• nat的基础配置（动态nat，nat server）

    目录

    1.静态nat

    2.动态nat

    （1）配置公网地址池

    （2）配置acl，匹配做nat转换的源

    （3）将源转换为公网地址，其中no-pat表示不做端口转化，只做一对一的地址转换

    3.nat server(端口映射)

    以下面的配置为例

    AR1

    1. <Huawei>sys
    2. Enter system view, return user view with Ctrl+Z.
    3. [Huawei]sysname AR1
    4. [AR1]int g0/0/0
    5. [AR1-GigabitEthernet0/0/0]ip address 192.168.1.254 24
    6. Sep 11 2023 15:17:30-08:00 AR1 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP
    7.  on the interface GigabitEthernet0/0/0 has entered the UP state. 
    8. [AR1-GigabitEthernet0/0/0]qu
    9. [AR1]int g0/0/1
    10. [AR1-GigabitEthernet0/0/1]ip add 12.1.1.1 24
    11. Sep 11 2023 15:18:10-08:00 AR1 %%01IFNET/4/LINK_STATE(l)[1]:The line protocol IP
    12.  on the interface GigabitEthernet0/0/1 has entered the UP state. 
    13. [AR1-GigabitEthernet0/0/1]qu
    14. [AR1]

    AR2

    1. <Huawei>sys
    2. Enter system view, return user view with Ctrl+Z.
    3. [Huawei]sysname AR2
    4. [AR2]int g0/0/0
    5. [AR2-GigabitEthernet0/0/0]ip address 12.1.1.254 24
    6. Sep 11 2023 15:19:21-08:00 AR2 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP
    7.  on the interface GigabitEthernet0/0/0 has entered the UP state. 
    8. [AR2-GigabitEthernet0/0/0]qu
    9. [AR2]

    在这里PC1和PC2是能到网关（AR1）的，网关是有AR2的路由的

    1. <AR1>display ip routing-table
    2. Route Flags: R - relay, D - download to fib
    3. ------------------------------------------------------------------------------
    4. Routing Tables: Public
    5.          Destinations : 10       Routes : 10       
    6.  
    7. Destination/Mask    Proto   Pre  Cost      Flags NextHop         Interface
    8.  
    9.        12.1.1.0/24  Direct  0    0           D   12.1.1.1        GigabitEthernet
    10. 0/0/1
    11.        12.1.1.1/32  Direct  0    0           D   127.0.0.1       GigabitEthernet
    12. 0/0/1
    13.      12.1.1.255/32  Direct  0    0           D   127.0.0.1       GigabitEthernet
    14. 0/0/1
    15.       127.0.0.0/8   Direct  0    0           D   127.0.0.1       InLoopBack0
    16.       127.0.0.1/32  Direct  0    0           D   127.0.0.1       InLoopBack0
    17. 127.255.255.255/32  Direct  0    0           D   127.0.0.1       InLoopBack0
    18.     192.168.1.0/24  Direct  0    0           D   192.168.1.254   GigabitEthernet
    19. 0/0/0
    20.   192.168.1.254/32  Direct  0    0           D   127.0.0.1       GigabitEthernet
    21. 0/0/0
    22.   192.168.1.255/32  Direct  0    0           D   127.0.0.1       GigabitEthernet
    23. 0/0/0
    24. 255.255.255.255/32  Direct  0    0           D   127.0.0.1       InLoopBack0
    25.

    所以PC1和PC2能到达AR2,但是AR2没有回程路由，即不知道到达192.168.1.1或192.168.1.2如何走

    1. <AR2>display ip routing-table
    2. Route Flags: R - relay, D - download to fib
    3. ------------------------------------------------------------------------------
    4. Routing Tables: Public
    5.          Destinations : 7        Routes : 7        
    6.  
    7. Destination/Mask    Proto   Pre  Cost      Flags NextHop         Interface
    8.  
    9.        12.1.1.0/24  Direct  0    0           D   12.1.1.254      GigabitEthernet
    10. 0/0/0
    11.      12.1.1.254/32  Direct  0    0           D   127.0.0.1       GigabitEthernet
    12. 0/0/0
    13.      12.1.1.255/32  Direct  0    0           D   127.0.0.1       GigabitEthernet
    14. 0/0/0
    15.       127.0.0.0/8   Direct  0    0           D   127.0.0.1       InLoopBack0
    16.       127.0.0.1/32  Direct  0    0           D   127.0.0.1       InLoopBack0
    17. 127.255.255.255/32  Direct  0    0           D   127.0.0.1       InLoopBack0
    18. 255.255.255.255/32  Direct  0    0           D   127.0.0.1       InLoopBack0
    19.

     这里用nat将pc1的地址转换为公网地址，就可以ping通AR2        

    1.静态nat

    公网ip对应的是192.168.1.1这个内部的私网IP

    1. <AR1>sys
    2. Enter system view, return user view with Ctrl+Z.
    3. [AR1]nat static global 12.1.1.2 inside 192.168.1.1

    此时PC1 ping 不通AR2

    1. PC>ping 12.1.1.254 -t
    2.  
    3. Ping 12.1.1.254: 32 data bytes, Press Ctrl_C to break
    4. Request timeout!
    5. Request timeout!
    6. Request timeout!

