NAT配置
NAT
配置
一、
实验目的
1、
静态的
NAT
配置
2、
动态的
NAT
配置
3、
PAT
配置
二、
实验拓扑
三、
实验步骤
R1
的基本配置
en
conf t
no ip domain-look
int f1/0
ip add 10.1.1 .1 255.255.255.0
no sh
int f0/0
ip add 192.168.1.1 255.255.255.0
no sh
exit
R2
的基本配置
en
conf t
no ip domain-look
int f0/0
ip add 192.168.1.2 255.255.255.0
no sh
int f1/0
ip add 172.16.1.1 255.255.255.0
no sh
exit
1.
静态
NAT
配置
R1
ip nat inside source static 10.1.1 .2 192.168.1.10
ip nat inside source static 10.1.1 .3 192.168.1.20
int f1/0
ip nat inside
int f0/0
ip nat outside
R2
ip nat inside source static 172.16.1.2 192.168.1.30
ip nat inside source static 172.16.1.3 192.168.1.40
int f1/0
ip nat inside
int f0/0
ip nat outside
验证
:
VPCS 1 >ping 192.168.1.2
192.168.1.2 icmp_seq=1 timeout
192.168.1.2 icmp_seq=2 time=110.000 ms
192.168.1.2 icmp_seq=3 time=62.000 ms
192.168.1.2 icmp_seq=4 time=47.000 ms
192.168.1.2 icmp_seq=5 time=62.000 ms
Router#sh ip nat translations
Pro Inside global Inside local Outside local Outside global
icmp 192.168.1.10:24510 10.1.1 .2:24510 192.168.1.2:24510 192.168.1.2:24510
icmp 192.168.1.10:24766 10.1.1 .2:24766 192.168.1.2:24766 192.168.1.2:24766
icmp 192.168.1.10:25022 10.1.1 .2:25022 192.168.1.2:25022 192.168.1.2:25022
icmp 192.168.1.10:25278 10.1.1 .2:25278 192.168.1.2:25278 192.168.1.2:25278
icmp 192.168.1.10:25534 10.1.1 .2:25534 192.168.1.2:25534 192.168.1.2:25534
icmp 192.168.1.10:25790 10.1.1 .2:25790 192.168.1.2:25790 192.168.1.2:25790
--- 192.168.1.10 10.1.1 .2 --- ---
--- 192.168.1.20 10.1.1 .3 --- ---
从上可以看出内网已经可以和外网通信了。
2.
动态
NAT
配置
R1
conf t
access-list 1 permit 10.1.1 .0 0.0.0.255
ip nat pool AAA 192.168.1.100 192.168.1.150 netmask 255.255.255.0
ip nat inside source list 1 pool AAA
int f1/0
ip nat inside
int f0/0
ip nat outside
R2
conf t
access-list 1 permit 172.16.1.0 0.0.0 .255
ip nat pool BBB 192.168.1.151 192.168.1.200 netmask 255.255.255.0
ip nat inside source list 1 pool BBB
int f1/0
ip nat inside
int f0/0
ip nat outside
验证：
VPCS 1 >ping 192.168.1.2
192.168.1.2 icmp_seq=1 timeout
192.168.1.2 icmp_seq=2 time=125.000 ms
192.168.1.2 icmp_seq=3 time=125.000 ms
192.168.1.2 icmp_seq=4 time=47.000 ms
192.168.1.2 icmp_seq=5 time=125.000 ms
Router#sh ip nat translations
Pro Inside global Inside local Outside local Outside global
icmp 192.168.1.100:50368 10.1.1 .2:50368 192.168.1.2:50368 192.168.1.2:50368
icmp 192.168.1.100:50624 10.1.1 .2:50624 192.168.1.2:50624 192.168.1.2:50624
icmp 192.168.1.100:50880 10.1.1 .2:50880 192.168.1.2:50880 192.168.1.2:50880
