EVE-NG. The host connected through the Cisco switch image does not see the Internet. How to fix?

Question

Computer networks

The network is built in EVE-NG.
The network uses the following topology:
Cisco image: Cisco vIOS Switch - viosl2-adventerprisek9-m.cml.SSA.high_iron_20180510

The essence of the problem: Win does not see the Internet, while pinging Switch and ISP, and ISP pinging Win.

Switch configuration:
Current configuration : 3286 bytes
!
! Last configuration change at 16:41:31 UTC Wed May 5 2021
!
version 15.2
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
service compress-config
!
hostname Switch
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
!
!
!
!
!
!
ip dhcp excluded-address 172.16.1.1
!
ip dhcp pool LAN
network 172.16.1.0 255.255.255.0
default-router 172.16.1.1
dns-server 8.8.8.8 8.8.4.4
!
!
ip cef
no ipv6 cef
!
!
!
spanning-tree mode pvst
spanning-tree extend system-id
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface GigabitEthernet0/0
no switchport
ip address 172.16.0.2 255.255.255.0
ip nat outside
negotiation auto
!
interface GigabitEthernet0/1
no switchport
ip address 172.16.1.1 255.255.255.0
ip nat inside
negotiation auto
!
interface GigabitEthernet0/2
negotiation auto
!
interface GigabitEthernet0/3
negotiation auto
!
interface GigabitEthernet1/0
negotiation auto
!
interface GigabitEthernet1/1
negotiation auto
!
interface GigabitEthernet1/2
negotiation auto
!
interface GigabitEthernet1/3
negotiation auto
!
ip default-gateway 172.16.0.1
ip nat pool ISP 172.16.0.51 172.16.0.60 netmask 255.255.255.0
ip nat inside source list 1 pool ISP
ip forward-protocol nd
!
ip http server
!
ip route 0.0.0.0 0.0.0.0 172.16.0.1
ip ssh server algorithm encryption aes128-ctr aes192-ctr aes256-ctr
ip ssh client algorithm encryption aes128-ctr aes192-ctr aes256-ctr
!
!
access-list 1 permit 172.16.1.0 0.0.0.255
!
!
!
!
control-plane
!

ISP static:


Pings:
Win ping Switch


Win ping ISP


Win tracert dns.google


Switch ping Win


Switch ping ISP


Switch ping dns.google


ISP ping Win


ISP ping Switch


ISP ping dns.google

Answer 1

So ISP masquerades the network that he gave out to the client, i.e. 172.16.0.0/24
but does not masquerade 172.16.1.0/24