     因为在全局下配置时，需要在接口上加上”nat static enable“

    1. [AR1]int g0/0/1
    2.  
    3. [AR1-GigabitEthernet0/0/1]nat static enable

    此时PC1能ping通了

    Request timeout!
    Request timeout!
    From 12.1.1.254: bytes=32 seq=22 ttl=254 time=46 ms
    From 12.1.1.254: bytes=32 seq=23 ttl=254 time=47 ms
    From 12.1.1.254: bytes=32 seq=24 ttl=254 time=32 ms
    From 12.1.1.254: bytes=32 seq=25 ttl=254 time=31 ms
    From 12.1.1.254: bytes=32 seq=26 ttl=254 time=47 ms
    From 12.1.1.254: bytes=32 seq=27 ttl=254 time=15 ms
    From 12.1.1.254: bytes=32 seq=28 ttl=254 time=32 ms
    From 12.1.1.254: bytes=32 seq=29 ttl=254 time=31 ms

    通过对AR2抓包，可见源地址变为了12.1.1.2,目的地址为12.1.1.254

    AR2有12.1.1.0/24 这一直连路由，所以就有了回程路由

    注意：

    在全局下配置时，需要在出接口配置 nat static enable

    如果直接在接口配置，就不需要加nat static enable

    1. [AR1-GigabitEthernet0/0/1]undo nat static enable
    2. [AR1-GigabitEthernet0/0/1]quit
    3. [AR1]undo nat static global 12.1.1.2 inside 192.168.1.1
    4. [AR1]int g0/0/1
    5. [AR1-GigabitEthernet0/0/1]nat static global 12.1.1.10 inside 192.168.1.1
    6. #不用在接口下再加入nat static enable
    7. #在pc1上ping AR2也是能ping通的

    2.动态nat

    （1）配置公网地址池
    [AR1]nat address-group 1 12.1.1.2 12.1.1.10
    （2）配置acl，匹配做nat转换的源
    1. [AR1]acl 2000
    2. [AR1-acl-basic-2000]rule 10 permit source 192.168.1.0 0.0.0.255
    （3）将源转换为公网地址，其中no-pat表示不做端口转化，只做一对一的地址转换
    1. [AR1-acl-basic-2000]quit
    2. [AR1]int g0/0/1
    3. [AR1-GigabitEthernet0/0/1]nat outbound 2000 address-group 1 no-pat
    4. #nat只有outbound,对于acl则可能有outbound或inbound

    配置完毕以后，pc1能ping通AR2        

    PC>ping 12.1.1.254

    Ping 12.1.1.254: 32 data bytes, Press Ctrl_C to break
    From 12.1.1.254: bytes=32 seq=1 ttl=254 time=47 ms
    From 12.1.1.254: bytes=32 seq=2 ttl=254 time=47 ms
    From 12.1.1.254: bytes=32 seq=3 ttl=254 time=47 ms
    From 12.1.1.254: bytes=32 seq=4 ttl=254 time=62 ms

     如果不加no-pat，多个用户可以用一个出口ip

    1. [AR1-GigabitEthernet0/0/1]undo nat outbound 2000 address-group 1 no-pat
    2. [AR1-GigabitEthernet0/0/1]quit
    3. [AR1]undo nat address-group 1
    4. [AR1]nat address-group 1 12.1.1.2 12.1.1.2
    5. [AR1]int g0/0/1
    6. [AR1-GigabitEthernet0/0/1]nat outbound 2000 address-group 1
    7. #多个用户可以用一个出口
    8.  
    9. #PC依旧能ping通
    10. PC>ping 12.1.1.254
    11.  
    12. Ping 12.1.1.254: 32 data bytes, Press Ctrl_C to break
    13. From 12.1.1.254: bytes=32 seq=1 ttl=254 time=47 ms
    14. From 12.1.1.254: bytes=32 seq=2 ttl=254 time=32 ms
    15. From 12.1.1.254: bytes=32 seq=3 ttl=254 time=31 ms

    easy ip：直接用出口的ip地址上网

    1. [AR1]int g0/0/1
    2. #将2000这个acl匹配的地址转换为公网地址
    3. [AR1-GigabitEthernet0/0/1]nat outbound 2000
    4.  
    5. #这样也能ping通
    6.  
    7. PC>ping 12.1.1.254
    8.  
    9. Ping 12.1.1.254: 32 data bytes, Press Ctrl_C to break
    10. From 12.1.1.254: bytes=32 seq=1 ttl=254 time=47 ms
    11. From 12.1.1.254: bytes=32 seq=2 ttl=254 time=32 ms
    12. From 12.1.1.254: bytes=32 seq=3 ttl=254 time=15 ms
    13. From 12.1.1.254: bytes=32 seq=4 ttl=254 time=31 ms
    14. From 12.1.1.254: bytes=32 seq=5 ttl=254 time=32 ms

    3.nat server(端口映射)

    1. #将内网服务器的地址，映射到公网的IP
    2.  
    3. [AR1-GigabitEthernet0/0/1]nat server protocol TCP global 12.1.1.2 80 inside 192.
    4. 168.1.2 80
    5. #若使用12.1.1.2的80端口，实际是访问192.168.1.2的80端口
  • 相关阅读:
    leetcode 4-寻找两个正序数组的中位数
    Microsoft Azure & NVIDIA IoT 开发者季 I｜Azure IoT & NVIDIA Jetson 开发基础
    uml用例图及其关系、类图及其关系、状态图、活动图、构件图与设计模式
    力扣(LeetCode)21. 合并两个有序链表(C++)
    汽车三元催化器的废品项目详解，三元催化再生项目的回收技术教学
    三、日志编写 —— TinyWebServer
    关于ribbon的重试机器，望解答
    figma对比sketch有什么优势和不足？
    面向面试知识-Redis
    gRPC协议详解
  • 原文地址：https://blog.csdn.net/weixin_69884785/article/details/132808595