Destination NAT on Cisco ISR

Question

I know how to perform regular overload PAT in my lab running

sh ver
Cisco IOS XE Software, Version 16.03.09
Cisco IOS Software [Denali], ISR Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 16.3.9, RELEASE SOFTWARE (fc4)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2019 by Cisco Systems, Inc.
Compiled Mon 29-Jul-19 13:38 by mcpre

The config is:

access-list 50 permit 10.0.0.0 0.255.255.255
ip nat inside source list 50 interface GigabitEthernet0/0/1 overload

interface GigabitEthernet0/0/1
 description PUBLIC-NET
 ip address 3.3.3.1 255.255.252.0
 ip nat outside
 negotiation auto
!

interface GigabitEthernet0/0/0
 ip address 10.0.0.1 255.255.255.0
 ip nat inside
!

What I'm trying to do is a destination NAT. That is any packet going from inside to outside going to an IP address, say 4.2.2.1, gets rewritten to 1.1.1.1. Is this possible on the ISR?

Answer 1

Lets come to conculsion first before answering your question about destination NAT

Destination NAT is always inbound traffic . When outside network users wants to access inside network resources it's (outside to inside)

Example : Assuming you have hosted a application in your internal network and the requirement is wants to access application from internet in this case we will configure destination NAT with public ip provided by ip with application hosted server private ip command in cisco ISR router is as below

IP nat inside source static 10.0.0.3 132.16.18.1

Users from internet will initiate traffic with destination ip 132.16.18.1 . Traffic will hits ISR router and it's translated packet ip header to private ip and enters into internal networks and access the application and responce will fallow same path ..

As you stated in your question any packet intiàted going from inside to outside => is always considered as souce NAT command is as fallow

IP nat inside souce static "private ip "public ip"

Search for: Search … IP NAT inside source vs IP NAT outside source Lesson Contents Configuration IP NAT inside source IP NAT outside source On Cisco IOS routers we can use the ip nat inside sourceand ip nat outside source commands. Most of us are familiar with the ip nat inside source command because we often use it to translate private IP addressses on our LAN to a public IP address we received from our ISP.

What about the ip nat outside source command? Does it work in the same way as ip nat inside source?

This is the difference between the two commands:

ip nat inside source:

Translates the source IP address of packets that forwards from inside to outside. Translates the destination IP address of packets that Forwards from outside to inside.

ip nat outside source:

Translates the source IP address of packets that forward s from outside to inside. Translates the destination IP address of packets that travel from inside to outside