[Day 11] 3. Static NAT

In Static NAT, there is a one-to-one mapping between a private IP address (inside local) and a public IP address (inside global). This mapping is manually configured and stays constant. It is typically used when you want a specific internal device (e.g., a web server) to always be reachable via a fixed public IP.

Key Terms:

Inside Local IP Address: The private IP address of the internal device inside the local network (e.g.,
```
172.16.10.2
```
).
Inside Global IP Address: The public IP address used to represent the internal device to the outside world (e.g.,
```
202.208.220.2
```
).
Outside Global IP Address: The public IP address of external devices or hosts on the internet.

How Static NAT Works?

Define Interfaces:
- The inside interface is the internal network facing interface (connected to your local network).
- The outside interface is the external network facing interface (connected to the internet or external network).
```
A(config)#int g0/0 
```
```
A(config-if)#ip nat inside
```
- In this command,
```
g0/0
```
  is the internal (inside) interface connected to the private network.
```
A(config)#int g0/1
```
```
A(config-if)#ip nat outside
```
- In this command,
```
g0/1
```
  is the external (outside) interface connected to the public network (internet).

Static NAT Mapping:

You statically map each private IP address to a corresponding public IP address using the
```
ip nat inside source static
```
command.

A(config)#ip nat inside source static 172.16.10.2 202.208.220.2

A(config)#ip nat inside source static 172.16.10.3 202.208.220.3

A(config)#ip nat inside source static 172.16.10.4 202.208.220.4

In these commands:
- ```
172.16.10.2
```
  ,
```
172.16.10.3
```
  , and
```
172.16.10.4
```
  are inside local IP addresses (private IPs).
- ```
202.208.220.2
```
  ,
```
202.208.220.3
```
  , and
```
202.208.220.4
```
  are inside global IP addresses (public IPs).

These static mappings allow external devices to access the internal private devices through fixed public IPs. For example, traffic to

202.208.220.2

will be routed to

172.16.10.2

NAT Table

The router will maintain a NAT table that records these mappings. For static NAT, it will look like this:

|Inside Local|Inside Global| |---|---| |172.16.10.2|202.208.220.2| |172.16.10.3|202.208.220.3| |172.16.10.4|202.208.220.4|

This table allows the router to translate incoming traffic destined for a public IP (Inside Global) to the correct private IP (Inside Local), and vice versa for outgoing traffic.

Something Extra

Static NAT does make a machine more visible and accessible to the outside world, which can increase exposure to attacks. However, this doesn't automatically make it "easy to hack" without considering the security measures in place.
Static NAT does make a machine globally reachable, which is useful for certain types of servers.
Remember that
```
ip nat inside
```
and
```
ip nat outside
```
commands are mandatory to use.

[Day 11] 3. Static NAT

Key Terms:

How Static NAT Works?

NAT Table

Something Extra

Read Next

[Day 11] 4. Dynamic NAT

[Day 11] 5. Dynamic NAT with Overload