NAT vs PAT: What’s the Difference for the CCNA Exam?

NAT translates one IP address into another. PAT is a specific flavor of NAT that translates many private addresses into a single public address by tracking port numbers alongside them. Every home router you have ever touched runs PAT, which is why the distinction confuses people: they have used PAT their whole lives and called it NAT.

On the CCNA 200‑301 exam this lives at objective 4.1, Configure and verify inside source NAT using static and pools, inside the IP Services domain worth 10 percent of your score. That weighting undersells it. NAT shows up in troubleshooting scenarios across the whole exam because it is the thing that silently breaks connectivity while every interface stays up and every route stays in the table.

What Does NAT Do on a Cisco Router?

It rewrites addresses in the IP header as packets cross between your network and someone else’s, then remembers the swap so return traffic finds its way back.

The reason it exists is arithmetic. IPv4 has roughly 4.3 billion addresses and the internet ran out of unallocated blocks years ago. Private ranges under RFC 1918, the 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 blocks, are not routable across the public internet. NAT is the bridge: your hosts use private addressing internally, and the router swaps in a public address on the way out.

Three variants matter for the exam.

• Static NAT maps one private address to one public address permanently. Use it when something inside needs to be reachable from outside at a predictable address, like a web server.
• Dynamic NAT maps private addresses to a pool of public addresses on a first-come basis. When a host finishes, its address returns to the pool. Run out of pool addresses and the next host gets nothing.
• PAT, also called NAT overload, maps many private addresses to one public address by assigning each conversation a unique source port.

What Is the Difference Between NAT and PAT?

Address count and port tracking. Dynamic NAT gives each inside host its own public address for the duration of the session, so ten simultaneous hosts need ten public addresses. PAT gives all ten the same public address and tells them apart by source port, so ten hosts, or a thousand, need exactly one.

Worth knowing about the blueprint wording: objective 4.1 says static and pools, and does not name PAT. Do not read that as permission to skip it. PAT is configured as an option on a pool or an interface, it is the only one of the three you will meet in a production network on day one, and questions about the overload keyword are common.

What Do Inside Local and Inside Global Mean?

These four terms are the most reliably confusing thing in the entire objective, and Cisco knows it. The trick is that each term is two separate questions stacked together.

Inside or outside tells you whose network the device belongs to. Inside is yours. Outside is theirs.

Local or global tells you which side of the router you are standing on when you look at the address. Local is how the address appears on your internal network. Global is how it appears on the public internet.

Outside local and outside global usually hold the same value, which is exactly why the term feels pointless when you first meet it. They only diverge when you configure outside NAT, which is beyond the CCNA. For the exam, the pair that matters is inside local versus inside global, and the question is almost always which column of show ip nat translations a given address belongs in.

How Do You Configure Static NAT?

Two pieces every time: the translation rule, and telling the router which interfaces face which direction. Forget the second piece and nothing happens at all.

R1(config)# ip nat inside source static 192.168.1.10 203.0.113.10
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip nat inside
R1(config-if)# exit
R1(config)# interface GigabitEthernet0/1
R1(config-if)# ip nat outside

Read the command left to right and it explains itself. Inside source means we are translating the source address of traffic originating on the inside. Static means the mapping never changes. Then the inside local address, then the inside global address, in that order.

That ordering is a favorite exam trap. Reverse the two addresses and you have told the router that 203.0.113.10 is a host on your LAN, which is a config that will accept happily and then behave in ways that make no sense.

How Do You Configure Dynamic NAT with a Pool?

Dynamic NAT needs three ingredients: an ACL identifying who gets translated, a pool of public addresses, and a statement tying them together.

R1(config)# access-list 1 permit 192.168.1.0 0.0.0.255
R1(config)# ip nat pool PUBLIC-POOL 203.0.113.10 203.0.113.20 netmask 255.255.255.0
R1(config)# ip nat inside source list 1 pool PUBLIC-POOL
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip nat inside
R1(config-if)# exit
R1(config)# interface GigabitEthernet0/1
R1(config-if)# ip nat outside

The ACL here is doing something different from what an ACL normally does, and this catches people who have just finished studying filtering questions. It is not blocking anything. A permit statement in a NAT ACL means “translate this traffic,” and a deny means “leave this traffic alone,” not “drop it.” Traffic that matches a deny still routes normally, just untranslated.

One quirk from Cisco’s own documentation that is easy to trip over in a lab: NAT does not support permit ip any any in an access list used for translation. Write a real source match instead of reaching for the catch-all.

How Do You Configure PAT?

Add one word. That is the whole difference at the CLI level.

