zNetLaB › Guided labs › Enterprise
Troubleshoot — NAT with the inside and outside the wrong way round
Enterprise Intermediate 3 devices 4 checked tasks 100 points Plan lab
The branch router has NAT overload configured and the internet still never sees the PCs’ traffic translated. The ACL is right, the pool interface is right — but the two NAT interface roles are reversed. Fix which interface is inside and which is outside. You build it in a browser, type real commands at each device, and every task below is
checked against the running configuration — so you find out it is wrong before anybody else does.
Open this lab in the simulator
The simulator runs in your browser with nothing to install. This lab is part of the full simulator: open it free for 7 days with a new account, then with a plan. It needs an account, which keeps your progress.
The scenario
The branch router has NAT overload configured and the internet still never sees the PCs’ traffic translated. The ACL is right, the pool interface is right — but the two NAT interface roles are reversed. Fix which interface is inside and which is outside.
Your role: a network engineer on the enterprise team. Level: Intermediate Done when: all 4 goals show as passed (100 points).
Network status
Devices: 1 router, 1 PC, 1 server, cabled as drawn. No Layer 1 or Layer 2 faults: every link is connected and up. Branch starts with addresses (G0/0 192.168.1.1/24, G0/1 203.0.113.1/24) and an ACL, NAT already configured. PC1 is a host with 192.168.1.10/24, gateway 192.168.1.1. Internet-Server is a host with 203.0.113.10/24, gateway 203.0.113.1. Known problems
The network worked and now does not: the scenario above says what users report. The cause is a configuration fault, not a cable. Find it with show commands (interfaces, routes, neighbours, running-config) before you change anything; fix only what is wrong. Goals
The LAN interface (Gi0/0) is NAT inside (30 pts) The internet interface (Gi0/1) is NAT outside (30 pts) Overload (PAT) is configured on the outside interface (20 pts) PC1 reaches the internet server (20 pts) The activity, in order
The LAN interface (Gi0/0) is NAT inside Why: NAT needs to know which side is inside; get it backwards and nothing translates. Verify with: show ip nat statistics The internet interface (Gi0/1) is NAT outside Why: NAT needs to know which side is inside; get it backwards and nothing translates. Verify with: show ip nat statistics Overload (PAT) is configured on the outside interface Why: PAT lets many private hosts share one public address; the ports tell the replies apart. Verify with: show ip nat translations PC1 reaches the internet server Why: A ping needs a route in BOTH directions. This is the end-to-end proof that everything before it worked. Verify with: ping 203.0.113.10 Tips
Work in the order given: later goals depend on the earlier ones. After every change, run the verify command before moving on; do not guess. Stuck? Read the verify output first. It names the interface, neighbour or route that is wrong. Common mistake: “ip nat inside” on the internet-facing port Common mistake: An ACL that does not match the inside addresses Common mistake: Forgetting overload and exhausting the single public address Why this matters
NAT only translates between an inside and an outside interface. With the roles reversed the ACL and the overload statement are right and nothing is translated.
What you will be able to do
Mark inside and outside interfaces correctly
Read show ip nat statistics and translations
Confirm overload (PAT) is bound to the outside interface
The network
ISR 2911, PC, Server — 3 devices in all, already cabled.
Gi0/0 192.168.1.1/24 Fa0 Gi0/1 203.0.113.1/24 Fa0 Branch PC1 192.168.1.10/24 · gw 192.168.1.1 Internet-Server 203.0.113.10/24 · gw 203.0.113.1 Drawn from this lab: devices, cables, ports and the addresses already set. Device Model Address already set
Branch ISR 2911 configure it PC1 PC 192.168.1.10 / 255.255.255.0 gw 192.168.1.1 Internet-Server Server 203.0.113.10 / 255.255.255.0 gw 203.0.113.1
Cabling
Branch Gi0/0 ↔ PC1 Fa0 Branch Gi0/1 ↔ Internet-Server Fa0
What is configured at the start
These are already configured when the lab opens — including, where this is a troubleshooting lab, the fault itself:
Branch interface g0/0
ip address 192.168.1.1 255.255.255.0
no shutdown
exit
interface g0/1
ip address 203.0.113.1 255.255.255.0
no shutdown
exit
access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 interface g0/1 overload
interface g0/0
ip nat outside
exit
interface g0/1
ip nat inside
exit Tasks, and how each one is checked
Every task is decided by reading the live network — a neighbour in FULL, a ping that succeeds, a line in the running configuration — not by looking for a keyword you typed. The same command shows you what the lab sees.
# Task Pts How to verify it yourself
1 The LAN interface (Gi0/0) is NAT inside 30 On Branch: show ip nat statistics — Gi0/0 is inside. 2 The internet interface (Gi0/1) is NAT outside 30 On Branch: show ip nat statistics — Gi0/1 is outside. 3 Overload (PAT) is configured on the outside interface 20 On Branch: show running-config | include nat shows overload . 4 PC1 reaches the internet server 20 On PC1: ping 203.0.113.10 must succeed.
Stuck? Ask the coach
Tell the coach what you see or what you tried. It gives you a hint, not the answer, the way a senior engineer would. Included with a free trial or any plan.
Ask the coach
Common mistakes
“ip nat inside” on the internet-facing port
An ACL that does not match the inside addresses
Forgetting overload and exhausting the single public address
Reference solution
Try it yourself first — the lab checks your work either way. This is one configuration that makes every task pass, device by device:
Branch interface g0/0
ip nat inside
exit
interface g0/1
ip nat outside
exit Where this is examined
CCNA (NAT), CCNP ENARSI (NAT troubleshooting), Network+.
This lab practises these topics in the zNetLaB certification courses:
Related labs
Where to start
The lessons all guided labs plans
CCNA®, CCNP® and Cisco® are trademarks of Cisco Systems, Inc. zNetLaB is not affiliated with or endorsed by Cisco.