To enable Network Address Translation (NAT) of the inside source address, use the ip
nat
inside
source command in global configuration mode. To remove the static translation, or the dynamic association to a pool, use the no form of this command.
Dynamic NAT
ip
nat
inside
source
list
{
access-list-number
| access-list-name
}
pool
name
[
vrf
name
]
[
match-in-vrf
| overload
]
[
match-interface
| {
interface-name
}
]
no
ip
nat
inside
source
list
{
access-list-number
| access-list-name
}
pool
name
[
vrf
name
]
[
match-in-vrf
| overload
]
[
match-interface
| {
interface-name
}
]
Static NAT
ip
nat
inside
source
static
local-ip
global-ip
[
vrf
name
]
[
match-in-vrf
[
track
track-id
]
[
pool
name
]
|
pool
name
|
no-payload
{
match-in-vrf
[
pool
name
]
|
pool
name
}
| [
egress-interface
type
]
|
[extendable]
{
[
match-in-vrf
[
pool
name
]
]
|
pool
name
|
no-payload
{
match-in-vrf
[
pool
name
]
|
pool
name
}
}
]
no
ip
nat
inside
source
static
local-ip
global-ip
[
vrf
name
]
[
match-in-vrf
[
track
track-id
]
[
pool
name
]
|
pool
name
|
no-payload
{
match-in-vrf
[
pool
name
]
|
pool
name
}
| [
egress-interface
type
]
|
[extendable ]
{
[
match-in-vrf
[
pool
name
]
]
|
pool
name
|
no-payload
{
match-in-vrf
[
pool
name
]
|
pool
name
}
}
]
Syntax Description
|
list
access-list-number
|
Specifies the number of a standard IP access list. Packets with source addresses that pass the access list are dynamically
translated using global addresses from the named pool.
|
|
list
access-list-name
|
Specifies the name of a standard IP access list. Packets with source addresses that pass the access list are dynamically
translated using global addresses from the named pool.
|
|
interface
|
Specifies an interface for the global address.
|
|
type
|
Interface type. For more information, use the question mark (?) to enable the online help function.
|
|
number
|
Interface or subinterface number. For more information about the numbering syntax for your networking device, use the question
mark (?) to enable the online help function.
|
|
pool
name
|
Specifies the name of the pool from which global IP addresses are allocated dynamically.
From Cisco IOS XE Catalyst SD-WAN Release 17.5.1a, you can use a NAT pool for static NAT.
|
|
overload
|
(Optional) Enables the device to use one global address for many local addresses. When overloading is configured, the TCP
or UDP port number of each inside host distinguishes between the multiple conversations using the same local IP address.
|
|
vrf name
|
(Optional) Associates the NAT translation rule with a particular VPN routing and forwarding (VRF) instance.
|
|
egress-interface type
|
(Optional) Specifies the type of egress interface used for port forwarding with NAT DIA.
|
|
match-in-vrf
|
(Optional) Enables NAT inside and outside traffic in the same VRF.
|
|
match-interface
interface-name
|
Specifies the interface name to apply the centralized data policy to for matching a NAT method with a NAT DIA egress interface.
|
|
track
track-id
|
(Optional) Enables service-side NAT object tracking of LAN prefixes and LAN interfaces.
|
|
static
|
Sets up a single static translation.
|
|
local-ip
|
Local IP address assigned to a host on the inside network. The address could be randomly chosen, allocated from RFC 1918,
or be an obsolete one.
|
|
global-ip
|
Globally unique IP address of an inside host as it appears to the outside network.
|
|
extendable
|
(Optional) Extends the translation.
|
|
forced
|
(Optional) Forcefully deletes an entry and its children from the configuration.
|
|
tcp
|
Establishes the TCP protocol.
|
|
udp
|
Establishes the UDP protocol.
|
|
local-port
|
Local TCP or UDP port. The range is from 1 to 65535.
|
|
global-port
|
Global TCP or UDP port. The range is from 1 to 65535.
|
Command Default
No NAT translation of inside source addresses occurs.
