网络地址转换中的PAT

网络地址转换：NAT

随着现在IPV4地址数量正在面临着枯竭，IPV6的普及又还需要经过漫长的时间，使用NAT可以暂时的缓解IPV4地址不够用，降低企业搭建网络的成本，同时在面对IPV6时也可以平滑的过度。

隐藏辣内部网络的信息，也具有一定的安全性。

 

NAT分为：静态，动态，PAT三种。

 

这次的实验时针对PAT的。

 

下面先看看环境：

 

分别在两个路由器上启用PAT。

 

先看R1（左边）的配置信息

Router#sh running-config
Building configuration...

Current configuration : 1141 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
hostname Router
boot-start-marker
boot-end-marker
no aaa new-model
memory-size iomem 5
ip cef

interface Serial0/0
 ip address 192.168.1.1 255.255.255.0
 ip nat outside
 ip virtual-reassembly
 serial restart-delay 0
 no fair-queue
!
interface FastEthernet1/0
 ip address 1.1.1.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 duplex auto
 speed auto
!
ip http server
no ip http secure-server
!
ip route 0.0.0.0 0.0.0.0 192.168.1.2
!
ip nat pool pat 192.168.1.1 192.168.1.1 netmask 255.255.255.0
ip nat inside source list 1 pool pat overload
!
access-list 1 permit 1.1.1.0 0.0.0.255
!
!
control-plane

line con 0
line aux 0
line vty 0 4
!
!
end

 

 

再看R2（右边）的配置信息

Router#sh running-config
Building configuration...

Current configuration : 1048 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
no aaa new-model
memory-size iomem 5
!
ip cef

interface Serial0/0
 ip address 192.168.1.2 255.255.255.0
 ip nat outside
 ip virtual-reassembly
 serial restart-delay 0
!
interface Serial0/1
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial0/2
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial0/3
 no ip address
 shutdown
 serial restart-delay 0
!
interface FastEthernet1/0
 ip address 2.1.1.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 duplex auto
 speed auto
!        
ip http server
no ip http secure-server
!
ip route 0.0.0.0 0.0.0.0 192.168.1.1
!
ip nat pool pat 192.168.1.2 192.168.1.2 netmask 255.255.255.0
ip nat inside source list 1 pool pat overload
!
access-list 1 permit 2.1.1.0 0.0.0.255
!
!
control-plane
!
line con 0
line aux 0
line vty 0 4
!
!
end

这样PAT就配置成功了。

 

现在验证一下：

在1.1.1.2上ping192.168.1.2

 

使用以下命令可以查看nat转换。

Router#sh ip nat translations
Pro Inside global                Inside local                Outside local        Outside global
icmp 192.168.1.1:26379     1.1.1.2:26379             192.168.1.2:26379  192.168.1.2:26379
icmp 192.168.1.1:26635     1.1.1.2:26635             192.168.1.2:26635  192.168.1.2:26635
icmp 192.168.1.1:26891     1.1.1.2:26891             192.168.1.2:26891  192.168.1.2:26891
icmp 192.168.1.1:27147     1.1.1.2:27147             192.168.1.2:27147  192.168.1.2:27147
icmp 192.168.1.1:27403     1.1.1.2:27403             192.168.1.2:27403  192.168.1.2:27403
icmp 192.168.1.1:27659     1.1.1.2:27659             192.168.1.2:27659  192.168.1.2:27659

 

在2.1.1.2上ping192.168.1.1

 

使用以下命令可以查看nat转换.

Router#sh ip nat translations
Pro Inside global                 Inside local              Outside local        Outside global
icmp 192.168.1.2:33036       2.1.1.2:33036          192.168.1.1:33036  192.168.1.1:33036
icmp 192.168.1.2:33292       2.1.1.2:33292          192.168.1.1:33292  192.168.1.1:33292
icmp 192.168.1.2:33548       2.1.1.2:33548          192.168.1.1:33548  192.168.1.1:33548
icmp 192.168.1.2:33804       2.1.1.2:33804          192.168.1.1:33804  192.168.1.1:33804
icmp 192.168.1.2:34060       2.1.1.2:34060          192.168.1.1:34060  192.168.1.1:34060
icmp 192.168.1.2:34316       2.1.1.2:34316          192.168.1.1:34316  192.168.1.1:34316

 

实验完成。