Placing NAT roles on the WAN: On the interface that connects a Cisco router to the Internet or upstream provider, which NAT role command should be applied?

Introduction / Context:
A working NAT deployment requires correct designation of inside and outside interfaces. The upstream/WAN-facing interface must be marked appropriately so translations occur in the right direction when traffic leaves the private network.

Given Data / Assumptions:

• The interface in question connects to the Internet or an upstream network.
• Classic IOS NAT is in use.
• Inside LAN hosts require translation to reach the outside.

Concept / Approach:

On a Cisco router, apply ip nat outside to the WAN interface and ip nat inside to the LAN interface. This informs the NAT engine which direction is outward versus inward for address/port mapping.

Step-by-Step Solution:

Verification / Alternative check:

show running-config should show correct inside/outside assignments. Use show ip nat translations while generating traffic to confirm outside-bound translations are created.

Why Other Options Are Wrong:

ip nat inside (A) is used on the private-side interface.

ip outside global and ip inside local (C, D) are address type names, not interface commands.

Common Pitfalls:

Reversing roles; forgetting ACL/route-map references; omitting default route so translated traffic has no path outward.

Final Answer:

ip nat outside