<!doctypehtml><html lang=en><meta charset=utf-8><title>
   Understanding NAT address types - PacketLife.net
  </title><link href=//netdna.bootstrapcdn.com/bootstrap/3.1.1/css/bootstrap.min.css rel=stylesheet><link href=/static/css/local.css rel=stylesheet><link href=/static/img/favicon.gif rel=icon type=image/gif><link title="Latest Blog Posts"href=/blog/feed/ rel=alternate type=application/rss+xml><script>var googletag = googletag || {};
googletag.cmd = googletag.cmd || [];
(function() {
var gads = document.createElement('script');
gads.async = true;
gads.type = 'text/javascript';
var useSSL = 'https:' == document.location.protocol;
gads.src = (useSSL ? 'https:' : 'http:') + 
'//www.googletagservices.com/tag/js/gpt.js';
var node = document.getElementsByTagName('script')[0];
node.parentNode.insertBefore(gads, node);
})();</script><script>googletag.cmd.push(function() {
googletag.defineSlot('/3265105/PacketLife_Blog_Top_728x90', [728, 90], 'div-gpt-ad-1394245464163-0').addService(googletag.pubads());
googletag.pubads().enableSingleRequest();
googletag.enableServices();
});</script><body><div id=wrap><div class=container><a href=/> <img alt="PacketLife.net logo"id=site_logo src=/static/img/logo.png> </a><div id=page><div class=header><nav class="navbar navbar-default"role=navigation><div class="collapse navbar-collapse"><ul class="nav navbar-nav"><li><a href=/blog/> Blog </a><li><a href=/library/cheat-sheets/> Cheat Sheets </a><li><a href=/captures/> Captures </a><li><a href=/toolbox/> Toolbox </a><li><a href=/bookshelf/> Bookshelf </a><li><a href=/about/> About </a></ul></div></nav></div><div id=content><div class=banner id=div-gpt-ad-1394245464163-0><script>googletag.cmd.push(function() { googletag.display('div-gpt-ad-1394245464163-0'); });</script></div><div class=row><div class=col-md-2></div><div class=col-md-8><div class="well text-center">Have you been looking for a better way to model your network infrastructure? Check out what we're doing with <a href=https://github.com/netbox-community/netbox> NetBox </a> ! Open source and widely extensible, NetBox has enabled thousands of organizations to automate their networks like never before possible.</div><h1 class=page-header>Understanding NAT address types</h1><h5 class=text-muted>By <a href> stretch </a> | Thursday, January 7, 2010 at 2:11 a.m. UTC</h5><div class=article><div><p>My first networking job was as an airman in the US Air Force. Having been <a href=http://en.wikipedia.org/wiki/History%20of%20the%20Internet> deepy involved </a> with early Internet development, the US military owns <a href=http://royal.pingdom.com/2008/02/13/where-did-all-the-ip-numbers-go-the-us-department-of-defense-has-them/> significant chunks </a> of the IPv4 address space. As such, network address translation (NAT) is often unnecessary on DoD-owned networks. While this made for convenient design, it prevented me from gaining vital real-world experience with NAT until later on in my career.<p>When first studying NAT, I remember being most confused by the addressing terminology. An IP address as related to NAT falls into one of four categories, as seen in the output of <code>
            show ip nat translations
           </code> on IOS:<ul><li><strong> Inside global </strong><li><strong> Inside local </strong><li><strong> Outside local </strong><li><strong> Outside global </strong></ul><p>None of the explanations I read in books at the time settled well in my mind, until I was able to grasp a key concept: there are two attributes of each address in play here: <em> location </em> and <em> perspective </em> .<p><img alt=NAT_classes_chart.png class=center-block src=/media/blog/attachments/285/NAT_classes_chart.png><p><em> Location </em> is described by the first word in the tuple, either <em> inside </em> or <em> outside </em> . It refers to the "side" of the NAT boundary router in which the address logically exists. In a typical NAT deployment, inside addresses will usually (but not necessarily) be private <a href=http://tools.ietf.org/html/rfc1918> RFC 1918 </a> addresses, and outside addresses will usually be globally routable (registered) IP addresses.<p><em> Perspective </em> refers to the side of the NAT boundary from which the address is observed, either <em> local </em> or <em> global </em> . If an address is seen by an inside host, it is being observed <em> locally </em> . If an address is seen by an outside host, it is observed <em> globally </em> .<p>A practical example should help clarify this distinction. To begin with, consider a simple one-to-one static NAT mapping configured on R2 (no layer four port translation is involved in this example).<p><img alt=NAT_boundary.png class=center-block src=/media/blog/attachments/286/NAT_boundary.png><pre>interface FastEthernet0/0
 ip address 10.0.0.1 255.255.255.252
 ip nat outside
!
