ensp 防火墙 pat 映射

 交换机配置

vlan 20
quit
int e0/0/5
port link-type access 
port default vlan 20
int e0/0/6
port link-type access
port default vlan 20


//如果下面配过就不用配了
#
int e0/0/4
port link-type trunk
port trunk allow-pass vlan all
#

防火墙配置

//建立vlan 20
vlan 20
quit
int vlanif 20
ip add 192.168.20.254 24
service-manage ping permit



//将vlanif20 加入trust1区
firewall zone name trust1
add int vlanif 20

配置安全策略
security-policy
rule name trust1_to_untrust1
source-zone trust1
destination-zone untrust1
action permit 

//pat映射

//添加映射池
nat address-group 2v1 1
mode pat
section 0 205.1.1.100 205.1.1.100

//添加pat策略
nat-policy 
rule name pat
source-zone trust1
destination-zone untrust1
action source-nat address-group 2v1
//配置黑洞路由
ip route-static 205.1.1.100 32 null 0

pc6配置

 pc7配置

 ping 203.1.1.1 并验证 display firewall session table