ExamFinch.com My Study

Study guide

NAT/PAT, VIP/FHRP, and Subinterfaces

Practice this exam

CompTIA Network+ N10-009

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

Current Exam Facts and Applied Networking Judgment Official Domain Weights and an 8-12 Week Study Plan How to Use Labs, Practice, and PBQ Workflow Missed-Question Notebook and Final Readiness Metrics

2 Domain 1: Networking Concepts (23%)

OSI and TCP/IP Models with Device and Protocol Mapping Networking Appliances and Where They Operate Ports and Protocol Decision Table Traffic Types and Encapsulation Flow

3 Domain 1: Media, Connectors, Transceivers, and Network Architectures

Copper, Fiber, Coax, and DAC Media Connector and Transceiver Selection Network Topologies and Design Patterns Cloud and Virtual Networking Concepts

4 Domain 1: IP Addressing and Subnetting Mastery

IPv4 Classes, Private/Public, APIPA, and Loopback CIDR, VLSM, and Subnet Math IPv6 Address Types and Notation Routing Basics and Longest Prefix Match

5 Domain 2: Network Implementation - Routing

Static vs Dynamic Routing and Route Selection OSPF, EIGRP, and BGP Basics at Network+ Depth NAT/PAT, VIP/FHRP, and Subinterfaces Routing PBQs and Troubleshooting Route Table Clues

6 Domain 2: Network Implementation - Switching

VLANs, Access Ports, Trunks, and Native VLAN STP/RSTP Loop Prevention and Bridge Roles Port Aggregation/LACP, MTU, Jumbo Frames, and Interface Settings Switch Implementation PBQs and Common Misconfigurations

7 Domain 2: Network Implementation - Wireless and Physical Implementation

Wi-Fi Standards, Bands, and Channels SSID Security, Guest Networks, and Authentication Antennas, Coverage, Roaming, Interference, and Site Surveys Physical Installation Implications

8 Domain 2: Network Implementation - Services Implementation

DNS Record Types and Troubleshooting Cues DHCP, DHCPv6, SLAAC, Scopes, Leases, and Relay NTP, PTP, NTS, and Time-Sensitive Networking Service Implementation PBQs: DNS, DHCP, VLANs, and Firewall Direction

9 Domain 3 Part A: Network Operations Documentation and Governance

Physical, Logical, Rack, Cable, Wireless Diagrams, and IPAM Asset Inventory, Baselines, SLAs, SOPs, and Runbooks Change Management and Request Tracking Lifecycle, EOL, EOS, Decommissioning, and Configuration Management

10 Domain 3 Part B: Monitoring, Remote Access, and Resilience

SNMP, Flow, Syslog, Packet Capture, Log Aggregation, APIs, and Port Mirroring Baselines and Performance Metrics Remote Access, Management Paths, and Secure Admin Habits DR and HA Concepts: RPO, RTO, MTTR, MTBF, Sites, Failover, and Testing

11 Domain 4: Logical Security and Secure Access (14%)

Encryption in Transit, Encryption at Rest, PKI, and Certificates IAM, MFA, SSO, Directory Services, and AAA Authorization, Least Privilege, RBAC, Geofencing, and Time-Based Access VPNs and Secure Management Design

12 Domain 4: Segmentation, Risk, and Network Attacks (14%)

Segmentation for Guest, BYOD, IoT, IIoT, SCADA, ICS, and OT Risk, Compliance, Audit, Data Locality, PCI, and GDPR Network Attacks and Scenario Cues Attack-to-Mitigation PBQ Tables

13 Domain 4: Security Controls and Hardening (14%)

Firewalls, IDS, IPS, Security Zones, and Screened Subnets ACLs, Filtering, NAC, Hardening, and Key Management Deception Technologies and Physical Security Zero Trust, SASE, and Trusted or Untrusted Zone Decisions

14 Domain 5: Troubleshooting Methodology and Tools (24%)

Official Troubleshooting Methodology and Evidence Handling Command-Line Tools: ping, traceroute, nslookup, dig, ipconfig, ifconfig, ip, arp, netstat, ss, and route Packet, Protocol, and Wi-Fi Analyzers Choosing the Right Tool by Symptom PBQs

15 Domain 5: Physical, Interface, and Wireless Troubleshooting (24%)

Cable Issues: Type, Attenuation, Crosstalk, Termination, and TX/RX Interface Issues: Errors, Discards, Duplex, Speed, Port Status, and PoE Transceiver, Fiber, and Signal Strength Troubleshooting Wireless Troubleshooting: Interference, Channels, Roaming, RSSI/SNR, Security, and Captive Portals

16 Domain 5: Network Services, Switching, Routing, and Performance Troubleshooting (24%)

DHCP, DNS, NTP, and IP Addressing Issues VLAN, STP, Trunk, Native VLAN, and ACL Issues Routing, Default Gateway, Route Table, and NAT Issues Congestion, Latency, Jitter, Packet Loss, and Application Performance Clues

17 Performance-Based Question Labs

Subnetting and VLSM Design Lab VLAN, Trunk, Router-on-a-Stick, and Firewall Rule Lab Wireless Deployment and Troubleshooting Lab Monitoring, Log Triage, and Route or Service Troubleshooting Lab

18 High-Yield Reference and Final Study Plan

High-Yield Ports and Protocols Table Wi-Fi, Cabling, Connectors, and Transceivers Quick Table Acronyms and Command-Line Tool Quick Table Final 7-Day Review Plan and Readiness Checklist

19 Final Synthesis: Strategy, Remediation, and Readiness

Mixed-Set Decision Strategy for Qualifiers and Close Answers Missed-Question Remediation Notebook by Error Type Exam-Day Time Management and PBQ Order 100-Question Readiness Simulation Blueprint Mapped to N10-009 Weights

NAT/PAT, VIP/FHRP, and Subinterfaces

Key Takeaways Explain This Topic AI

NAT translates IP addresses; PAT (NAT overload) multiplexes many inside connections onto one public IP using unique source ports.