interface FastEthernet0/1
 ip address 192.168.0.1 255.255.255.0
 ip nat inside
!
ip nat inside source static 192.168.0.10 192.0.2.10
</pre><p>This static mapping creates a simple NAT translation rule:<pre>R2# <strong>show ip nat translations</strong>
Pro Inside global      Inside local       Outside local      Outside global
--- 192.0.2.10         192.168.0.10       ---                ---
</pre><p>Note that only the first two address classes have entries. This is because no stateful session is being tracked, and thus there is only one address, the <em> inside </em> address. The entry describes both the global and local <em> perspectives </em> of a single inside address.<p>To summarize:<ul><li><strong> Inside global: </strong> The address of the inside host as seen from the outside<li><strong> Inside local: </strong> The address of the inside host as seen from the inside</ul><p>If we initiate a TCP session from R1 to R3, we can see that a second, temporary NAT translation is created, this time with all four classes populated with an address:<pre>R2# <strong>show ip nat translations</strong>
Pro Inside global      Inside local       Outside local      Outside global
<em>tcp 192.0.2.10:23      192.168.0.10:23    10.0.0.2:32978     10.0.0.2:32978</em>
--- 192.0.2.10         192.168.0.10       ---                ---
</pre><p>The meanings of the first two columns are the same as with our static entry; they describe the globally- and locally-significant addresses of the inside host. The second two columns note the locally- and globally-significant addresses of the <em> outside </em> host. The two addresses of the outside address are identical, as global addresses are not being translated between sides of the NAT boundary.<p><img alt=NAT_packet.png class=center-block src=/media/blog/attachments/287/NAT_packet.png><p>To review:<ul><li><strong> Inside global: </strong> The address of the inside host as seen from the outside<li><strong> Inside local: </strong> The address of the inside host as seen from the inside<li><strong> Outside local: </strong> The address of the outside host as seen from the inside<li><strong> Outside global: </strong> The address of the outside host as seen from the outside</ul></div></div><div class=text-right><p class=text-muted>Posted in <a href=/blog/category/design/> Design </a></div><div class=text-center><a href=https://amzn.to/2TlGfnH> <img height=60 src=/static/a/amazon.jpg width=468> </a><p class=subtext>Support PacketLife by buying stuff you don't need!</div><a name=comments> </a><h4 class="text-center text-muted">Comments</h4><hr><a name=c2135> </a><div class=row><div class="col-md-4 text-right"><strong> Josh </strong><br><small class=text-muted> January 7, 2010 at 2:24 a.m. UTC </small></div><div class=col-md-8><p>Best Explanation for NAT I have seen. Good show!<hr></div></div><a name=c2136> </a><div class=row><div class="col-md-4 text-right"><strong> gsstratton </strong><br><small class=text-muted> January 7, 2010 at 2:34 a.m. UTC </small></div><div class=col-md-8><p>One of the more confusing aspects covered by CCNA. Setting up pools of dynamic mappings is a very good way to conserve the ever-dwindling amount of IPv4 addresses. When I was in college they had an entire B block reserved, and gave out publicly routed IP addresses to every client. Maybe Stretch can give me some insight as to why this was preferred, other than lazy network admins?<hr></div></div><a name=c2137> </a><div class=row><div class="col-md-4 text-right"><strong> tacack </strong><br><small class=text-muted> January 7, 2010 at 3:20 a.m. UTC </small></div><div class=col-md-8><p>Dude, you should really get into training :) I'd pay to join your class!<hr></div></div><a name=c2138> </a><div class=row><div class="col-md-4 text-right"><strong> tomset </strong><br><small class=text-muted> January 7, 2010 at 4:06 a.m. UTC </small></div><div class=col-md-8><p>I was just thinking yesterday about how confusing that terminology was. Now I understand it much better. Thanks Stretch!