ASA中的策略NAT

一般情况下，在转换过程中目的地址是不会被考虑的，而策略NAT可以基于ACL里定义的源和目的地址，将本址转成不同的全局地址。有动态策略NAT和静态策略NAT两种。需要使用access-list命令定义被转换流中的源地址和目的地址，再使用static或nat/global创建NAT

 

R1#show run
!        
interface Loopback1
 ip address 1.1.3.1 255.255.255.0
!        
interface FastEthernet0/0
 ip address 1.1.1.1 255.255.255.0
!
interface FastEthernet0/1
 ip address 1.1.2.1 255.255.255.0
 no keepalive
!
router ospf 1
 log-adjacency-changes
 network 1.1.1.0 0.0.0.255 area 0
 network 1.1.2.0 0.0.0.255 area 1

 network 1.1.3.0 0.0.0.255 area 2
!
R3#show run
!        
interface FastEthernet0/0
 ip address 192.168.1.3 255.255.255.0
 duplex auto
 speed auto
!
interface FastEthernet0/1
 ip address 192.168.2.3 255.255.255.0
 duplex auto
 speed auto
 no keepalive
!
ip route 0.0.0.0 0.0.0.0 192.168.1.2
!

ciscoasa(config)# show run
!
interface Ethernet0/0
 nameif inside
 security-level 100
 ip address 1.1.1.2 255.255.255.0
!
interface Ethernet0/1
 nameif outside
 security-level 0
 ip address 192.168.1.2 255.255.255.0

access-list aclin extended permit icmp any any
access-group aclin in interface outside
！（下面使用策略NAT，包括静态和动态）

access-list policy-dynamic extended permit ip 1.1.2.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list policy-dynamic extended permit ip 1.1.1.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list policy-static extended permit ip host 1.1.3.1 192.168.2.0 255.255.255.0

nat (inside) 1 access-list policy-dynamic
global (outside) 1 192.168.0.1-192.168.0.14 netmask 255.255.255.240
static (inside,outside) 192.168.0.18  access-list policy-static

!
router ospf 1
 network 1.1.1.0 255.255.255.0 area 0
 log-adj-changes
 default-information originate
!
route outside 0.0.0.0 0.0.0.0 192.168.1.3 1

 

使用下面工具进行测试：
show xlate 可以查看转换槽的内容
clear xlate 可以消除转换槽的内容
show conn 可以查看所有处于活跃的边接

 

 

动态策略NAT测试：
ciscoasa(config)# show xlate
1 in use, 3 most used
Global 192.168.0.18 Local 1.1.3.1（可以看到已经为源1.1.3.1创建了转换）
在R1上使用扩展ping，源为1.1.2.1 目的为192.168.1.3
使用debug icmp trace可以看到：
ICMP echo request from inside:1.1.2.1 to outside:192.168.1.3 ID=17 seq=3 len=72
ICMP echo request translating inside:1.1.2.1 to outside:192.168.0.1
ICMP echo reply from outside:192.168.1.3 to inside:192.168.0.1 ID=17 seq=3 len=72
ICMP echo reply untranslating outside:192.168.0.1 to inside:1.1.2.1
在R1上使用扩展ping，源为1.1.1.1 目的为192.168.1.3
使用debug icmp trace可以看到：
ICMP echo request from inside:1.1.1.1 to outside:192.168.1.3 ID=18 seq=3 len=72
ICMP echo request translating inside:1.1.1.1 to outside:192.168.0.2
ICMP echo reply from outside:192.168.1.3 to inside:192.168.0.2 ID=18 seq=3 len=72
ICMP echo reply untranslating outside:192.168.0.2 to inside:1.1.1.1
配置成功

静态策略NAT测试：
在R1上使用扩展ping，源为1.1.2.1 目的为192.168.2.3
使用debug icmp trace可以看到：
ICMP echo request from inside:1.1.3.1 to outside:192.168.2.3 ID=19 seq=3 len=72
ICMP echo request translating inside:1.1.3.1 to outside:192.168.0.18
ICMP echo reply from outside:192.168.2.3 to inside:192.168.0.18 ID=19 seq=3 len=72
ICMP echo reply untranslating outside:192.168.0.18 to inside:1.1.3.1

 

OK！