Static NAT is one-to-one, dynamic NAT draws from a pool, and PAT is the common many-to-one method for internet access.

A VIP is a shared virtual address fronting a load-balanced service or a redundant gateway.

FHRP (HSRP, VRRP, GLBP) presents a virtual gateway IP and MAC so hosts keep their gateway when a router fails.

Router-on-a-stick uses 802.1Q-tagged subinterfaces on one physical link to route between VLANs.

Last updated: June 2026

Where These Topics Sit

Routing implementation rarely stops at the route table. Real designs add address translation, gateway redundancy, and VLAN-aware interfaces - all at the boundary between hosts, switches, routers, firewalls, and the internet. N10-009 tests them in practical, scenario-driven items.

NAT and PAT

  • Term What changes Typical use
  • NAT The IP address is translated Private-to-public, or overlapping networks
  • Static NAT One inside address maps to one outside address Publish a server; preserve a fixed mapping
  • Dynamic NAT Inside hosts draw from a pool of outside addresses Translate many clients with a public pool
  • PAT / NAT overload Many inside hosts share one outside IP via unique ports The standard internet-access method
  • Port forwarding An outside port maps to an inside host:port Allow inbound access to one service

PAT is why dozens of private hosts browse the internet behind a single public IP. The translation table tracks the inside local address and port, the translated outside address and port, and the remote endpoint - a four-tuple that keeps each session distinct.

PAT Translation Walkthrough

Follow one HTTPS session as it crosses a PAT-enabled edge router (inside host 192.168.10.25, public IP 198.51.100.10, web server 93.184.216.34):

  • Step Source before Source after Destination
  • Client request out 192.168.10.25:51512 198.51.100.10:40001 93.184.216.34:443
  • Server reply arrives 93.184.216.34:443 (unchanged) 198.51.100.10:40001
  • Router untranslates 93.184.216.34:443 (unchanged) 192.168.10.25:51512

The router remembers that outside port 40001 belongs to 192.168.10.25:51512, so the return packet is mapped back to the right host. If the NAT entry has aged out, the inside/outside interface roles are swapped, or no entry was ever created, the return packet is dropped even when the route table looks perfect. This is a classic "works outbound, fails on reply" PBQ symptom.

Important distinction: NAT and PAT hide and conserve addressing - they are not a firewall. Inbound filtering is a separate policy decision. A port forward without a matching firewall rule still fails.

VIP and FHRP

A virtual IP (VIP) can front a service or a redundant gateway.

  • Use case What the VIP represents Clue
  • Load balancer VIP One front-end address for a server pool Users hit one IP; traffic spreads to backends
  • FHRP gateway VIP Shared default gateway for a VLAN Hosts keep their gateway when one router fails

First-hop redundancy protocols (FHRP) let two or more routers cooperatively provide a resilient default gateway. The exam may say "FHRP" generically or name HSRP, VRRP, or GLBP.

  • FHRP concept Meaning
  • Active / master router Currently forwarding for the virtual gateway
  • Standby / backup router Ready to take over on failure
  • Virtual IP The gateway address configured on hosts
  • Virtual MAC MAC tied to the virtual gateway (so ARP need not change)
  • Priority Influences which router becomes active
  • Preemption Lets a restored higher-priority router reclaim active

Hosts should always point their default gateway at the virtual IP , never at a physical router interface - that is what makes failover invisible to the host. Quick contrast: HSRP and GLBP are Cisco-proprietary; VRRP is an open standard; GLBP can load-balance across multiple active routers, while HSRP/VRRP use one active and one or more standby.

Subinterfaces and Router-on-a-Stick

A subinterface is a logical interface created under one physical interface. In router-on-a-stick , a single physical router link connects to a switch trunk, and each VLAN gets a subinterface tagged with 802.1Q .

  • Component Example Role
  • Physical interface G0/0 Carries the 802.1Q trunk
  • Subinterface G0/0.10 Gateway for VLAN 10
  • Encapsulation tag 802.1Q VLAN 10 Identifies VLAN 10 frames
  • IP address 192.168.10.1/24 Default gateway for VLAN 10 hosts

Three things must line up: the subinterface number/tag, the switch trunk must allow that VLAN, and the host gateway must equal the subinterface IP.

Symptom map

  • Symptom Likely issue
  • Internal users ping gateway but not internet Missing default route, NAT/PAT fault, or upstream filtering
  • One published server unreachable from outside Port forward, static NAT, firewall rule, or server gateway
  • Hosts lose gateway when primary router fails FHRP misconfigured, wrong VIP, or priority/preemption
  • VLAN 20 hosts cannot reach other VLANs Missing subinterface, wrong tag, trunk, or wrong gateway
  • NAT works one way, return traffic fails Stale table, swapped inside/outside roles, asymmetric routing
  • PBQ practice prompt

A switch trunk feeds a router serving VLAN 10 (users), VLAN 20 (voice), and VLAN 30 (servers). VLAN 10 reaches its gateway but cannot reach VLAN 30. The router has G0/0.10 and G0/0.20 but no G0/0.30. Fix: add the VLAN 30 subinterface with the matching 802.1Q tag and gateway IP, then confirm the trunk allows VLAN 30.