<hr></div></div><a name=c2139> </a><div class=row><div class="col-md-4 text-right"><strong> pompeychimes </strong><br><small class=text-muted> January 7, 2010 at 4:08 a.m. UTC </small></div><div class=col-md-8><p>Maybe this should be a cheat sheet?<hr></div></div><a name=c2140> </a><div class=row><div class="col-md-4 text-right"><a href=http://ITDualism.wordpress.com/> <strong> Rofi Neron </strong> </a><br><small class=text-muted> January 7, 2010 at 4:19 a.m. UTC </small></div><div class=col-md-8><p>I was going over NAT as I do my CCNP studies. thanks for the good clear explanation<hr></div></div><a name=c2141> </a><div class=row><div class="col-md-4 text-right"><strong> Joe C </strong><br><small class=text-muted> January 7, 2010 at 4:27 a.m. UTC </small></div><div class=col-md-8><p>Great Post, thanks!!<hr></div></div><a name=c2143> </a><div class=row><div class="col-md-4 text-right"><strong> skoal </strong><br><small class=text-muted> January 7, 2010 at 10:05 a.m. UTC </small></div><div class=col-md-8><p>I'd love to see a cheat sheet too.<hr></div></div><a name=c2144> </a><div class=row><div class="col-md-4 text-right"><strong> Jim </strong><br><small class=text-muted> January 7, 2010 at 1:16 p.m. UTC </small></div><div class=col-md-8><div><p>I have to agree. By far the best explanation to date.<p>Thanks Stretch</div><hr></div></div><a name=c2145> </a><div class=row><div class="col-md-4 text-right"><strong> aryanarora1984 </strong><br><small class=text-muted> January 7, 2010 at 1:33 p.m. UTC </small></div><div class=col-md-8><p>I can't see any tab on blog to visit recent posts<hr></div></div><a name=c2146> </a><div class=row><div class="col-md-4 text-right"><strong> aconaway </strong><br><small class=text-muted> January 7, 2010 at 2:34 p.m. UTC </small></div><div class=col-md-8><p>That some good eatin', Stretch. I've always had to brute force my thought process though all those NAT details. Thanks for being thoughtful enough to show us the logic.<hr></div></div><a name=c2148> </a><div class=row><div class="col-md-4 text-right"><strong> Andrew </strong><br><small class=text-muted> January 7, 2010 at 5:17 p.m. UTC </small></div><div class=col-md-8><div><p>I've always felt that this whole concept of 'inside' and 'outside' was absurd. Just NAT on the involved interface as traffic enters or exits...sheesh. :)<p>Anyhow now that NVI is available we can at least drop those useless words from the NAT config, and therefore the concept. The whole inside/outside thing made me want to gag myself with an NM.</div><hr></div></div><a name=c2149> </a><div class=row><div class="col-md-4 text-right"><a href=http://blog.ioshints.info/> <strong> Ivan Pepelnjak </strong> </a><br><small class=text-muted> January 7, 2010 at 5:19 p.m. UTC </small></div><div class=col-md-8><p>Perfect explanation. I love the table ;)<hr></div></div><a name=c2150> </a><div class=row><div class="col-md-4 text-right"><strong> krishna </strong><br><small class=text-muted> January 8, 2010 at 2:03 a.m. UTC </small></div><div class=col-md-8><p>Excellent post<hr></div></div><a name=c2151> </a><div class=row><div class="col-md-4 text-right"><strong> shivlu </strong><br><small class=text-muted> January 8, 2010 at 12:54 p.m. UTC </small></div><div class=col-md-8><p>The GUI difference shown is really awesome.<hr></div></div><a name=c2152> </a><div class=row><div class="col-md-4 text-right"><strong> ppinto </strong><br><small class=text-muted> January 8, 2010 at 2:31 p.m. UTC </small></div><div class=col-md-8><p>Excellent post<hr></div></div><a name=c2153> </a><div class=row><div class="col-md-4 text-right"><strong> ccie14745 </strong><br><small class=text-muted> January 9, 2010 at 3:21 a.m. UTC </small></div><div class=col-md-8><p>This sort of perspective is crucial for non-Cisco gear as well. Any time a NAT is used, it's a routing boundary that presents confusion to end users and application owners. I always map these sorts of things, though I'm not a fan of Cisco's terminology to describe it. In fact, terminiology for NAT is about as fragmented in this industry as any other area, between source nat, hide nat, overload, global inside. Ugh.