In preparation of your CCNP exam, we want to make sure we cover the various concepts that we could see on your Cisco CCNP exam. So to assist you, below we will discuss on of the more difficult CCNP concepts; NAT: Local and Global Definitions. As you progress through your CCNP exam studies, I am sure with repetition you will find this topic becomes easier. So even though it may be a difficult concept and confusing at first, keep at it as no one said getting your Cisco certification would be easy!

Introduction

This document defines and clarifies the following Network Address Translation (NAT) terms: inside local, inside global, outside local, and outside global. Refer to the Network Address Translation White Paper for further information on network services offered by NAT.

Prerequisites

Requirements

There are no specific requirements for this document.

Components Used

This document is not restricted to specific software and hardware versions.

Conventions

For more information on document conventions, refer to the Cisco Technical Tips Conventions.

Term Definitions

Cisco defines these terms as follows:

  • Inside local address – The IP address assigned to a host on the inside network. This is the address configured as a parameter of the computer's OS or received via dynamic address allocation protocols such as DHCP. The address is likely not a legitimate IP address assigned by the Network Information Center (NIC) or service provider.
  • Inside global address – A legitimate IP address assigned by the NIC or service provider that represents one or more inside local IP addresses to the outside world.
  • Outside local address – The IP address of an outside host as it appears to the inside network. Not necessarily a legitimate address, it is allocated from an address space routable on the inside.
  • Outside global address – The IP address assigned to a host on the outside network by the host's owner. The address is allocated from a globally routable address or network space.

The above definitions still leave a lot to be interpreted. For this example, this document redefines these terms by first defining "local address" and "global address." Keep in mind that the terms "inside" and "outside" are NAT definitions. Interfaces on a NAT router are defined as "inside" or "outside" with the NAT configuration commands, ip nat inside and ip nat outside. Networks to which these interfaces connect can then be thought of as "inside" networks or "outside" networks, respectively.

  • Local address – A local address is any address that appears on the "inside" portion of the network.
  • Global address – A global address is any address that appears on the "outside" portion of the network.

Packets sourced on the "inside" portion of the network have an "inside local address" as the source address and an "outside local address" as the destination address of the packet, while the packet resides on the "inside" portion of the network. When that same packet gets switched to the "outside" network, the source of the packet is now known as the "inside global address" and the destination of the packet is known as the "outside global address."

Conversely, when a packet is sourced on the "outside" portion of the network, while it is on the "outside" network, its source address is known as the "outside global address." The destination of the packet is known as the "inside global address." When the same packet gets switched to the "inside" network, the source address is known as the "outside local address" and the destination of the packet is known as the "inside local address."

This image provides an example.

Examples

These sections examine these terms more closely using the following topology and examples.

Define Inside Local and Inside Global Addresses

In the configuration below, when the NAT router receives a packet on its inside interface with a source address of 10.10.10.1, the source address is translated to 171.16.68.5. This also means that when the NAT router receives a packet on its outside interface with a destination address of 171.16.68.5, the destination address is translated to 10.10.10.1
ip nat inside source static 10.10.10.1 171.16.68.5

!— Inside device A is known by the outside cloud as 171.16.68.5.

interface s 0
ip nat inside

interface s 1
ip nat outside

When the inside device is communicating with the outside device, the addresses are defined in this way:

As mentioned before, the local addresses are addresses that appear on the inside cloud. Global addresses are addresses that appear on the outside cloud. Because of the way NAT is configured, the inside addresses are the only addresses that are translated; therefore, the "inside local" address is different from the "inside global" address, while the "outside local" address is the same and the "outside global" address.

The following is what the packets look like when they are on the inside network and on the outside network.

Define Outside Local and Outside Global Addresses

In the next configuration, when the NAT router receives a packet on its outside interface with a source address of 171.16.68.1, the source address is translated to 10.10.10.5. This also means that if the NAT router receives a packet on its inside interface with a destination address of 10.10.10.5, the destination address is translated to 171.16.68.1.
ip nat outside source static 171.16.68.1 10.10.10.5
!— Outside device A is known to the inside cloud as 10.10.10.5.
interface s 0
ip nat inside
interface s 1
ip nat outside

When the Outside Device A is communicating with Inside Device A the addresses are defined in the following way:

The local addresses are addresses that appear on the inside cloud. Global addresses are addresses that appear on the outside cloud. In this example, because of the way NAT is configured, only the outside addresses get translated; therefore, the "outside local" address is different from the "outside global" address, while the "inside local" address is the same and the "inside global" address.

The following is what the packets look like when they are on the inside network and on the outside network.

Define All Local and Global Addresses

In the final configuration, when the NAT router receives a packet on its inside interface with a source address of 10.10.10.1, the source address is translated to 171.16.68.5. When the NAT router receives a packet on its outside interface with a source address of 171.16.68.1, the source address is translated to 10.10.10.5.

This also means that when the NAT router receives a packet on its outside interface with a destination address of 171.16.68.5, the destination address is translated to 10.10.10.1. Also, when the NAT router receives a packet on its inside interface with a destination address of 10.10.10.5, the destination address is translated to 171.16.68.1.

ip nat inside source static 10.10.10.1 171.16.68.5

!— Inside device A is known to the outside cloud as 171.16.68.5.

ip nat outside source static 171.16.68.1 10.10.10.5
!— device A is known to the inside cloud as 10.10.10.5.
interface s 0
ip nat inside

interface s 1
ip nat outside

If Inside Device A were communicating with Outside Device A the addresses would be defined in the following way:

Notice once again that the local addresses are addresses that appear on the inside cloud, and that global addresses are addresses that appear on the outside cloud. In this particular case, because of the way NAT is configured, both the "inside" addresses and the "outside" addresses are translated; therefore the "inside local" addresses are different from the "inside global" addresses and the "outside local" addresses are different from the "outside global" addresses.

The following is what the packets look like when they are on the inside network and on the outside network.

In summary, the terms "local" and "global" are actually quite straight forward when we think of them in terms of where they appear in the network. Local addresses appear on the "inside" portion of the network while global addresses appear on the "outside" portion of the network. Also, depending on how NAT is configured, the local and global addresses for each (inside and outside) may be, or may not be, the same.

We hope you found this Cisco certification article helpful. We pride ourselves on not only providing top notch Cisco CCNP exam information, but also providing you with the real world Cisco CCNP skills to advance in your networking career.