Lab 13 — NAT and Port Address Translation

Mission Information

Item	Details
Lab	13
Lab Name	NAT and Port Address Translation
Track	CompTIA Network+
Difficulty	Intermediate
Estimated Time	120–150 minutes
Primary Role	Network Technician / Junior Network Administrator
Environment	Network+ Private-to-External Routed Network
Primary Systems	NETPLUS-CLIENT01, NETPLUS-SERVER01, NETPLUS-RTR01, NETPLUS-EXT01
Primary Tools	Router CLI, ping, tracert/traceroute, curl, Wireshark
Skills	NAT, Static NAT, Dynamic NAT, PAT, NAT Overload, Port Forwarding, Translation Tables, Packet Analysis, Troubleshooting

Mission Objective: Configure NAT and PAT so systems using private IPv4 addresses can communicate with an external network, inspect how addresses and ports are translated, configure inbound static translations, and systematically troubleshoot NAT failures.

Mission Scenario

GHC Enterprise uses private IPv4 addressing internally.

CLIENT01:

10.10.10.20

SERVER01:

10.10.10.30

These addresses belong to private IPv4 space and are not intended to be routed across the public Internet.

The enterprise edge router has an externally reachable lab address:

203.0.113.10

Your network team wants internal systems to communicate with an external test server:

198.51.100.20

The required architecture is:

Private Network
      ↓
Edge Router
      ↓
NAT / PAT
      ↓
External Network

You have been assigned to configure and investigate the translation process.

Mission Objectives

By completing this lab, you will be able to:

• explain why NAT exists

• identify private IPv4 address ranges

• distinguish private and public addressing

• explain inside and outside NAT terminology

• understand inside local addresses

• understand inside global addresses

• configure NAT inside and outside interfaces

• configure static NAT

• configure dynamic NAT

• configure PAT

• explain NAT overload

• inspect NAT translation tables

• understand source-port translation

• configure static port forwarding

• analyze traffic before and after NAT

• understand NAT’s impact on end-to-end addressing

• troubleshoot missing NAT translations

• troubleshoot incorrect NAT interfaces

• troubleshoot incorrect ACLs

• troubleshoot NAT pool exhaustion

• troubleshoot port forwarding

• differentiate NAT problems from routing and firewall problems

1. Build the NAT Lab Topology

Use:

NETPLUS-CLIENT01
10.10.10.20/24
GW 10.10.10.1
      |
      |
NETPLUS-SW01
      |
      |
NETPLUS-RTR01
Inside: 10.10.10.1/24
Outside: 203.0.113.10/24
      |
      |
External Lab Network
203.0.113.0/24
      |
      |
NETPLUS-EXT-RTR
      |
      |
198.51.100.0/24
      |
      |
NETPLUS-EXT01
198.51.100.20/24

203.0.113.0/24 and 198.51.100.0/24 are documentation ranges and are ideal for isolated training labs.

2. Configure CLIENT01

Configure:

IP Address:
10.10.10.20

Subnet Mask:
255.255.255.0

Default Gateway:
10.10.10.1

DNS:
As required by the lab

Verify:

ipconfig /all

3. Configure SERVER01

Use:

IP Address:
10.10.10.30

Subnet Mask:
255.255.255.0

Default Gateway:
10.10.10.1

4. Configure the Router Inside Interface

Cisco-like example:

configure terminal

interface <inside-interface>
 ip address 10.10.10.1 255.255.255.0
 no shutdown

5. Configure the Router Outside Interface

Configure:

interface <outside-interface>
 ip address 203.0.113.10 255.255.255.0
 no shutdown

Verify:

show ip interface brief

6. Verify Internal Connectivity

From CLIENT01:

ping 10.10.10.1

Expected:

Success

From SERVER01:

ping 10.10.10.1

7. Verify External Router Connectivity

From RTR01:

ping <external-next-hop>

Verify the edge router can reach the external network before introducing NAT.

8. Understand Private IPv4 Addressing

RFC 1918 defines private IPv4 ranges:

10.0.0.0/8

172.16.0.0/12

192.168.0.0/16

Examples:

10.10.10.20
172.20.10.5
192.168.1.100

These addresses are commonly used inside private networks.

9. Why Private Addressing Exists

IPv4 provides approximately:

4.3 billion

possible addresses.

Private addressing allows many organizations to reuse the same address space internally.

