.50
This bidirectional — traffic originating from 192.168.10.50 exits as 203.0.113.50, and inbound traffic to 203.0.113.50 is delivered to 192.168.10.50.
If you only have one public IP and it is already used by PAT, skip static NAT and use port forwarding (Step 5) instead.
If you only have one public IP (covered by PAT), you can still expose individual services by forwarding specific ports to an internal host. The router matches inbound traffic by destination port and rewrites it to the private host.
! Forward inbound TCP 80 and 443 to an internal web server R1(config)# ip nat inside source static tcp 192.168.10.50 80 interface GigabitEthernet0/0 80 R1(config)# ip nat inside source static tcp 192.168.10.50 443 interface GigabitEthernet0/0 443 ! Forward SSH on a non-standard port (port 2222 → internal :22) R1(config)# ip nat inside source static tcp 192.168.10.50 22 interface GigabitEthernet0/0 2222 ! Forward RDP (3389) to an internal Windows machine R1(config)# ip nat inside source static tcp 192.168.10.60 3389 interface GigabitEthernet0/0 3389
ip nat inside source static tcp <inside-ip> <inside-port> interface <wan-if> <outside-port>. Use udp instead of tcp for protocols like DNS or SIP.
After a client generates some traffic (browse to a site, ping 8.8.8.8), the NAT table should populate.
! Show active NAT translations R1# show ip nat translations ! Show NAT hit/miss counters and pool usage R1# show ip nat statistics ! Confirm interfaces are tagged correctly R1# show ip interface GigabitEthernet0/0 R1# show ip interface GigabitEthernet0/1
The show ip nat translations output will look like this when PAT is active:
show ip nat statistics shows "Hits" incrementingWhen NAT is not translating, work through these checks in order.
| Symptom | Likely cause | Fix |
|---|---|---|
| No translations in table | ACL doesn't match traffic, or interfaces not tagged | Check ACL, check ip nat inside/outside |
| Misses incrementing, no hits | ACL mismatch — traffic doesn't match permit rule | Use debug ip nat to see what's being checked |
| Traffic reaches internet but return fails | Default route missing | Add ip route 0.0.0.0 0.0.0.0 <ISP-gateway> |
| Port forward not working | ACL blocking inbound, or wrong port | Check ACLs on WAN interface; verify port numbers |
! Real-time NAT debug — watch what is/isn't translating R1# debug ip nat ! Stop debug (always do this when done) R1# undebug all ! Clear the NAT table and start fresh R1# clear ip nat translation * ! Save config once everything is working R1# write memory
debug ip nat on a busy router generates enormous output and can impact performance. Use it briefly and always run undebug all when done.
Your 1921 is translating LAN traffic to the internet. Next steps: configure VLANs with router-on-a-stick, or add ACLs to restrict which hosts can reach which destinations.
No translations in the table means no traffic matched — check the ACL before you check anything else.
| Command | What it does |
|---|---|
ip nat outside | On the WAN interface |
ip nat inside | On the LAN interface (or each sub-interface) |
ip nat inside source list <acl> interface <wan> overload | PAT — everyone shares the WAN address |
ip nat inside source static <private> <public> | Static 1:1 mapping |
show ip nat translations | The active table |
show ip nat statistics | Hit / miss counts |
debug ip nat | Real-time trace — briefly, then undebug all |
clear ip nat translation * | Flush the table |
Router-on-a-stick with sub-interfaces — then ip nat inside goes on each sub-interface.
If the interfaces here don't match yours, that's where Gi0/0 and Gi0/1 were configured.