R1(config)# ip nat inside source list 1 pool PUBLIC-POOL overload

More common in the real world, and more common on the exam, is overloading the outside interface address directly so you need no pool at all:

R1(config)# access-list 1 permit 192.168.1.0 0.0.0.255
R1(config)# ip nat inside source list 1 interface GigabitEthernet0/1 overload
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip nat inside
R1(config-if)# exit
R1(config)# interface GigabitEthernet0/1
R1(config-if)# ip nat outside

This is the config behind every small office and every home router on earth. One public address from the ISP, an entire LAN behind it, port numbers doing the bookkeeping.

How Do You Verify NAT Is Working?

Two commands, and the first one tells you almost everything.

R1# show ip nat translations
Pro  Inside global       Inside local        Outside local    Outside global
tcp  203.0.113.1:1055    192.168.1.10:1055   8.8.8.8:443      8.8.8.8:443
tcp  203.0.113.1:1056    192.168.1.11:1056   8.8.8.8:443      8.8.8.8:443
udp  203.0.113.1:53001   192.168.1.10:53001  8.8.8.8:53       8.8.8.8:53

R1# show ip nat statistics
Total active translations: 3 (0 static, 3 dynamic; 3 extended)
Outside interfaces: GigabitEthernet0/1
Inside interfaces: GigabitEthernet0/0
Hits: 847  Misses: 12

Look at that first output and you can see PAT working: two different inside local addresses sharing one inside global address, kept apart by port number. Those column headers are also free revision on the four-term vocabulary, which is a decent argument for running the command in a lab rather than memorizing definitions from a table like the one above.

show ip nat statistics earns its keep by listing which interfaces are marked inside and outside. When that section is empty, you have found your problem. clear ip nat translation * wipes the dynamic entries when you want a clean slate after a config change, and static mappings survive it.

Why Does NAT Stop Working?

In roughly the order I run into it:

1. Missing ip nat inside or ip nat outside on an interface. This is the answer far more often than anything else. The translation statement is fine, the ACL is fine, no interface is marked, so nothing translates. show ip nat statistics exposes it in one line.
2. The ACL does not match the source subnet. Wrong wildcard mask, wrong network, or the host sits in a subnet nobody added to the list.
3. Pool exhausted. Dynamic NAT with eleven addresses and thirty users means nineteen people cannot reach anything. The misses counter climbs. Add overload.
4. No route back. NAT is not routing. The upstream device still needs a path to your public range, and static NAT to an address your ISP never routed to you produces a translation entry and zero connectivity.
5. Overlapping or duplicated static mappings. Two statics pointing at the same inside global address will fight.

The pattern worth internalizing is that NAT failures look like routing failures. Interfaces up, routes present, pings failing. Before you tear apart the routing table, check show ip nat translations and see whether a translation is even being built.

Is NAT a Security Feature?

No, and this is worth being clear about because plenty of study material implies otherwise.

NAT does hide internal addressing from the outside, and that obscurity has some incidental value. It is not access control. It does not inspect traffic, it does not enforce policy, and it does not track state in the way a firewall does. A host behind PAT is unreachable from outside mostly as a side effect of there being no inbound mapping, and the moment you add port forwarding that protection evaporates.

Cisco tests this as a concept question. If an answer choice describes NAT as a security control, it is wrong. Filtering is what ACLs and firewalls are for.

The related point people ask about: IPv6 does not need NAT, because address scarcity was the entire reason NAT existed. Every host can hold a globally routable address. Some organizations still translate IPv6 for policy reasons, but the arithmetic problem is gone. If you want the addressing side of that, start with IPv6 essentials for the CCNA.

What NAT Mistakes Show Up on the CCNA Exam?

The recurring ones, worth reading twice before exam day:

• Reversing inside local and inside global in the ip nat inside source static command.
• Assuming a deny in a NAT ACL blocks traffic. It only exempts it from translation.
• Missing the overload keyword and then being asked why only some hosts have connectivity.
• Marking both interfaces ip nat inside, or marking neither.
• Mixing up outside local and outside global when reading a show ip nat translations table.
• Calling NAT a security feature.

Every one of those is a config that looks correct at a glance, which is the whole point of how Cisco writes these. Reading about them is not the same as catching them under a clock in a simulation item.

Build the lab. A Packet Tracer topology or physical home lab with two routers, an inside LAN, and a fake outside network takes twenty minutes to put together. Configure PAT, ping across it, then remove ip nat inside from one interface and watch the translations table stay empty while everything else looks perfectly healthy. That specific failure, seen once with your own hands, is worth more than rereading this page.

If you want the full command reference beyond exam scope, Cisco’s Configure Network Address Translation document walks through the common deployment patterns, and the NAT for IP Address Conservation guide covers the caveats, including which applications break when their addresses get rewritten mid-flight.

Ashley Miller

Network Professional | CCNA Certified

Ashley Miller is a 35-year-old networking professional with a proven foundation in Cisco technologies. She is CCNA certified and currently advancing her expertise by working toward the Cisco Certified Network Professional (CCNP) certification. With a passion for designing and maintaining efficient, secure network infrastructures, Ashley brings both technical skill and real-world experience to every project.