For example:

Company A
10.0.0.0/8

Company B
10.0.0.0/8

Company C
10.0.0.0/8

These networks remain logically separate.

10. Understand NAT

NAT stands for:

Network Address Translation

NAT modifies IP addressing information as packets move between address domains.

Conceptually:

10.10.10.20
      ↓
NAT Router
      ↓
203.0.113.10
      ↓
External Network

11. Why NAT Is Used

Common reasons include:

Private IPv4 Addressing

IPv4 Address Conservation

Network Address Translation

Address-Space Integration

For typical Internet access:

Many Private Hosts
      ↓
Few Public IPv4 Addresses

PAT makes this especially practical.

12. Understand NAT Terminology

Important terms include:

Inside

Outside

Inside Local

Inside Global

Outside Local

Outside Global

For Network+, focus especially on:

Inside Local

Inside Global

13. Understand Inside Local

The:

Inside Local

address is the address assigned to the inside host as seen from the internal network.

Example:

10.10.10.20

14. Understand Inside Global

The:

Inside Global

address represents the inside host to the outside network.

Example:

203.0.113.10

With PAT, multiple inside hosts can share the same inside global address.

15. Visualize the Translation

Before NAT:

Source:
10.10.10.20

Destination:
198.51.100.20

After NAT/PAT:

Source:
203.0.113.10

Destination:
198.51.100.20

The external host sees:

203.0.113.10

rather than:

10.10.10.20

16. Understand Static NAT

Static NAT creates a fixed:

One-to-One

mapping.

Example:

10.10.10.30
      ↔
203.0.113.30

The mapping remains predictable.

17. Static NAT Use Cases

Static NAT may be useful when an internal system must consistently appear externally using a specific translated address.

Examples include:

Web Server

Application Server

Legacy Service

Published Internal Resource

depending on network architecture and security requirements.

18. Identify NAT Interfaces

On RTR01:

LAN Interface
=
NAT Inside

and:

External Interface
=
NAT Outside

19. Configure NAT Inside

Cisco-like example:

interface <inside-interface>
 ip nat inside

20. Configure NAT Outside

Configure:

interface <outside-interface>
 ip nat outside

Verify the correct interfaces are assigned.

21. Configure Static NAT

Map:

Inside Local:
10.10.10.30

Inside Global:
203.0.113.30

Cisco-like configuration:

ip nat inside source static 10.10.10.30 203.0.113.30

22. Inspect Static NAT

Run:

show ip nat translations

You should see a mapping associated with:

10.10.10.30

and:

203.0.113.30

23. Understand the NAT Translation Table

A NAT table tracks translation state.

Example:

Inside Local	Inside Global
10.10.10.30	203.0.113.30

With PAT, the table will also include transport-layer information.

24. Test Static NAT

Generate traffic from SERVER01 toward EXT01.

Example:

ping 198.51.100.20

Then inspect:

show ip nat translations

and:

show ip nat statistics

25. Understand Dynamic NAT

Dynamic NAT translates private addresses using a:

Pool of Global Addresses

Example:

Inside Hosts
      ↓
NAT Router
      ↓
203.0.113.40–203.0.113.45

Mappings are created dynamically as needed.

26. Define a NAT Pool

For the isolated lab, use:

203.0.113.40
through
203.0.113.45

Cisco-like example:

ip nat pool GHC-NAT-POOL 203.0.113.40 203.0.113.45 netmask 255.255.255.0

27. Identify Internal Addresses for Translation

Create an ACL matching:

10.10.10.0/24

Example:

access-list 1 permit 10.10.10.0 0.0.0.255

28. Connect the ACL to the NAT Pool

Configure:

ip nat inside source list 1 pool GHC-NAT-POOL

Traffic matching ACL 1 can now use addresses from the NAT pool.

29. Generate Dynamic NAT Traffic

From CLIENT01:

ping 198.51.100.20

Then inspect:

show ip nat translations

Record:

Inside Local:

Inside Global:

30. Generate Traffic from Multiple Clients

If available, create:

CLIENT01
10.10.10.20

CLIENT02
10.10.10.21

CLIENT03
10.10.10.22

Generate external traffic from each system.

Observe how dynamic NAT consumes global addresses.

31. Understand Dynamic NAT Limitation

Suppose the pool contains:

6 global addresses

but:

20 inside hosts

attempt simultaneous translations.