<hr></div></div><a name=c2155> </a><div class=row><div class="col-md-4 text-right"><strong> adt1983 </strong><br><small class=text-muted> January 10, 2010 at 12:25 a.m. UTC </small></div><div class=col-md-8><div><p>Click! And another Cisco concept makes sense thanks to Packet Life!<p>Not a difficult concept, just Cisco's explanation! Thank you Jeremy!</div><hr></div></div><a name=c2156> </a><div class=row><div class="col-md-4 text-right"><strong> mspn </strong><br><small class=text-muted> January 11, 2010 at 7:54 a.m. UTC </small></div><div class=col-md-8><p>Can there be a difference between outside global and outside local at any time? This could only happen, if my router knows about a nat config on the far end side, correct? Thanks for your great explanations.<hr></div></div><a name=c2158> </a><div class=row><div class="col-md-4 text-right"><strong> wtsexton </strong><br><small class=text-muted> January 11, 2010 at 7:51 p.m. UTC </small></div><div class=col-md-8><div><p>@mspn<p>Not that I've ever seen the inside end does not know about the outside.</div><hr></div></div><a name=c2173> </a><div class=row><div class="col-md-4 text-right"><strong> justbailey </strong><br><small class=text-muted> January 14, 2010 at 4:56 p.m. UTC </small></div><div class=col-md-8><div><p>very good explanation<p>"location and perspective."<p>this approach makes it easy to logically think out what the "show ip nat translations" is telling us.<p>thanks,</div><hr></div></div><a name=c2295> </a><div class=row><div class="col-md-4 text-right"><strong> EthernetNinja </strong><br><small class=text-muted> February 18, 2010 at 1:34 a.m. UTC </small></div><div class=col-md-8><div><p>This has always been a confusing issue for students and its partly Cisco's fault for making these <em> bad </em> early definitions and sticking to them. It would have been more advantageous to use a 'Actual' SRC/DEST and 'Translated' SRC/DEST type of table.<p>Oh well.</div><hr></div></div><a name=c3006> </a><div class=row><div class="col-md-4 text-right"><strong> Robert </strong><br><small class=text-muted> August 8, 2010 at 12:09 p.m. UTC </small></div><div class=col-md-8><div><p>Jeremy,<p>ip nat inside source static 192.168.0.10 192.0.2.10<p>Where does the 192.0.2.10 come from? In your figure I don't see any interface with that ip address??<p>Cheers,<p>Robert</div><hr></div></div><a name=c3007> </a><div class=row><div class="col-md-4 text-right"><strong> stretch </strong><br><small class=text-muted> August 8, 2010 at 3:18 p.m. UTC </small></div><div class=col-md-8><p>@Robert: It's simply a static translation rule, similar to if I had created a NAT address pool, but with only a single IP address mapping.<hr></div></div><a name=c3652> </a><div class=row><div class="col-md-4 text-right"><strong> Hax </strong><br><small class=text-muted> December 29, 2010 at 7:47 a.m. UTC </small></div><div class=col-md-8><p>Hy That is the best NAT explanation ewer seen ..THX<hr></div></div><a name=c3760> </a><div class=row><div class="col-md-4 text-right"><strong> Frank Snead </strong><br><small class=text-muted> January 18, 2011 at 7:11 p.m. UTC </small></div><div class=col-md-8><div><p>Just a thought..<p>Router B's public address has to be on that subnet that you are SNAT-ing to. In order for this to work it should be like this:<pre>interface FastEthernet0/0
 ip address 192.0.2.10 255.255.255.0
 ip nat outside