Command Modes
Global configuration (config)
Command History
|
Release
|
Modification
|
|
Cisco IOS XE Catalyst SD-WAN Release 17.2.1v
|
Command qualified for use in Cisco vManage CLI templates.
|
|
Cisco IOS XE Catalyst SD-WAN Release 17.5.1a
|
This command was modified. The pool
pool keyword-argument pair is supported for static NAT.
|
|
Cisco IOS XE Catalyst SD-WAN Release 17.8.1a
|
This command was modified. Added the track keyword for service-side NAT object tracking.
|
|
Cisco IOS XE Catalyst SD-WAN Release 17.9.1a
|
This command was modified. Added the egress-interface
type keyword for port forwarding for NAT DIA.
|
|
Cisco IOS XE Catalyst SD-WAN Release 17.14.1a
|
This command was modified. Added the
match-interface
interface-name keyword fork mapping multiple NAT methods for NAT DIA.
|
The following example shows how to translate between inside hosts addressed from one network to the globally unique network:
Device(config)# ip nat pool net-209 10.255.255.254 10.255.255.255 prefix-length 28
ip nat inside source list 1 pool net-209
!
interface ethernet 0
ip address 10.0.0.1 255.255.255.224
ip nat outside
!
interface ethernet 1
ip address 10.255.255.254 10.255.255.255
ip nat inside
!
access-list 1 permit 192.168.255.255 255.255.0.
access-list 1 permit 192.168.255.255 255.255.224.
The following example shows how to translate local traffic to an edge device that is using NAT (NAT-PE):
Device(config)# ip nat inside source list 1 interface ethernet 0 vrf vrf1 overload
ip nat inside source list 1 interface ethernet 0 vrf vrf2 overload
!
ip route vrf vrf1 0.0.0.0 0.0.0.0 192.168.255.254
ip route vrf vrf2 0.0.0.0 0.0.0.0 192.168.255.255
!
access-list 1 permit 0.0.0.0 255.0.0.0
!
ip nat inside source list 1 interface ethernet 1 vrf vrf1 overload
ip nat inside source list 1 interface ethernet 1 vrf vrf2 overload
!
ip route vrf vrf1 0.0.0.0 0.0.0.0 192.168.0.0 global
ip route vrf vrf2 0.0.0.0 0.0.0.0 192.168.0.1 global
access-list 1 permit 0.0.0.0 255.0.0.0
The following example shows how to configure a NAT pool using static inside NAT.
Device(config)# ip nat pool natpool1 10.11.11.1 10.11.11.30 prefix-length 24
ip nat pool natpool2 10.11.11.5 10.11.11.6 prefix-length 24
ip nat inside source list global-list pool natpool1 vrf 1 match-in-vrf
ip nat inside source list global-list pool natpool2 vrf 1 match-in-vrf
ip nat inside source static 192.168.11.10 10.11.11.10 vrf 1 match-in-vrf pool natpool1
The following example shows how to configure a NAT pool using static inside and static outside NAT.
Device(config)# ip nat pool natpool1 10.11.11.1 10.11.11.30 prefix-length 24
ip nat pool natpool2 10.11.11.5 10.11.11.6 prefix-length 24
ip nat inside source list global-list pool natpool1 vrf 1 match-in-vrf
ip nat inside source list global-list pool natpool2 vrf 1 match-in-vrf
ip nat inside source static 192.168.11.10 10.11.11.10 vrf 1 match-in-vrf pool natpool1
ip nat outside source static 192.168.21.10 10.22.22.10 vrf 1 match-in-vrf pool natpool1
The following example shows how to configure an inside static NAT global pool with a tracker name and a tracker ID for tracking
service-side NAT objects:Device(config)# ip nat inside source static 192.168.11.10 10.11.11.10 vrf 1 match-in-vrf track 1
For more information on configuring the service-side NAT object tracker, see the Cisco SD-WAN NAT Configuration Guide.
The following example shows how to configure NAT DIA port forwarding:
Device(config)# interface GigabitEthernet1
ip address 10.1.2.1 255.255.255.0
ip nat outside
negotiation auto
no mop enabled
no mop sysid
end
ip nat inside source list nat-dia-vpn-hop-access-list interface GigabitEthernet1 overload
ip nat inside source static tcp 192.168.1.100 443 interface GigabitEthernet1 8443 vrf 1
ip nat inside source static tcp 192.168.1.100 80 10.1.2.10 80 vrf 1 egress-interface
GigabitEthernet1
ip nat inside source static tcp 192.168.1.100 22 10.1.2.20 2020 vrf 1 egress-interface
GigabitEthernet1
For more information on configuring NAT DIA port forwarding, see the Cisco SD-WAN NAT Configuration Guide.
The following is a sample configuration for configuring multiple NAT DIA where the default NAT method is using a NAT pool
and the alternative or secondary NAT method is using interface overload with match-interface:
interface GigabitEthernet1
ip address 10.1.1.1 255.255.255.0
no ip redirects
load-interval 30
negotiation auto
ip nat outside
!
ip nat inside source list dia-list 1 pool natpool1 overload egress-interface GigabitEthernet1
ip nat inside source list dia-list 1 interface GigabitEthernet1 overload match-interface GigabitEthernet1
For more information about configuring the multiple NAT methods for an interface using CLI, see the section "Configure Multiple
NAT Types Using CLI" in Cisco SD-WAN NAT Configuration Guide.
Feedback