Policy-Based Routing & NAT/PAT Quick Reference

Normal routing decides purely by destination IP. PBR lets a route-map match on source, protocol, packet size, or other criteria and set a specific next-hop or exit interface — overriding what the routing table alone would choose, for a deliberate policy reason (cost, latency, compliance path).

A route-map used for PBR needs both a match clause (what traffic this applies to) and a set clause (what to do with it) — a match with no set has no effect, and a set with no match applies to everything a permit route-map implicitly matches.

PBR is applied inbound on an interface ('ip policy route-map <name>') — a fully correct route-map with no policy applied anywhere has zero effect on real traffic.

NAT (static or dynamic) is a 1:1 mapping between an inside and an outside address — no port translation needed, but it doesn't conserve public address space.

PAT ('NAT overload') maps many inside addresses to one outside address, distinguished by port number — this is what lets an entire private network share one public IP, and is the overwhelmingly common real-world case at an internet edge.

'show route-map <name>' shows match/set clauses and hit counts per clause — a zero hit count on an expected match is the fastest way to catch a PBR policy that's configured but not actually triggering.

'show ip nat translations' shows active NAT/PAT mappings in real time — confirms translation is actually happening, not just configured.