Without PAT:

Available Global Addresses

can become a limiting resource.

32. Understand PAT

PAT stands for:

Port Address Translation

PAT allows many private hosts to share:

One Global IPv4 Address

by differentiating sessions using transport-layer identifiers such as port numbers.

33. PAT Is Commonly Called NAT Overload

On many networking platforms, PAT is referred to as:

NAT Overload

Conceptually:

10.10.10.20:50001
10.10.10.21:50002
10.10.10.22:50003
        ↓
NAT/PAT
        ↓
203.0.113.10:<translated ports>

34. Understand Why PAT Scales Better

Without PAT:

1 Private Host
      ↓
1 Global Address

With PAT:

Many Private Hosts
      ↓
1 Global Address
      ↓
Different Port Mappings

This dramatically reduces public IPv4 consumption.

35. Remove Dynamic NAT for the PAT Exercise

Remove the previous dynamic NAT rule according to your platform.

Keep:

ACL 1

matching:

10.10.10.0/24

where appropriate.

36. Configure PAT Using the Outside Interface

Cisco-like example:

ip nat inside source list 1 interface <outside-interface> overload

The keyword:

overload

enables PAT behavior.

37. Generate PAT Traffic

From CLIENT01:

ping 198.51.100.20

Also generate TCP traffic if an external web service exists:

curl http://198.51.100.20

38. Inspect PAT Translations

Run:

show ip nat translations

You may see entries representing:

Protocol

Inside Global

Inside Local

Outside Local

Outside Global

For TCP or UDP, port information becomes especially important.

39. Generate Multiple TCP Sessions

From CLIENT01 and additional clients:

curl http://198.51.100.20

or connect to another lab TCP service.

Observe:

10.10.10.20:<port>
      ↓
203.0.113.10:<translated-port>

and:

10.10.10.21:<port>
      ↓
203.0.113.10:<different-port>

40. Build the PAT Translation Table

Record examples:

Inside Local	Inside Global	Destination
10.10.10.20:50001	203.0.113.10:30001	198.51.100.20:80
10.10.10.21:50001	203.0.113.10:30002	198.51.100.20:80
10.10.10.22:50001	203.0.113.10:30003	198.51.100.20:80

Use the actual values observed in your lab.

41. Understand Return Traffic

Suppose the external server sends:

Destination:
203.0.113.10:30002

The NAT router checks its translation table.

It identifies:

203.0.113.10:30002
      ↓
10.10.10.21:50001

and forwards the packet to the correct internal host.

42. Visualize PAT

CLIENT01
10.10.10.20:51001
        \
         \
CLIENT02  \
10.10.10.21:51001
           \
            ↓
          RTR01
      NAT / PAT Table
            ↓
203.0.113.10:30001
203.0.113.10:30002
            ↓
       External Network

43. Capture Traffic Before NAT

Start Wireshark on the inside segment.

Generate:

curl http://198.51.100.20

Observe:

Source:
10.10.10.20

Destination:
198.51.100.20

44. Capture Traffic After NAT

Capture the same flow on the outside segment.

Observe:

Source:
203.0.113.10

Destination:
198.51.100.20

Compare the packet captures.

45. Compare Source Ports

For TCP or UDP traffic, record:

Inside Source IP:

Inside Source Port:

Outside Source IP:

Translated Source Port:

PAT may preserve or modify the original source port depending on translation requirements.

46. Understand NAT and ICMP

NAT can also translate ICMP traffic.

Because ICMP does not use TCP/UDP ports, NAT implementations use other information, such as ICMP identifiers, to maintain translation state.

This is why:

ping

can still work through PAT.

47. Inspect NAT Statistics

Run:

show ip nat statistics

Review:

Total Active Translations

Inside Interfaces

Outside Interfaces

Hits

Misses

Dynamic Mappings

Exact output depends on platform.

48. Clear Dynamic NAT Translations

In the lab, where supported:

clear ip nat translation *

Then:

show ip nat translations

Generate traffic again and observe the table being rebuilt.

49. Understand Static Port Forwarding

PAT normally supports outbound connections initiated by internal clients.

Sometimes an external client must initiate a connection toward an internal service.

