NAT Overload: ACL Selection Error
PAT failures often look like generic internet outages. This lab makes the route and interface roles healthy on purpose, leaving the NAT selection ACL as the evidence-led fault to find.
The problem
Clients on 192.168.10.0/24 can reach their gateway and the edge router can reach the ISP, but client traffic creates no NAT translations because the ACL used by overload does not match the inside subnet.
What you'll practice
- Verify NAT inside and outside roles
- Read the ACL attached to a NAT overload rule
- Calculate the wildcard mask for a /24
- Inspect NAT translation output
- Validate client-to-internet reachability
The topology
A single edge router connects the inside 192.168.10.0/24 LAN to an ISP-facing /30 link. The lab isolates NAT policy from routing by preconfiguring reachability in both directions.
Commands to run yourself
The real diagnostic commands for this lab, copy-paste ready. Run these in the same order to reproduce the investigation on your own session.
show running-config | include ip natshow access-listsshow ip nat translationsshow ip nat statisticsTopology diagram
Frequently asked
Does a NAT ACL filter the traffic?
A standard ACL referenced by a NAT rule normally selects addresses for translation; it is not, by itself, applied as a packet-filtering ACL on an interface.
Ready to run this lab yourself?
No setup, no image sourcing. Book a session or ask for a live demo.