Cisco CCNA NAT for IPv4 4 — Questions and Answers
Question 1: A company wants external internet users to reach an internal web server at 10.0.0.5 via the public IP 198.51.100.10. Which NAT type should be used?
- PAT (NAT Overload)
- Dynamic NAT
- Static NAT (Correct answer)
- Double NAT
Correct answer: Static NAT
Static NAT creates a permanent one-to-one mapping between a private IP and a public IP, allowing inbound connections to reach internal servers predictably.
Question 2: What happens to the NAT translation table entry when an idle TCP session times out?
- The entry is kept permanently until manually cleared
- The entry is removed after the NAT timeout expires (Correct answer)
- The entry is flagged as expired but retained for logging
- The outside host is notified via ICMP
Correct answer: The entry is removed after the NAT timeout expires
Cisco IOS removes idle dynamic NAT/PAT entries after a configurable timeout (default 24 hours for TCP, 5 minutes for UDP) to reclaim table space.
Question 3: Which IOS command defines a NAT pool named MYPOOL with addresses 198.51.100.1 through 198.51.100.10 and a /28 mask?
- ip nat pool MYPOOL 198.51.100.1 198.51.100.10 netmask 255.255.255.240 (Correct answer)
- ip nat pool MYPOOL 198.51.100.1-198.51.100.10 /28
- nat pool MYPOOL 198.51.100.1 198.51.100.10 prefix-length 28
- ip nat inside pool MYPOOL 198.51.100.1 198.51.100.10 mask 255.255.255.240
Correct answer: ip nat pool MYPOOL 198.51.100.1 198.51.100.10 netmask 255.255.255.240
The correct syntax is 'ip nat pool [name] [start-ip] [end-ip] netmask [mask]' — prefix-length is an alternative but 'netmask' is the traditional keyword.
Question 4: Which Cisco IOS command links an access list to a NAT pool for dynamic translation?
- ip nat inside source static acl 10 pool MYPOOL
- ip nat inside source list 10 pool MYPOOL (Correct answer)
- ip nat outside source list 10 pool MYPOOL
- access-list 10 nat pool MYPOOL
Correct answer: ip nat inside source list 10 pool MYPOOL
'ip nat inside source list [acl] pool [pool-name]' ties ACL-matched inside source addresses to the specified pool for dynamic NAT.
Question 5: NAT is often criticized for which networking principle violation?
- It breaks OSPF neighbor adjacency by default
- It violates end-to-end connectivity by modifying IP headers in transit (Correct answer)
- It increases routing table size
- It prevents VLAN tagging on trunks
Correct answer: It violates end-to-end connectivity by modifying IP headers in transit
NAT violates the end-to-end principle of IP networking because it modifies source/destination addresses in packet headers, breaking transparency between endpoints.
Question 6: A router uses 'ip nat inside source static tcp 10.1.1.5 80 198.51.100.1 80'. What does this accomplish?
- Translates all traffic from 10.1.1.5 to 198.51.100.1
- Forwards external TCP port 80 traffic destined for 198.51.100.1 to internal host 10.1.1.5:80 (Correct answer)
- Blocks HTTP traffic on the outside interface
- Creates a dynamic pool for web servers
Correct answer: Forwards external TCP port 80 traffic destined for 198.51.100.1 to internal host 10.1.1.5:80
This static NAT command maps external IP 198.51.100.1 port 80 to internal host 10.1.1.5 port 80, enabling port forwarding for an internal web server.
Question 7: Which issue arises when two branch offices with overlapping private address ranges connect via a hub site using NAT?
- NAT cannot handle RFC 1918 addresses at all
- Routing becomes ambiguous because the same IP range exists on multiple segments (Correct answer)
- PAT table overflows immediately
- OSPF metrics double automatically
Correct answer: Routing becomes ambiguous because the same IP range exists on multiple segments
Overlapping private address spaces cause routing ambiguity; a packet destined for 192.168.1.10 could belong to either branch, requiring Twice NAT or VPN with address translation to resolve.
Cisco CCNA NAT for IPv4 4
A company wants external internet users to reach an internal web server at 10.0.0.5 via the public IP 198.51.100.10.
Which NAT type should be used?