NAT Overload: ACL Selection Error
Inside hosts reach their gateway and the router reaches the ISP, yet no NAT translation is ever built. Diagnose the selection ACL and fix it yourself, live, right below.
Symptom
Inside users reach the router but never the internet. Trace the NAT ACL, correct its wildcard mask, and verify live translations.
Your mission
Prove the cause, then fix it
Format
Guided CLI investigation
Investigate before you configure.
Use the CLI evidence to isolate the fault, make the smallest safe correction, then verify the network state changed.
Observe the symptom and link state.
Diagnose by comparing the protocol evidence.
Verify the expected device state and confirm the original symptom is resolved.
Console access: R1
This workspace stacks for portrait phones. Rotate to landscape for the full split-screen console.
Need a hint?
Reveal the root cause when you're ready.
Try the investigation first, then use this as your escape hatch, not a dead end.
Lab debrief
Turn the session into a repeatable troubleshooting pattern.
Use this reference after your attempt: first explain the symptom, then verify the evidence, then confirm the repair.
The problem
Clients on 10.0.0.0/24 can reach their gateway and the edge router can reach the ISP, but client traffic creates no NAT translations: the ACL referenced by the overload rule selects a different subnet than the one the users are actually on.
What you'll practice
- Verify NAT inside and outside roles
- Read the ACL attached to a NAT overload rule
- Calculate the wildcard mask for a /24
- Inspect NAT translation output
- Validate client-to-internet reachability
The topology
A single edge router connects the inside 192.168.10.0/24 LAN to an ISP-facing /30 link. The lab isolates NAT policy from routing by preconfiguring reachability in both directions.
Commands to run yourself
The real diagnostic commands for this lab, copy-paste ready. Run these in the same order to reproduce the investigation on your own session.
show running-config | include ip natshow access-listsshow ip nat translationsshow ip nat statisticsTopology diagram
Frequently asked
Does a NAT ACL filter the traffic?
A standard ACL referenced by a NAT rule normally selects addresses for translation; it is not, by itself, applied as a packet-filtering ACL on an interface.
Ready to run this lab yourself?
No setup, no image sourcing. Book a session or ask for a live demo.