Example:

External Client
      ↓
203.0.113.10:8080
      ↓
NAT Router
      ↓
10.10.10.30:80

This is commonly called:

Port Forwarding

50. Prepare SERVER01 Web Service

On SERVER01, run a lab HTTP service.

For example, with Python where available:

python3 -m http.server 80

or use another approved lab web server.

Verify internally:

http://10.10.10.30

51. Configure Static Port Translation

Cisco-like example:

ip nat inside source static tcp 10.10.10.30 80 203.0.113.10 8080

This creates:

203.0.113.10:8080
      ↓
10.10.10.30:80

52. Test Port Forwarding

From EXT01:

curl http://203.0.113.10:8080

Expected:

HTTP response from SERVER01

53. Inspect the Static Translation

Run:

show ip nat translations

Identify:

TCP

203.0.113.10:8080

10.10.10.30:80

54. Understand NAT Is Not a Firewall

A common misconception is:

NAT = Firewall

This is incorrect.

NAT performs:

Address / Port Translation

A firewall performs:

Traffic Filtering

Modern edge devices often perform both functions, which can make them appear to be the same feature.

55. NAT Can Affect Reachability

Although NAT is not inherently a firewall, typical PAT behavior means unsolicited inbound traffic lacks an existing translation unless:

Static NAT

Port Forwarding

Other Explicit Translation

has been configured.

Security policy should still be enforced by firewall rules.

56. Understand NAT and End-to-End Addressing

Without NAT:

Source Host
      ↓
Destination sees source address

With NAT:

Original Source Address
      ↓
Translated
      ↓
Destination sees translated address

This changes the traditional end-to-end addressing model.

57. Understand NAT Logging

In enterprise environments, NAT logs can become important during troubleshooting and security investigations.

A useful translation record may include:

Internal IP

Internal Port

Translated IP

Translated Port

Destination

Timestamp

Without timestamps and port information, identifying a specific internal host behind PAT may be difficult.

58. Troubleshooting Scenario 1 — NAT Inside Missing

Remove:

ip nat inside

from the internal interface.

Generate traffic:

curl http://198.51.100.20

Then inspect:

show ip nat translations

Expected:

No appropriate translation

59. Diagnose the Missing Inside Interface

Check:

show ip nat statistics

Verify:

Inside Interface

is correctly identified.

Restore:

ip nat inside

60. Troubleshooting Scenario 2 — NAT Outside Missing

Remove:

ip nat outside

from the external interface.

Generate traffic.

Expected:

NAT does not operate correctly

Check interface NAT roles.

Restore the outside designation.

61. Troubleshooting Scenario 3 — Incorrect ACL

Configure the NAT ACL to permit:

10.10.20.0/24

instead of:

10.10.10.0/24

CLIENT01:

10.10.10.20

will not match.

Result:

No NAT Translation

62. Diagnose the NAT ACL

Inspect:

show access-lists

and:

show ip nat statistics

Ask:

Does the source address match the NAT ACL?

Correct:

access-list 1 permit 10.10.10.0 0.0.0.255

63. Troubleshooting Scenario 4 — No Default Route

NAT configuration can be correct while routing is broken.

Remove or invalidate the router’s external route.

Generate traffic.

Expected:

Translation May Occur
      ↓
But Packet Cannot Reach Destination

64. Differentiate NAT and Routing

Check:

show ip nat translations

If a translation exists but traffic still fails, investigate:

Routing

Default Route

External Gateway

Return Route

Firewall

Do not assume every external connectivity problem is NAT.

65. Troubleshooting Scenario 5 — Dynamic NAT Pool Exhaustion

Create a small pool:

203.0.113.40–203.0.113.41

Only two addresses are available.

Generate simultaneous traffic from:

CLIENT01

CLIENT02

CLIENT03

Without PAT, the third host may be unable to obtain a translation.

66. Diagnose Pool Exhaustion

Inspect:

show ip nat translations

and:

show ip nat statistics

Potential solutions include:

Expand NAT Pool

Use PAT

Release Expired Translations

67. Troubleshooting Scenario 6 — Wrong Static NAT Address

Configure:

10.10.10.30
      ↔
203.0.113.99

when the intended global address is:

203.0.113.30

External clients attempting:

203.0.113.30

will not reach SERVER01 through that mapping.

