A pool of public addresses
Dynamic NAT takes a free address from a pool each time a new inside host sends traffic out. An ACL says which inside addresses may be translated:
access-list 1 permit 192.168.1.0 0.0.0.255: who may be translated;ip nat pool PUBLIC 203.0.113.3 203.0.113.4 netmask 255.255.255.248: the addresses to use;ip nat inside source list 1 pool PUBLIC: join them up.
This pool has only two addresses, and three PCs want to go out:
In NetLab
▶ R1 R1>enable R1#configure terminal Enter configuration commands, one per line. End with CNTL/Z. R1(config)#access-list 1 permit 192.168.1.0 0.0.0.255 R1(config)#ip nat pool PUBLIC 203.0.113.3 203.0.113.4 netmask 255.255.255.248 R1(config)#ip nat inside source list 1 pool PUBLIC R1(config)#end *Mar 1 00:00:06.000: %SYS-5-CONFIG_I: Configured from console by console ▶ PC1 NetLab Windows-style command prompt. Type help to see the commands. C:\Users\student>ping 198.51.100.10 Pinging 198.51.100.10 with 32 bytes of data: Request timed out. Request timed out. Request timed out. Reply from 198.51.100.10: bytes=32 time<1ms TTL=62 Ping statistics for 198.51.100.10: Packets: Sent = 4, Received = 1, Lost = 3 (75% loss), Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 0ms, Average = 0ms ▶ PC2 student@PC2:~$ ping -c 2 198.51.100.10 PING 198.51.100.10 (198.51.100.10) 56(84) bytes of data. 64 bytes from 198.51.100.10: icmp_seq=2 ttl=62 time=0.640 ms --- 198.51.100.10 ping statistics --- 2 packets transmitted, 1 received, 50% packet loss, time 1001ms rtt min/avg/max/mdev = 0.640/0.640/0.640/0.000 ms ▶ PC3 NetLab Windows-style command prompt. Type help to see the commands. C:\Users\student>ping 198.51.100.10 Pinging 198.51.100.10 with 32 bytes of data: Request timed out. Request timed out. Request timed out. Request timed out. Ping statistics for 198.51.100.10: Packets: Sent = 4, Received = 0, Lost = 4 (100% loss), ▶ R1 R1#show ip nat translations Pro Inside global Inside local Outside local Outside global --- 203.0.113.3 192.168.1.10 --- --- icmp 203.0.113.3:10 192.168.1.10:10 198.51.100.10:10 198.51.100.10:10 --- 203.0.113.4 192.168.1.20 --- --- icmp 203.0.113.4:11 192.168.1.20:11 198.51.100.10:11 198.51.100.10:11 R1#show ip nat statistics | include pool|misses [Id: 1] access-list 1 pool PUBLIC refcount 4 pool PUBLIC: netmask 255.255.255.248 type generic, total addresses 2, allocated 2 (100%), misses 4
PC1 and PC2 each took a pool address; PC3 got nothing and is cut off until an address is freed (clear ip nat translation *, or when an entry times out). That's why dynamic NAT on its own is rare today.
Common mistake: The ACL in a NAT rule doesn't filter traffic: it only chooses which addresses are translated. Hosts it doesn't permit still go out, just untranslated (so their replies never come back).