</pre><p>Or is there some cisco NAT black magic I am not understanding? SNAT creates a 1 to 1 mapping but the "Inside Global" or "Outside NAT Address" as the rest of the world calls it still has to be routable on that interface. I can't just SNAT something I don't have and expect it to be routable. Or maybe I am just stupid.....</div><hr></div></div><a name=c4354> </a><div class=row><div class="col-md-4 text-right"><strong> Viper_mania </strong><br><small class=text-muted> May 7, 2011 at 5:07 a.m. UTC </small></div><div class=col-md-8><p>Awesome explanation !! Thanks a ton :)<hr></div></div><a name=c4453> </a><div class=row><div class="col-md-4 text-right"><strong> Sahil </strong><br><small class=text-muted> June 2, 2011 at 6:06 a.m. UTC </small></div><div class=col-md-8><p>Thanks..u r really doing a good job..... thanks for the clear explanation.<hr></div></div><a name=c4549> </a><div class=row><div class="col-md-4 text-right"><strong> Stephen Stought </strong><br><small class=text-muted> June 28, 2011 at 3:58 p.m. UTC </small></div><div class=col-md-8><div><p>Frank,<p>Thanks for the comment, it forced me to model the whole thing in GNS3 and really get a good understanding. R2's Fa0/0 does not need to change. The entire model works with a default route from r3 to r2 192.168.0.1 and a static 'ip route 192.0.2.0 255.255.255.0 10.0.0.1' in r1. Add a firewall and this would be a valid B2B environment. i.e a business partner that was using the 192.168.0.0/24 space but not the 192.0.2.0/24 space.<p>Excellent work Stretch!!!<p>Steve</div><hr></div></div><a name=c4972> </a><div class=row><div class="col-md-4 text-right"><strong> Chip </strong><br><small class=text-muted> November 8, 2011 at 6:38 p.m. UTC </small></div><div class=col-md-8><div><p>The trick question is (for 100 points):<p>can you use NAT to acces a host that does not have a gateway set ?? :D<p>ex :<p>HostB ip 10.10.10.2 /24 ( NO gateway set ) <br> R1 fa0 ip 10.10.10.1 /24 <br> R1 fa1 ip 10.20.20.1 /24 <br> HostB ip 10.20.20.2 /24 gateway to 10.20.20.1<p>How can you use NAT to ping from B to A. <br> The ideea is to modify the packets source adress while passing R1. as if the ping was initiated from R1 fa0's interface<p>Ofcourse a ping from B to anything else except local lan would not work cause no route :D</div><hr></div></div><a name=c6390> </a><div class=row><div class="col-md-4 text-right"><strong> A guest </strong><br><small class=text-muted> July 1, 2013 at 10:41 a.m. UTC </small></div><div class=col-md-8><div><p>I went and read the Cisco site on this and it just left me confused, this article was crystal clear when I realised the differences were regarding perspective.<p>In addition to this the article was only as long as it needed to be where as Cisco's is about 4 times longer.</div><hr></div></div><a name=c6446> </a><div class=row><div class="col-md-4 text-right"><strong> A guest </strong><br><small class=text-muted> August 1, 2013 at 9:15 p.m. UTC </small></div><div class=col-md-8><p>Amazing explanation!!!! Thank you very much!!!<hr></div></div><a name=c6552> </a><div class=row><div class="col-md-4 text-right"><strong> Alex </strong><br><small class=text-muted> September 21, 2013 at 11:29 p.m. UTC </small></div><div class=col-md-8><p>Excellent explanation. Like you, the book definitions weren't cutting it for me. Thanks much!<hr></div></div><a name=c6623> </a><div class=row><div class="col-md-4 text-right"><strong> tyrone </strong><br><small class=text-muted> November 8, 2013 at 12:01 p.m. UTC </small></div><div class=col-md-8><p>very simple and good explanation, congrat for all your posts<hr></div></div><a name=c6633> </a><div class=row><div class="col-md-4 text-right"><strong> Edgar </strong><br><small class=text-muted> November 13, 2013 at 6:08 p.m. UTC </small></div><div class=col-md-8><p>Excelent explanation!!!, it was a confusing topic for me, keep going with this kind of work!<hr></div></div><a name=c6813> </a><div class=row><div class="col-md-4 text-right"><strong> grateful </strong><br><small class=text-muted> March 11, 2014 at 6:43 p.m. UTC </small></div><div class=col-md-8><p>Thank you!! Though I understand the concept of NAT, I could not grasp these four terms. This is the best breakdown I've found. Many, many thanks!<hr></div></div><a name=c6964> </a><div class=row><div class="col-md-4 text-right"><strong> etsiap </strong><br><small class=text-muted> May 8, 2014 at 6:42 p.m. UTC </small></div><div class=col-md-8><p>Thanks for the clear definition!