## Overview

NAT rewrites IP addresses in a packet to allow private networks to communicate with public or overlapping networks. It’s commonly used to:

- **Hide private IP addresses** behind a public IP
- **Resolve overlapping subnets**
- **Enable internet access** for internal hosts
- **Redirect traffic** to internal services using destination NAT

#### Source NAT
- Rewrites the **source IP address**
- Most common NAT type
- Used for outbound traffic (e.g., internet, inter-VRF)
#### Port Address Translation (PAT)
- A form of NAT that rewrites both IP and **port number**
- Allows **many internal hosts** to share a **single public IP**
- Enabled by the keyword `overload`
- Most commonly used NAT type in production networks

---
## Types of NAT

- **Static NAT / PAT** – Fixed one-to-one IP or IP+Port mapping
- **Dynamic NAT / PAT** – Allocated from a pool or interface dynamically as traffic flows
- **Policy NAT / PAT** – NAT applied only to traffic matching an access list (ACL)
- **VRF-aware NAT / PAT** – NAT with multi-VRF awareness
- **VASI NAT** – Uses virtual interfaces for inter-VRF translation (IOS XE advanced use)

---
## Configurations

```none
interface Ethernet1
 ip address 10.0.0.1 255.255.255.252
 ip nat outside

interface Ethernet2
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
```

---
### NAT

**Static NAT**

```none
(config)# ip nat inside source static 192.168.1.10 10.0.0.1
```

Maps internal host `192.168.1.10` to outside IP `10.0.0.1` permanently (1:1 mapping).

```none
(config)# ip nat inside source static 192.168.1.10 interface Ethernet1
```

Maps internal host `192.168.1.10` to the **outside interface IP** (dynamic public IP scenario).

**Dynamic NAT**

```none
(config)# access-list 1 permit any
(config)# ip nat inside source list 1 interface Ethernet1
```

Dynamically translates IPs that match ACL 1 to the IP address of Ethernet1.
- Only one translation is allowed at a time unless PAT (`overload`) is used.

---

### PAT

```none
(config)# access-list 1 permit any
(config)# ip nat inside source list 1 interface Ethernet1 overload
```

Applies PAT to any internal IP, allowing multiple internal hosts to share the IP of Ethernet1 using port translation.

---

### Policy

**NAT & PAT (Policy-based using ACL)**

```none
(config)# access-list 100 permit tcp any any eq 80
(config)# ip nat inside source list 100 interface Ethernet1
(config)# ip nat inside source list 100 interface Ethernet1 overload
```

- Translates only **HTTP (TCP port 80)** traffic that matches ACL 100.
- Without `overload`: Dynamic Policy NAT (1:1)
- With `overload`: Dynamic Policy PAT (many-to-one with port translation)

---

### Port Forwarding

```none
ip nat inside source static tcp 192.168.1.10 23 10.0.0.1 12345
	or
ip nat inside source static tcp 192.168.1.10 23 interface Eth1 12345
```

Maps internal **port 23** on `192.168.1.10` to **port 12345** on `10.0.0.1`.
- Commonly used for port forwarding scenarios (e.g., external SSH/RDP access).