Learn how NAT and PAT translate addresses and transport identifiers, how return traffic finds the correct private session, and where related features fit.
What you will be able to do
- Distinguish basic NAT from PAT by identifying whether transport information is translated.
- Describe how PAT uses ports or other transport identifiers to share outside addressing.
- Trace the creation of a PAT binding and the translation of outbound and return traffic.
- Recognize selected PAT capabilities and limitations, including address choices, timeouts, and IPSec support.
01
What NAT and PAT do
Network Address Translation, or NAT, changes address information as traffic crosses a translation device. This lets packets use a different address representation on the other side of that device.
Port Address Translation, or PAT, goes further by translating private addresses together with transport information. Its purpose is to let multiple internal conversations share one or more outside registered IP addresses.
Basic NAT changes IP addresses only. PAT, also called NAPT or overloading, changes IP addresses and transport identifiers such as TCP or UDP ports.
Think of an internal client beginning a TCP or UDP conversation. PAT can present the conversation externally through a shared address while using a translated port to keep that conversation distinct.
02
The identifiers PAT uses
A PAT translation combines an IP address with a transport-level identifier. For TCP and UDP, that identifier is a port; for ICMP, it can be a query identifier.
The translated address may come from an address pool or from the translation device’s interface address. Port translation supplies additional distinctions when several sessions use the same outside address.
For example, two internal clients can have different private addresses but appear through one interface address. PAT assigns different outside ports so their conversations remain separately identifiable.
This differs from basic NAT, where an address mapping does not add transport-port information. Basic NAT therefore distinguishes traffic through address mappings rather than a port-based extension.
03
Creating a PAT binding
When an internal session starts, PAT examines the originating private address and its private transport port. The first outgoing session establishes a binding that records how this internal tuple will be represented externally.
PAT also checks whether the originating source port is available after the source IP address has been translated. If the translated port can be used, it becomes part of the active mapping.
A useful conceptual example is an internal source tuple made from a private address and TCP port. PAT records that tuple alongside the outside address and selected translated port.
The binding is not merely an address replacement. It connects address information with source or destination port information, allowing later packets to match the correct session.
04
Translating outbound traffic
For TCP and UDP traffic leaving the internal network, NAT changes the source-side information. The source private IP address becomes the chosen outside address, and the source transport port becomes the translated port.
Later outgoing sessions from the same private address can use the address binding established for that address. PAT still uses transport information to represent each session within the available mapping space.
Consider a second packet from an already mapped client. PAT compares its source details with the existing translation entry, then sends the packet with the corresponding outside address and port.
The key direction is outbound source translation: the sender’s internal address and source port are the fields being represented on the outside.
05
Following the return path
Reply traffic arrives with destination information that points to the translated outside address and port. The translation device uses its entry to identify the associated internal session.
For TCP and UDP return traffic, NAT performs the corresponding destination translation. The outside destination address becomes the private destination address, and the outside destination port becomes the private destination port.
For example, a reply aimed at a shared outside address and one translated port can be delivered to the internal client whose mapping contains that port. Another reply using a different translated port can follow a different binding.
Outbound source translation and inbound destination translation are complementary. Together, they preserve the conversation’s path across the address boundary.
06
Why port uniqueness matters
PAT needs enough identifying information to separate simultaneous sessions that share an outside address. The combination of address data and transport information gives each translation entry a usable match.
A single private-address and transport-port tuple can support translation for sessions originating from that tuple. The resulting entry records the information needed to translate packets in both directions.
This is different from treating the outside IP address as the only identifier. One shared address can represent multiple conversations because the associated translated ports or other identifiers differ.
When analyzing a PAT table, look for both sides of the mapping: the internal and outside addresses, plus the relevant source or destination port information.
08
An implementation boundary
NAT-related features can differ in how traffic is processed. One stated Cisco IOS limitation is that NAT-PT is not supported in the Cisco Express Forwarding path.
This limitation concerns a particular feature and forwarding path. It should not be generalized into a claim that all NAT or PAT operation is excluded from that path.
When reviewing a design or troubleshooting result, separate the general PAT model from platform-specific support details. First trace the mapping, then check whether the chosen feature is supported in the relevant implementation.
09
Recap before Practice and Prove
Basic NAT translates IP addresses, while PAT combines address translation with ports or another transport identifier. This difference is the foundation for recognizing each method.
PAT can use an address pool or an interface address, then create a binding that pairs private session information with an outside representation. That binding lets shared addressing support distinct conversations.
Outbound TCP and UDP packets receive source translations. Return packets receive corresponding destination translations, allowing replies to reach the internal session associated with the entry.
PAT entries include address and port information, and implementations can provide timeout controls. IPSec NAT transparency and overload mode address particular traffic needs.
In Practice, trace a new mapping and its reply path. In Prove, explain why the translated port matters, distinguish PAT from basic NAT, and identify the relevant capability or limitation in a scenario.