68. Diagnose Static NAT

Check:

show running-config | include ip nat

and:

show ip nat translations

Compare:

Expected Mapping

Configured Mapping

69. Troubleshooting Scenario 7 — Wrong Port Forward

Configure:

203.0.113.10:8080
      ↓
10.10.10.30:8080

while SERVER01 listens on:

TCP 80

External connection fails.

70. Diagnose Port Forwarding

Verify three things:

External Port

Internal Address

Internal Service Port

Correct mapping:

203.0.113.10:8080
      ↓
10.10.10.30:80

71. Troubleshooting Scenario 8 — Internal Service Down

NAT may be configured correctly.

But if SERVER01’s web service is stopped:

NAT Translation
=
Correct

while:

Application Connection
=
Failure

Test internally first:

curl http://10.10.10.30

72. Troubleshooting Scenario 9 — Firewall Blocks Traffic

Suppose NAT translation exists, routing works, and SERVER01 is listening.

But a firewall blocks:

TCP 80

Result:

NAT Works
      ↓
Traffic Filtered
      ↓
Application Fails

This reinforces:

NAT
≠
Firewall

73. Troubleshooting Scenario 10 — Return Path Failure

CLIENT01 sends traffic through RTR01.

NAT occurs successfully.

EXT01 receives the packet.

But the external environment does not have a valid return path toward the translated address.

Result:

Outbound Packet Seen
      ↓
No Successful Return Traffic

Investigate both directions.

74. Troubleshooting Scenario 11 — Incorrect Inside/Outside Assignment

Suppose:

LAN
=
ip nat outside

and:

WAN
=
ip nat inside

This reverses the intended NAT roles.

Check:

show ip nat statistics

and interface configuration.

Correct the assignments.

75. Build the NAT Troubleshooting Workflow

Use:

Internal Host Configured Correctly?
      ↓
Can Host Reach Default Gateway?
      ↓
Can Router Reach External Destination?
      ↓
Correct Inside Interface?
      ↓
Correct Outside Interface?
      ↓
Does Source Match NAT ACL?
      ↓
Correct NAT Rule?
      ↓
Translation Created?
      ↓
Correct Global Address?
      ↓
Correct Port Translation?
      ↓
Correct Routing?
      ↓
Return Path Available?
      ↓
Firewall Permits Traffic?
      ↓
Destination Service Running?

76. Mission Challenge — Identify the Private Address

Which address is private?

A. 8.8.8.8
B. 10.20.30.40
C. 203.0.113.20
D. 198.51.100.20

Answer:

10.20.30.40

because it belongs to:

10.0.0.0/8

77. Mission Challenge — Identify PAT

You observe:

10.10.10.20:51001
→
203.0.113.10:30001

10.10.10.21:51001
→
203.0.113.10:30002

Both clients use:

203.0.113.10

but different translated ports.

This is:

PAT

78. Mission Challenge — Static NAT

Requirement:

10.10.10.30

must always map to:

203.0.113.30

Use:

Static NAT

79. Mission Challenge — Dynamic NAT

Requirement:

Internal hosts

should dynamically receive addresses from:

203.0.113.40–203.0.113.45

Use:

Dynamic NAT

80. Mission Challenge — Many-to-One Translation

Requirement:

200 internal clients

must share:

203.0.113.10

for outbound connectivity.

Use:

PAT / NAT Overload

81. Mission Challenge — Port Forwarding

Requirement:

External:
203.0.113.10:8443

must reach:

Internal:
10.10.10.30:443

Required mapping:

203.0.113.10:8443
      ↓
10.10.10.30:443

82. Mission Challenge — Translation Exists but Traffic Fails

You see:

10.10.10.20
→
203.0.113.10

in the translation table.

But external connectivity fails.

What should you investigate next?

Routing

Return Path

Firewall

Destination Availability

Do not repeatedly modify NAT when translation is already proven.

83. Mission Challenge — No Translation

CLIENT01:

10.10.10.20

NAT ACL:

permit 10.20.0.0 0.0.255.255

Expected:

CLIENT01 does not match the ACL
      ↓
No NAT Translation

84. Compare NAT Types

Type	Translation
Static NAT	One private address ↔ one global address
Dynamic NAT	Private addresses → pool of global addresses
PAT	Many private hosts → one/few global addresses using ports
Port Forwarding	External address/port → internal address/port

85. NAT and IPv6

NAT became extremely common largely because of IPv4 address scarcity.

IPv6 provides a vastly larger address space.

