• nat的基础配置（动态nat，nat server）

    目录

    1.静态nat

    2.动态nat

    （1）配置公网地址池

    （2）配置acl，匹配做nat转换的源

    （3）将源转换为公网地址，其中no-pat表示不做端口转化，只做一对一的地址转换

    3.nat server(端口映射)

    以下面的配置为例

    AR1

    1. <Huawei>sys
    2. Enter system view, return user view with Ctrl+Z.
    3. [Huawei]sysname AR1
    4. [AR1]int g0/0/0
    5. [AR1-GigabitEthernet0/0/0]ip address 192.168.1.254 24
    6. Sep 11 2023 15:17:30-08:00 AR1 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP
    7.  on the interface GigabitEthernet0/0/0 has entered the UP state. 
    8. [AR1-GigabitEthernet0/0/0]qu
    9. [AR1]int g0/0/1
    10. [AR1-GigabitEthernet0/0/1]ip add 12.1.1.1 24
    11. Sep 11 2023 15:18:10-08:00 AR1 %%01IFNET/4/LINK_STATE(l)[1]:The line protocol IP
    12.  on the interface GigabitEthernet0/0/1 has entered the UP state. 
    13. [AR1-GigabitEthernet0/0/1]qu
    14. [AR1]

    AR2

    1. <Huawei>sys
    2. Enter system view, return user view with Ctrl+Z.
    3. [Huawei]sysname AR2
    4. [AR2]int g0/0/0
    5. [AR2-GigabitEthernet0/0/0]ip address 12.1.1.254 24
    6. Sep 11 2023 15:19:21-08:00 AR2 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP
    7.  on the interface GigabitEthernet0/0/0 has entered the UP state. 
    8. [AR2-GigabitEthernet0/0/0]qu
    9. [AR2]

    在这里PC1和PC2是能到网关（AR1）的，网关是有AR2的路由的

    1. <AR1>display ip routing-table
    2. Route Flags: R - relay, D - download to fib
    3. ------------------------------------------------------------------------------
    4. Routing Tables: Public
    5.          Destinations : 10       Routes : 10       
    6.  
    7. Destination/Mask    Proto   Pre  Cost      Flags NextHop         Interface
    8.  
    9.        12.1.1.0/24  Direct  0    0           D   12.1.1.1        GigabitEthernet
    10. 0/0/1
    11.        12.1.1.1/32  Direct  0    0           D   127.0.0.1       GigabitEthernet
    12. 0/0/1
    13.      12.1.1.255/32  Direct  0    0           D   127.0.0.1       GigabitEthernet
    14. 0/0/1
    15.       127.0.0.0/8   Direct  0    0           D   127.0.0.1       InLoopBack0
    16.       127.0.0.1/32  Direct  0    0           D   127.0.0.1       InLoopBack0
    17. 127.255.255.255/32  Direct  0    0           D   127.0.0.1       InLoopBack0
    18.     192.168.1.0/24  Direct  0    0           D   192.168.1.254   GigabitEthernet
    19. 0/0/0
    20.   192.168.1.254/32  Direct  0    0           D   127.0.0.1       GigabitEthernet
    21. 0/0/0
    22.   192.168.1.255/32  Direct  0    0           D   127.0.0.1       GigabitEthernet
    23. 0/0/0
    24. 255.255.255.255/32  Direct  0    0           D   127.0.0.1       InLoopBack0
    25.

    所以PC1和PC2能到达AR2,但是AR2没有回程路由，即不知道到达192.168.1.1或192.168.1.2如何走

    1. <AR2>display ip routing-table
    2. Route Flags: R - relay, D - download to fib
    3. ------------------------------------------------------------------------------
    4. Routing Tables: Public
    5.          Destinations : 7        Routes : 7        
    6.  
    7. Destination/Mask    Proto   Pre  Cost      Flags NextHop         Interface
    8.  
    9.        12.1.1.0/24  Direct  0    0           D   12.1.1.254      GigabitEthernet
    10. 0/0/0
    11.      12.1.1.254/32  Direct  0    0           D   127.0.0.1       GigabitEthernet
    12. 0/0/0
    13.      12.1.1.255/32  Direct  0    0           D   127.0.0.1       GigabitEthernet
    14. 0/0/0
    15.       127.0.0.0/8   Direct  0    0           D   127.0.0.1       InLoopBack0
    16.       127.0.0.1/32  Direct  0    0           D   127.0.0.1       InLoopBack0
    17. 127.255.255.255/32  Direct  0    0           D   127.0.0.1       InLoopBack0
    18. 255.255.255.255/32  Direct  0    0           D   127.0.0.1       InLoopBack0
    19.

     这里用nat将pc1的地址转换为公网地址，就可以ping通AR2        

    1.静态nat

    公网ip对应的是192.168.1.1这个内部的私网IP

    1. <AR1>sys
    2. Enter system view, return user view with Ctrl+Z.
    3. [AR1]nat static global 12.1.1.2 inside 192.168.1.1

    此时PC1 ping 不通AR2

    1. PC>ping 12.1.1.254 -t
    2.  
    3. Ping 12.1.1.254: 32 data bytes, Press Ctrl_C to break
    4. Request timeout!
    5. Request timeout!
    6. Request timeout!

