I am so confused with fundamentals that I used to be an expert in, so I have this topology enter image description here

Please answer to my questions separately,

Question 1) So if I have two DNS severs, and ofc two IP address( & 31) available from the ISP

This config would be suffice for Port forwarding?

Switch3650(config)#ip nat inside source static 80 80

Switch3650(config)#ip nat inside source static 80 80

Switch3650(config)#int vlan 1

Switch3650(config-if)#ip nat inside

Switch3650(config)#int fa1/2

Switch3650(config-if)#ip nat outside

and configuration of my outside interface only has to have one IP address configured or two?

Switch3650(config)#int fa1/2

Switch3650(config-if)#ip add

**or** defining two ip addresses on my interface

Switch3650(config)#int fa1/2

Switch3650(config-if)#ip add

Switch3650(config-if)#ip add secondary

am I achieving the same result here? so when do we use secondary ip, when we can't cover our available valid(public) IPs with subnet mask in one line?

so what will happen if I only put one ip address on the outside interface? the nat won't translate anymore, because it can't find the outside interface, because it's not listed in the routing table, right?

Switch3650(config-if)#ip add

Question 2)

so let's say I wanna PAT overload the rest of my network which they are not those two servers and they are clients with ip ranges from to how should I calculate the wild card mask?

Switch3650(config)#access-list 1 permit 192.168.1????????????

Switch3650(config)#ip nat inside source list 1 80 overload

this is what I put

**0 0** 0 0 0 0 0 1 = 1

**0 0** 1 1 0 0 0 1 = 49

according to this algorithm

Network Address is 0 which is wrong it has to be 1, because it starts from 1,

what am I missing?

the Netmask has to be I guess: 192 equal to wildcard of 63

Please please answer to all my questions, I am so confused


  • I know this is a packet-tracer picture, but I can't get passed the fact that Cisco Switches don't do NAT. Also, to specify ports in NAT, you also have to specify tcp or udp.
    – Ricky
    Commented Aug 13, 2019 at 5:59
  • 6500 series does Commented Aug 13, 2019 at 6:10
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Commented Nov 19, 2022 at 21:45

2 Answers 2


1) You don't need to use IP address on the interface for NAT outside address at all. For your example, if you have on your interface, you can use any other of net for the NAT, and, fo instance.

Also, your configuration with /32 mask (ip add does not have much sense for me, how you can connect this to upstream?

2) if you need NAT addresses from 1 to 49 you need to split all address space to right subnets, for your example (1-49) it can be:

access-list 1 permit  
  access-list 1 permit  
  access-list 1 permit  
  access-list 1 permit  
  access-list 1 permit  
  access-list 1 permit  
  access-list 1 permit

It will work for (1-49), but it is very strange design for me, you can just use (0-31) and (32-47) for such thing.

  • yes that was just an example but thx for bringing it, because you need 1 IP with all host 0bits for NET and 1 IP with all 1 bits host for BCast, so 2 ip from the range is already allocated which makes 32 bits mask too short for usage, can you elaborate then when does secondary IP addresses on an interface come handy? Commented Aug 13, 2019 at 6:05

As per your network topology and to accomplish your requirement in optimised way you can use both public IP address & both ip for static natting for incoming traffic to reach dns servers 192 .168.1.50 & 192.168.1 51 .example below

#Ip nat inside souce static 53

#ip nat inside source stati. 53

For your further requirements for outbound traffic for source ip range from to192.168.1.49 clients to access internet resource. Then this traffic will be outbound inside to outside for this traffic.please create PAT overload nat configuration with interface allocate ip address `#aacess-list 101 ip address

Here you can use /26 subnet wildcard mask it will provide 64 host . Your requirement is 49 client to ensure scalabilty and for future requirements 14 IPs can keep in reserve for future use

Nat overload configuration for nat translation for outbound traffic

#Ip nat inside souce list 101 interfàce Fa1/2 overload

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.