LogoفارسیFA

Hands-On Lab: Configuring PAT (NAT Overload)

This hands-on lab configures Port Address Translation using the overload keyword, allowing many internal hosts to share a single public IP address simultaneously, and verifies each host is distinguished by a unique translated port number.

PAT ConfigurationNAT OverloadPort-Based Translation

~3 min read · Updated Sep 23, 2026

Lab Objective

Configure PAT on a router so multiple internal hosts share the single public IP address assigned to the outside interface, and verify simultaneous sessions from different hosts are correctly distinguished by port number.

Lab Purpose

Dynamic NAT, covered in the previous lab, still requires one public address per simultaneously active host. PAT removes this limitation entirely by allowing many internal hosts to share a single public address at once, distinguishing between them using different source port numbers — by far the most common NAT configuration in real-world networks, including nearly every home router.

Lab Topology

R1
  Gi0/0 (inside): 192.168.65.1/24
  Gi0/1 (outside): 203.0.113.50/30

Internal hosts: PC-A (192.168.65.10),
                PC-B (192.168.65.11),
                PC-C (192.168.65.12)

No pool needed -- all hosts will share
R1's own outside interface address

Task 1: Configure Basic Addressing and Interfaces

Configure both interfaces, marking Gi0/0 as inside and Gi0/1 as outside.

Task 2: Define an ACL Identifying Eligible Internal Traffic

Create a standard ACL matching the internal subnet.

Task 3: Configure PAT Using the Overload Keyword

Configure NAT to translate matched traffic using the outside interface's own address, with the overload keyword enabling port-based translation.

Task 4: Generate Simultaneous Traffic from Multiple Hosts

Generate traffic from all three internal hosts at once.

Task 5: Verify All Hosts Share One Public Address

Confirm the translation table shows all three hosts mapped to the same public address, distinguished only by port number.

Solution and Verification

R1(config)# interface gigabitethernet0/0
R1(config-if)# ip address 192.168.65.1 255.255.255.0
R1(config-if)# ip nat inside
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)# interface gigabitethernet0/1
R1(config-if)# ip address 203.0.113.50 255.255.255.252
R1(config-if)# ip nat outside
R1(config-if)# no shutdown

R1(config)# access-list 1 permit 192.168.65.0 0.0.0.255

R1(config)# ip nat inside source list 1 interface gigabitethernet0/1 overload

-- Unlike dynamic NAT's pool-based approach,
-- "overload" reuses the outside interface's
-- single address for every translated host,
-- adding a unique port number to distinguish
-- between them

PC-A> ping 203.0.113.1
PC-B> ping 203.0.113.1
PC-C> ping 203.0.113.1

R1# show ip nat translations

Pro  Inside global            Inside local          Outside local  Outside global
icmp 203.0.113.50:1           192.168.65.10:1       203.0.113.1    203.0.113.1
icmp 203.0.113.50:2           192.168.65.11:2       203.0.113.1    203.0.113.1
icmp 203.0.113.50:3           192.168.65.12:3       203.0.113.1    203.0.113.1

-- All three hosts share the EXACT SAME
-- outside global address (203.0.113.50),
-- distinguished only by the port number
-- appended after the colon -- this is what
-- allows an unlimited number of internal
-- hosts to share one single public address,
-- unlike the pool exhaustion limit seen with
-- dynamic NAT in the previous lab

Key Takeaway

PAT's "overload" keyword is the single word that transforms NAT from a one-to-one mapping into a true many-to-one mapping, entirely by tracking port numbers alongside the shared IP address — this is precisely why an entire home network of a dozen or more devices can share the single public IP address typically assigned by an internet service provider.

Written & researched by Dr. Shahin Siami

Related Articles

Hands-On Lab: Configuring OSPF Virtual Links

This hands-on lab connects a disconnected area to the backbone using an OSPF virtual link, addressing a design violation where an area does not have a direct physical connection to Area 0, and verifies routes flow correctly once the virtual link is established.

Continue

Hands-On Lab: Configuring an OSPF NSSA Area

This hands-on lab configures Area 1 as an NSSA, redistributing a local external route directly from within that area and verifying it propagates as a Type 7 LSA before being translated to Type 5 at the ABR, while inter-area routes from elsewhere remain blocked exactly as in a standard stub area.

Continue

Hands-On Lab: Configuring OSPF Stub and Totally Stubby Areas

This hands-on lab configures a leaf area as a standard stub area, then upgrades it to a totally stubby area, comparing the routing table size at each stage and verifying only a default route remains once fully configured.

Continue

Hands-On Lab: Configuring Multi-Area OSPF with Route Summarization

This hands-on lab configures multi-area OSPF across three routers, designating an ABR that summarizes several subnets from a leaf area into a single route advertised toward the backbone, tying together the area design and summarization concepts covered earlier in this series.

Continue

Hands-On Lab: Configuring EIGRP for IPv6

This hands-on lab configures EIGRP for IPv6 between two routers, activating the protocol directly on each interface similar to OSPFv3's approach, and highlights the mandatory router ID requirement unique to EIGRPv6.

Continue

Hands-On Lab: Configuring OSPFv3 for IPv6

This hands-on lab configures OSPFv3 between two routers to dynamically route IPv6 traffic, comparing its configuration syntax against the OSPFv2 labs covered earlier in this series while highlighting the interface-level activation approach OSPFv3 uses.

Continue
Previous ArticleNext Article