     因为在全局下配置时，需要在接口上加上”nat static enable“

    1. [AR1]int g0/0/1
    2.  
    3. [AR1-GigabitEthernet0/0/1]nat static enable

    此时PC1能ping通了

    Request timeout!
    Request timeout!
    From 12.1.1.254: bytes=32 seq=22 ttl=254 time=46 ms
    From 12.1.1.254: bytes=32 seq=23 ttl=254 time=47 ms
    From 12.1.1.254: bytes=32 seq=24 ttl=254 time=32 ms
    From 12.1.1.254: bytes=32 seq=25 ttl=254 time=31 ms
    From 12.1.1.254: bytes=32 seq=26 ttl=254 time=47 ms
    From 12.1.1.254: bytes=32 seq=27 ttl=254 time=15 ms
    From 12.1.1.254: bytes=32 seq=28 ttl=254 time=32 ms
    From 12.1.1.254: bytes=32 seq=29 ttl=254 time=31 ms

    通过对AR2抓包，可见源地址变为了12.1.1.2,目的地址为12.1.1.254

    AR2有12.1.1.0/24 这一直连路由，所以就有了回程路由

    注意：

    在全局下配置时，需要在出接口配置 nat static enable

    如果直接在接口配置，就不需要加nat static enable

    1. [AR1-GigabitEthernet0/0/1]undo nat static enable
    2. [AR1-GigabitEthernet0/0/1]quit
    3. [AR1]undo nat static global 12.1.1.2 inside 192.168.1.1
    4. [AR1]int g0/0/1
    5. [AR1-GigabitEthernet0/0/1]nat static global 12.1.1.10 inside 192.168.1.1
    6. #不用在接口下再加入nat static enable
    7. #在pc1上ping AR2也是能ping通的

    2.动态nat

    （1）配置公网地址池
    [AR1]nat address-group 1 12.1.1.2 12.1.1.10
    （2）配置acl，匹配做nat转换的源
    1. [AR1]acl 2000
    2. [AR1-acl-basic-2000]rule 10 permit source 192.168.1.0 0.0.0.255
    （3）将源转换为公网地址，其中no-pat表示不做端口转化，只做一对一的地址转换
    1. [AR1-acl-basic-2000]quit
    2. [AR1]int g0/0/1
    3. [AR1-GigabitEthernet0/0/1]nat outbound 2000 address-group 1 no-pat
    4. #nat只有outbound,对于acl则可能有outbound或inbound

    配置完毕以后，pc1能ping通AR2        

    PC>ping 12.1.1.254

    Ping 12.1.1.254: 32 data bytes, Press Ctrl_C to break
    From 12.1.1.254: bytes=32 seq=1 ttl=254 time=47 ms
    From 12.1.1.254: bytes=32 seq=2 ttl=254 time=47 ms
    From 12.1.1.254: bytes=32 seq=3 ttl=254 time=47 ms
    From 12.1.1.254: bytes=32 seq=4 ttl=254 time=62 ms

     如果不加no-pat，多个用户可以用一个出口ip

    1. [AR1-GigabitEthernet0/0/1]undo nat outbound 2000 address-group 1 no-pat
    2. [AR1-GigabitEthernet0/0/1]quit
    3. [AR1]undo nat address-group 1
    4. [AR1]nat address-group 1 12.1.1.2 12.1.1.2
    5. [AR1]int g0/0/1
    6. [AR1-GigabitEthernet0/0/1]nat outbound 2000 address-group 1
    7. #多个用户可以用一个出口
    8.  
    9. #PC依旧能ping通
    10. PC>ping 12.1.1.254
    11.  
    12. Ping 12.1.1.254: 32 data bytes, Press Ctrl_C to break
    13. From 12.1.1.254: bytes=32 seq=1 ttl=254 time=47 ms
    14. From 12.1.1.254: bytes=32 seq=2 ttl=254 time=32 ms
    15. From 12.1.1.254: bytes=32 seq=3 ttl=254 time=31 ms

    easy ip：直接用出口的ip地址上网

    1. [AR1]int g0/0/1
    2. #将2000这个acl匹配的地址转换为公网地址
    3. [AR1-GigabitEthernet0/0/1]nat outbound 2000
    4.  
    5. #这样也能ping通
    6.  
    7. PC>ping 12.1.1.254
    8.  
    9. Ping 12.1.1.254: 32 data bytes, Press Ctrl_C to break
    10. From 12.1.1.254: bytes=32 seq=1 ttl=254 time=47 ms
    11. From 12.1.1.254: bytes=32 seq=2 ttl=254 time=32 ms
    12. From 12.1.1.254: bytes=32 seq=3 ttl=254 time=15 ms
    13. From 12.1.1.254: bytes=32 seq=4 ttl=254 time=31 ms
    14. From 12.1.1.254: bytes=32 seq=5 ttl=254 time=32 ms

    3.nat server(端口映射)

    1. #将内网服务器的地址，映射到公网的IP
    2.  
    3. [AR1-GigabitEthernet0/0/1]nat server protocol TCP global 12.1.1.2 80 inside 192.
    4. 168.1.2 80
    5. #若使用12.1.1.2的80端口，实际是访问192.168.1.2的80端口
  • 相关阅读:
    2023鸿蒙预定未来，环境搭建学习
    线上项目源码安全性处理方案
    国庆看坚如磐石
    6月PMP考试准考证问题及注意事项，考生必读
    UVM基础-Sequence、Sequencer（一）
    [附源码]java毕业设计源冀平行进口车系统
    Spring Boot 加载本地 JAR 包的技术实践
    Hbase Coprocessor 协处理器 与 JavaAPI
    go中select语句
    FFmpeg 解码 H.264 视频出现花屏和马赛克的解决办法
  • 原文地址：https://blog.csdn.net/weixin_69884785/article/details/132808595