<hr></div></div><a name=c7134> </a><div class=row><div class="col-md-4 text-right"><strong> Val </strong><br><small class=text-muted> July 16, 2014 at 6:59 a.m. UTC </small></div><div class=col-md-8><p>Thanks. this is just the right explanation i have been searching for.<hr></div></div><a name=c7334> </a><div class=row><div class="col-md-4 text-right"><strong> Matt48 </strong><br><small class=text-muted> October 2, 2014 at 6:43 a.m. UTC </small></div><div class=col-md-8><div><p>I understand the stages of address states from original to translated, except for how the (outside local) address is processed.<p>My theory is that the (outside local) address is seen on the private network to which it is not a member, as the same ip as the (outside global) address.<p>For the device with an outside global (internet) address, that is connected to its own local network, it would have an outside local address that is different from its outside global address, in its private network.<p>I envision two private networks facing each other through the internet, and the addresses of each.<p>But are there internet-only devices with no local network connection, and what of the outside local address then?</div><hr></div></div><a name=c7399> </a><div class=row><div class="col-md-4 text-right"><strong> Humair </strong><br><small class=text-muted> November 1, 2014 at 9:37 a.m. UTC </small></div><div class=col-md-8><p>Well done mate. Excellent work! Keep it up.<hr></div></div><a name=c7664> </a><div class=row><div class="col-md-4 text-right"><strong> Hemachandra </strong><br><small class=text-muted> April 26, 2015 at 6:27 p.m. UTC </small></div><div class=col-md-8><p>Thank you<hr></div></div><a name=c7865> </a><div class=row><div class="col-md-4 text-right"><strong> Geo_John </strong><br><small class=text-muted> August 29, 2015 at 9:44 a.m. UTC </small></div><div class=col-md-8><p>Thanks jeremy<hr></div></div><a name=c8077> </a><div class=row><div class="col-md-4 text-right"><strong> Bry </strong><br><small class=text-muted> January 29, 2016 at 3:02 p.m. UTC </small></div><div class=col-md-8><p>Thanks! After reading this post NAT makes more sense. Great explanation on how to distinguish between all the terminologies.<hr></div></div><a name=c8120> </a><div class=row><div class="col-md-4 text-right"><strong> Lewis </strong><br><small class=text-muted> March 2, 2016 at 7:47 p.m. UTC </small></div><div class=col-md-8><div><p>Best description for the four terms most often confused.<p>Inside global: The address of the inside host as seen from the outside Inside local: The address of the inside host as seen from the inside Outside local: The address of the outside host as seen from the inside Outside global: The address of the outside host as seen from the outside</div></div></div><div class="alert alert-info">Comments have closed for this article due to its age.</div></div><div class=col-md-2></div></div></div></div><div class=text-center><ul class="list-inline outertext"id=footernav><li><a href=/> Home </a><li>|<li><a href=/blog/> Blog </a><li>|<li><a href=/library/cheat-sheets/> Cheat Sheets </a><li>|<li><a href=/captures/> Captures </a><li>|<li><a href=/toolbox/> Toolbox </a><li>|<li><a href=/bookshelf/> Bookshelf </a><li>|<li><a href=/about/> About </a></ul></div></div></div><div id=footer><div class="container text-center small"><strong> More cool stuff </strong><ul class=list-inline><li><a href=http://networking-forum.com/> networking-forum.com </a><li>|<li><a href=http://www.reddit.com/r/networking/> r/Networking </a><li>|<li><a href=http://inetpro.org/wiki/> Internetworkpro </a><li>|<li><a href=http://firewall.cx/> firewall.cx </a><li>|<li><a href=http://networkengineering.stackexchange.com/> Network Engineering @ StackExchange </a></ul></div></div><script src=//ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js></script><script src=//netdna.bootstrapcdn.com/bootstrap/3.1.1/js/bootstrap.min.js></script><script async src=https://www.googletagmanager.com/gtag/js?id=UA-3943290-1></script><script>window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('js', new Date());

  gtag('config', 'UA-3943290-1');</script>