ACLs, NAT, and PAT Quick Reference for CCNA 200-301 v2.0

Cisco's published 200-301 v2.0 blueprint requires configuration of IPv4 Access Control Lists (ACLs) and Network Address Translation (NAT), including Port Address Translation (PAT). Cisco says v2.0 begins February 3, 2027.

The fastest way to solve these questions is to keep packet filtering and address translation separate. An ACL may filter traffic, or it may simply identify traffic for another feature such as NAT.

1. ACL and NAT decision map

2. Read every ACL from the top

An IPv4 ACL is an ordered list.

IOS evaluates entries:

1. Top to bottom
2. First match wins
3. Processing stops after the first match
4. If nothing matches, the implicit deny any applies

Before reading the ACL, write the packet:

protocol | source IP | source port | destination IP | destination port

Then test the packet against each entry in order.

A later permit cannot rescue traffic that already matched an earlier deny.

Counters can help show which line is matching:

show access-lists
show ip access-lists

A zero counter does not automatically mean the rule is wrong. Traffic may not be reaching the ACL, another entry may match first, or the ACL may be applied in the wrong direction or location.

3. Choose standard or extended from what must be matched

Named vs numbered tells you how the ACL is identified. Standard vs extended tells you what the entries can match.

Example standard named ACL:

ip access-list standard MGMT-SOURCES
 permit 10.10.50.0 0.0.0.255
 deny any log

Example extended named ACL:

ip access-list extended WEB-IN
 permit tcp 10.20.0.0 0.0.255.255 host 192.0.2.80 eq 443
 deny ip any host 192.0.2.80 log

The extended entry can distinguish HTTPS traffic to one destination because it includes protocol, addresses, and destination port.

4. Treat wildcard masks as inverse matching bits

For a wildcard mask:

• 0 means the corresponding address bit must match.
• 1 means the corresponding address bit may vary.

For a normal contiguous subnet, subtract each subnet-mask octet from 255.

Examples:

host 192.0.2.10 is shorthand for matching one exact IPv4 address. any matches any address.

Do not read 0.0.0.255 as though it were a subnet mask. It means the first three octets must match while the final octet may vary.

5. Placement and direction decide which packets see the ACL

An interface ACL is evaluated relative to the interface:

• Inbound: as the packet enters the interface, before the router forwards it.
• Outbound: after the routing decision, as the packet leaves the interface.

Useful verification:

show ip interface GigabitEthernet0/0/0
show ip access-lists
show running-config | section access-list

When a correct-looking ACL has no effect, check whether it is attached to the expected interface and direction.

Placement guidelines are not absolute laws. Use the policy requirement and topology. The classic guidance is:

• Standard ACLs closer to the destination
• Extended ACLs closer to the source

The reason is control precision, not memorizing a slogan.

6. Keep NAT address terms tied to viewpoint

For common CCNA scenarios, inside local → inside global is the translation learners most often need to recognize.

7. Separate static NAT, dynamic NAT, and PAT by mapping behavior

Static NAT

Static NAT creates a fixed mapping.

ip nat inside source static 10.10.10.10 203.0.113.10

Use it when a stable one-to-one representation is required.

Dynamic NAT

Dynamic NAT selects an available global address from a configured pool for matching inside hosts.

The mapping is created as matching traffic uses the translation service rather than being permanently assigned to one host.

PAT overload

PAT allows many inside sessions to share one or a smaller number of global addresses by distinguishing flows with transport-layer information.

A common overload pattern is:

interface GigabitEthernet0/0/0
 ip nat inside
!
interface GigabitEthernet0/0/1
 ip nat outside
!
access-list 10 permit 10.10.0.0 0.0.255.255
ip nat inside source list 10 interface GigabitEthernet0/0/1 overload

The overload keyword is the strong PAT clue.

8. Troubleshoot NAT from roles to return path

Use this order:

1. Inside/outside roles: Are the correct interfaces marked?
2. Match criteria: Does the source traffic match the NAT rule or ACL?
3. Forward path: Does routing send the packet across the expected translation boundary?
4. Translation state: Does a translation appear while matching traffic is generated?
5. Outside reachability: Can the translated packet reach the destination?
6. Return path: Can the reply return to the translating device and matching session?

Useful commands:

show ip nat translations
show ip nat statistics
show access-lists
show ip interface brief
show ip route

An empty translation table while matching traffic is active points back toward roles, matching, or path.

A translation entry proves NAT matched and created state. It does not prove the remote application replied successfully.

9. An ACL can identify NAT traffic without filtering an interface

This distinction is a frequent source of confusion.

In:

access-list 10 permit 10.10.0.0 0.0.255.255
ip nat inside source list 10 interface GigabitEthernet0/0/1 overload

ACL 10 identifies which inside source addresses are eligible for translation.

That ACL is not automatically a packet filter on an interface.

For filtering, an ACL must be applied in the relevant context, such as:

interface GigabitEthernet0/0/0
 ip access-group WEB-IN in

Same ACL technology, different use.

10. Scenario comparisons

ACL has a broad deny before a specific permit

The specific permit never gets a chance to match. First match wins.

Extended ACL permits HTTPS but users cannot ping the server

That may be exactly what the policy says. A TCP/443 permit does not permit ICMP.

NAT ACL counter increments, but no translation appears

The source matched the ACL, but verify inside/outside roles, the active path, and NAT configuration. A match counter alone is not a translation.

Translation appears, but the application still fails

Move past NAT matching. Check routing, ACLs/firewalls, remote service state, and return path.

A /26 network must be matched in an ACL

The subnet mask is 255.255.255.192; the normal wildcard is 0.0.0.63.

PAT configuration uses one outside interface address for many users

Look for overload and verify the translation table while several sessions are active.

11. Common exam traps

• Reading only the ACL line you want to match instead of starting at the top.
• Forgetting the implicit deny.
• Confusing named/numbered with standard/extended.
• Treating a wildcard mask like a subnet mask.
• Ignoring interface direction.
• Applying standard-vs-extended placement advice without considering the actual policy/topology.
• Treating a NAT match ACL as an interface filtering ACL.
• Forgetting to mark NAT inside and outside interfaces.
• Looking at NAT translations without generating matching traffic.
• Treating a translation entry as proof of end-to-end application success.
• Ignoring the return path.
• Assuming PAT and static NAT solve the same mapping requirement.

12. Rapid review grid

13. Official references

• Cisco 200-301 CCNA v2.0 Exam Topics
• Cisco IOS XE Access Control Lists configuration
• Cisco IOS XE NAT configuration