What do these three options in a Cisco Router NAT configuration mean?

Question

In a standard Static PAT configuration, where one IP:Port combination is always mapped to another IP:Port combination, there are three possible combinations of inside/outside/source/destination that can be configured.

For example, this is a configuration example:

ip nat inside source static tcp 10.0.20.13 8080 2.2.2.33 80
       ^^^^^^^^^^^^^

In layman's terms, this configuration allows any Outside host to initiate a TCP connection to the IP 2.2.2.33 over port 80. When this packet hits the router, the destination IP Address and Port (2.2.2.33:80) gets translated to 10.0.20.13:8080.

The reverse would also happen, if the inside host 10.0.20.13 sends a TCP packet with a source port of 8080, as this packet crosses the router, the source IP and Port (10.0.20.13:8080) gets translated to 2.2.2.33:80. (this would typically be a response packet, rather than one initiated from the Inside host)

---

Here are all the three configuration options for the marked portion above:

Router(config)#ip nat inside ?
  destination  Destination address translation
  source       Source address translation

Router(config)#ip nat outside ?
  source  Source address translation

In effect, you could configure:

• ip nat inside source static tcp {IP} {Port} {IP} {Port}
• ip nat inside destination static tcp {IP} {Port} {IP} {Port}
• ip nat outside source static tcp {IP} {Port} {IP} {Port}

How are these options different and when would one use each of the three options? Please use layman's terms like I did above to describe how each would manipulate packets that were coming through the device.

Also, can anyone tell me why there is no outside destination option?

Answer 1

We must start from the basics, so let's revise NAT terminology. NAT translates IP addresses in IP packets, right? What does that mean? That it, basically, creates mirages - yes, optical illusions, you know. For example, in a typical NAT configuration when private-addressed LAN hosts access Internet by using external router interface's public IP address those hosts appear for Internet servers as having this public IP (or IPs from a pool of public IPs). NAT does not create new physical hosts, of course - but it create kind of new virtual entities - in this example, the LAN hosts see themselves as, let's say 192.168.1.x but Internet servers see them as 203.0.113.x - one set of physical hosts but two sets of IP addresses. Two distinct sets of (logical) hosts. Optical illusion. And the terminology is this:

• inside local - "real" IP addresses of the internal hosts as assigned to their interfaces and as they see each other
• inside global - "mirage" IP addresses as seen by the outside world
• outside global - "real" IP addresses of the external hosts as they seen by themselves and by (almost) entire Internet
• outside local - "mirage" IP addresses as we see external hosts (if we asked NAT to translate correspondingly)

And as you can see, we are obliged to make a distinction between our network and the Internet or another external network. We do this by marking our router's IP interfaces as either ip nat inside or ip nat outside, agree?

Now let's remember how NAT is usually implemented: it maintains special tables that contain entries about translations. And the important point is that these entries can be created either statically or dynamically. For dynamically created entries, the direction of traffic is important - is the traffic initiated from inside to outside or vice versa? For static entries, this is not so - they are symmetrical. NAT configuration statements that contain the static keyword create static entries immediately after putting them into the running config; those with the dynamic keyword watch for the interesting traffic and dynamically create translation entries, which will then eventually time out.

We can already speculate about your last question: why there is no outside destination option? ip nat inside source static creates static NAT entry that translates exactly as you described, but this includes not only the traffic initiated from one particular side - static NAT entries are symmetrical. So, ip nat outside destination static would create a static entry for translating destination IP addresses of traffic entering into your network from the outside AND source IP addresses for traffic going from inside - but this is exactly what ip nat inside source static command does! So, it's simply redundant to have this command. The only difference is that you would interchange the source with the destination ip when using one or another form of basically the same command.

In regard to your first statement, "there are three possible combinations of inside/outside/source/destination that can be configured" - this is not quite so. The point is that, generally speaking, NAT configuration statements are not "math formulas" and should be considered wholly, and not as builded logically from independed keywords. So, each "combination" presents a solution for a particular task, for example, ip nat inside destination list is used for configuring server TCP load balancing that uses specific algorithm and does not work with UDP. Also, (in modern IOSes) there is no ip nat inside destination static command - have you actually tried it with the static option?

You can see some particular scenarios of using NAT including configuration examples in this Cisco paper: http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_nat/configuration/12-2sx/nat-12-2sx-book/iadnat-addr-consv.html

Finally, I would like to mention that sometimes NAT is not what you want, for example, look at my answer for this "canonical question": https://serverfault.com/questions/55611/loopback-to-forwarded-public-ip-address-from-local-network-hairpin-nat/733532#733532

PS Should I go into more details?

Answer 2

Think about this very carefully.

Inside source means that you want to translate the source address from traffic originating inside your network. This is the typical "home networking" arrangement which allows you to use private addresses on the public Internet. Of course, this is not the only use for this version.

Inside destination means that you want traffic originating from an outside address to a particular destination transport protocol and port to go to a particular inside address. This is what home users do to allow something like a web server with a private address to be accessed from the public Internet. Of course, this is not the only use for this version.

Outside source translates traffic originating from outside to look like it originated from an inside address. It can useful in cases where companies with overlapping IP address ranges merge and need to start connecting the networks. You can translate the source addresses of traffic originating from the outside, which would normally have outside source addresses which conflict with inside addresses, to source addresses addresses in an available inside address range.

Outside destination doesn't really make a lot of sense since it is the inverse of port forwarding. This would limit any traffic originating from the inside, destined to a particular outside transport protocol and port, to a single outside address.