Therefore traditional IPv4-style NAT is generally not required for address conservation in IPv6.

IPv6 security should still be enforced through:

Firewalls

ACLs

Segmentation

Security Policy

Do not treat NAT as a required security mechanism.

86. Create the Lab Workspace

On your administration workstation:

mkdir -p ~/NetworkPlus-Labs/LAB13/{Captures,Screenshots,Configs,Notes}

Create:

touch ~/NetworkPlus-Labs/LAB13/Notes/lab13-notes.md

87. Save Router Configuration Evidence

Capture:

show ip interface brief

show ip route

show access-lists

show ip nat translations

show ip nat statistics

Also save the relevant NAT configuration.

88. Save Packet Captures

Where supported, save:

LAB13-PRE-NAT.pcapng

LAB13-POST-NAT.pcapng

LAB13-PAT.pcapng

LAB13-PORT-FORWARD.pcapng

LAB13-NAT-FAILURE.pcapng

89. Document Your Findings

Use:

# LAB13 — NAT and Port Address Translation

## Topology

### CLIENT01

IP:
10.10.10.20

Gateway:
10.10.10.1

### SERVER01

IP:
10.10.10.30

### RTR01

Inside Interface:

Inside Address:
10.10.10.1

Outside Interface:

Outside Address:
203.0.113.10

### EXT01

Address:
198.51.100.20

## Static NAT

Inside Local:

Inside Global:

Translation:

Connectivity Result:

## Dynamic NAT

NAT Pool:

ACL:

Inside Local:

Inside Global:

## PAT

Inside Local IP:

Inside Local Port:

Inside Global IP:

Translated Port:

Destination:

## Packet Analysis

### Before NAT

Source IP:

Source Port:

Destination IP:

Destination Port:

### After NAT

Source IP:

Source Port:

Destination IP:

Destination Port:

## Port Forwarding

External Address:

External Port:

Internal Address:

Internal Port:

Result:

## Troubleshooting

### Missing Inside Interface

Symptom:

Root Cause:

Fix:

### Missing Outside Interface

Symptom:

Root Cause:

Fix:

### Incorrect ACL

Symptom:

Root Cause:

Fix:

### Pool Exhaustion

Symptom:

Root Cause:

Fix:

### Wrong Port Forward

Symptom:

Root Cause:

Fix:

### Routing Failure

Symptom:

Root Cause:

Fix:

### Firewall Failure

Symptom:

Root Cause:

Fix:

## Final Assessment

Explain how NAT and PAT translated private addresses and how you distinguished translation problems from routing, firewall, and application failures.

90. Evidence to Capture

Capture:

01-nat-topology.png

02-client-ip-configuration.png

03-router-interface-status.png

04-router-routing-table.png

05-private-address-verification.png

06-nat-inside-interface.png

07-nat-outside-interface.png

08-static-nat-config.png

09-static-nat-translation.png

10-static-nat-test.png

11-dynamic-nat-pool.png

12-nat-acl.png

13-dynamic-nat-config.png

14-dynamic-nat-translations.png

15-multiple-dynamic-translations.png

16-pat-config.png

17-pat-client01.png

18-pat-client02.png

19-pat-translation-table.png

20-pat-source-ports.png

21-pre-nat-packet.png

22-post-nat-packet.png

23-nat-statistics.png

24-port-forward-config.png

25-server-web-service.png

26-port-forward-test.png

27-static-port-translation.png

28-missing-nat-inside.png

29-missing-nat-outside.png

30-incorrect-nat-acl.png

31-nat-pool-exhaustion.png

32-wrong-static-nat.png

33-wrong-port-forward.png

34-application-service-failure.png

35-firewall-failure.png

36-final-nat-translations.png

91. Validation Checklist

Infrastructure

• CLIENT01 configured

• SERVER01 configured

• RTR01 configured

• EXT01 configured

• Internal connectivity verified

• External router connectivity verified

• Routing verified before NAT testing

NAT Fundamentals

• Private IPv4 ranges understood

• Public vs private addressing understood

• NAT purpose understood

• Inside terminology understood

• Outside terminology understood

• Inside local understood

• Inside global understood

Static NAT

• Inside interface configured

• Outside interface configured

• Static NAT mapping created

• Static translation verified

• Static NAT connectivity tested

Dynamic NAT

• NAT pool created

• NAT ACL created

• Dynamic NAT configured

• Translation created

• Multiple clients tested

• Pool exhaustion concept understood

PAT

• PAT configured

• NAT overload understood

• Multiple clients tested

• Shared global address verified

• Port translations inspected

• Return translation understood

Packet Analysis

• Inside traffic captured

• Outside traffic captured

• Original source address identified

• Translated source address identified

• Original source port identified

• Translated port identified

• Pre/post-NAT packets compared

Port Forwarding

• Internal service configured

• Static port translation created

• External connection tested

• External port identified

• Internal port identified

• Translation table inspected

Troubleshooting

• Missing NAT inside investigated

• Missing NAT outside investigated

• Incorrect ACL investigated

• Routing failure distinguished from NAT

• NAT pool exhaustion investigated

• Incorrect static NAT investigated

• Wrong port forwarding investigated

• Internal service failure investigated

• Firewall failure distinguished from NAT

• Return-path failure understood

• Reversed NAT interfaces investigated

Architecture

• NAT distinguished from firewalling

• NAT logging understood

• End-to-end addressing impact understood

• IPv6 relationship understood

Documentation

• NAT topology documented

• Static NAT documented

• Dynamic NAT documented

• PAT translations documented

• Packet captures saved

• Port forwarding documented

• Troubleshooting findings documented

• Evidence screenshots captured

• Lab notes completed

92. Mission Review

Before NAT, CLIENT01 uses:

10.10.10.20

as its source address.

With NAT:

10.10.10.20
      ↓
RTR01
      ↓
Address Translation
      ↓
203.0.113.10

With PAT:

CLIENT01
10.10.10.20:51001
        \
         \
CLIENT02
10.10.10.21:51001
           \
            ↓
           PAT
            ↓
203.0.113.10:30001

203.0.113.10:30002

This allows:

Many Private Hosts
      ↓
One Global Address
      ↓
Multiple Port Mappings

You also configured inbound translation:

203.0.113.10:8080
      ↓
10.10.10.30:80

Finally, you learned that successful external connectivity depends on more than NAT:

Host Configuration
      ↓
Default Gateway
      ↓
Routing
      ↓
NAT
      ↓
Firewall
      ↓
Return Path
      ↓
Destination Service

The key lesson is:

NAT translates addressing information between networks, while PAT extends this model by using transport-layer identifiers so many private IPv4 hosts can share a smaller number of global addresses.

Skills Developed

After completing this mission, you should be able to:

• identify private IPv4 ranges

• explain NAT

• explain inside local and inside global addresses

• configure NAT inside and outside interfaces

• configure static NAT

• configure dynamic NAT

• create NAT pools

• use ACLs for NAT matching

• configure PAT

• explain NAT overload

• interpret NAT translation tables

• analyze source-port translation

• compare packets before and after NAT

• configure static port forwarding

• explain inbound translations

• differentiate NAT from firewalling

• identify NAT pool exhaustion

• troubleshoot incorrect NAT ACLs

• troubleshoot incorrect interface roles

• troubleshoot missing translations

• troubleshoot port-forwarding failures

• distinguish NAT failures from routing problems

• distinguish NAT failures from application problems

• understand NAT logging requirements

What’s Next?

Lab 14 — Wireless Network Configuration and Security

Your routed network can now provide:

DHCP
   ↓
DNS
   ↓
Routing
   ↓
NAT / PAT
   ↓
External Connectivity

The next mission introduces another major Network+ environment:

Wireless Networking

You will work with:

• wireless LAN architecture

• access points

• SSIDs

• BSS and ESS concepts

• 2.4 GHz, 5 GHz, and 6 GHz bands

• wireless channels

• channel width

• interference

• signal strength

• RSSI

• wireless authentication

• WPA2

• WPA3

• PSK

• enterprise authentication concepts

• 802.1X

• RADIUS concepts

• guest wireless networks

• wireless VLANs

• client isolation

• rogue access points

• evil twin concepts

• wireless troubleshooting

• Wi-Fi packet and connection analysis

The progression becomes:

Wired Client
      ↓
Switching
      ↓
Routing
      ↓
DHCP / DNS
      ↓
NAT
      ↓
Wireless Access
      ↓
Secure Enterprise Connectivity

➡️ Next: Lab 14 — Wireless Network Configuration and Security