icmp 192.168.1.100:51136 10.1.1 .2:51136 192.168.1.2:51136 192.168.1.2:51136
icmp 192.168.1.100:51392 10.1.1 .2:51392 192.168.1.2:51392 192.168.1.2:51392
icmp 192.168.1.100:51648 10.1.1 .2:51648 192.168.1.2:51648 192.168.1.2:51648
--- 192.168.1.100 10.1.1 .2 --- ---
Router#sh ip nat translations
Pro Inside global Inside local Outside local Outside global
--- 192.168.1.100 10.1.1 .2 --- ---
icmp 192.168.1.101:10180 10.1.1 .3:10180 192.168.1.2:10180 192.168.1.2:10180
icmp 192.168.1.101:10436 10.1.1 .3:10436 192.168.1.2:10436 192.168.1.2:10436
icmp 192.168.1.101:10692 10.1.1 .3:10692 192.168.1.2:10692 192.168.1.2:10692
icmp 192.168.1.101:10948 10.1.1 .3:10948 192.168.1.2:10948 192.168.1.2:10948
icmp 192.168.1.101:11204 10.1.1 .3:11204 192.168.1.2:11204 192.168.1.2:11204
icmp 192.168.1.101:11460 10.1.1 .3:11460 192.168.1.2:11460 192.168.1.2:11460
--- 192.168.1.101 10.1.1 .3 --- ---
Router#
从上面可以看到内网已经从地址池中动态的选择了外网
IP
（默认是从小往大）
3.
PAT
配置
R1
conf t
access-list 1 permit 10.1.1 .0 0.0.0.255
ip nat pool ABC 192.168.1.20 192.168.1.20 netmask 255.255.255.0
定义地址池
ip nat inside source list 1 pool ABC overload
int f1/0
ip nat inside
int f0/0
ip nat outside
end
R2
conf t
access-list 1 permit 172.16.1.0 0.0.0 .255
ip nat inside source list 1 int f0/0 overload
定义接口
int f1/0
ip nat inside
int f0/0
ip nat outside
end
验证：
VPCS 1 >ping 192.168.1.2
192.168.1.2 icmp_seq=1 time=172.000 ms
192.168.1.2 icmp_seq=2 time=62.000 ms
192.168.1.2 icmp_seq=3 time=94.000 ms
192.168.1.2 icmp_seq=4 time=78.000 ms
192.168.1.2 icmp_seq=5 time=62.000 ms
VPCS 2 >ping 192.168.1.2
192.168.1.2 icmp_seq=1 time=125.000 ms
192.168.1.2 icmp_seq=2 time=93.000 ms
192.168.1.2 icmp_seq=3 time=94.000 ms
192.168.1.2 icmp_seq=4 time=62.000 ms
192.168.1.2 icmp_seq=5 time=93.000 ms
VPCS 3 >ping 192.168.1.1
192.168.1.1 icmp_seq=1 time=141.000 ms
192.168.1.1 icmp_seq=2 time=47.000 ms
192.168.1.1 icmp_seq=3 time=78.000 ms
192.168.1.1 icmp_seq=4 time=78.000 ms
192.168.1.1 icmp_seq=5 time=62.000 ms
VPCS 4 >ping 192.168.1.1
192.168.1.1 icmp_seq=1 time=110.000 ms
192.168.1.1 icmp_seq=2 time=94.000 ms
192.168.1.1 icmp_seq=3 time=62.000 ms
192.168.1.1 icmp_seq=4 time=78.000 ms
192.168.1.1 icmp_seq=5 time=125.000 ms
Router#sh ip nat translations
（
R1
）
Pro Inside global Inside local Outside local Outside global
icmp 192.168.1.20:7625 10.1.1 .2:7625 192.168.1.2:7625 192.168.1.2:7625
icmp 192.168.1.20:7881 10.1.1 .2:7881 192.168.1.2:7881 192.168.1.2:7881
icmp 192.168.1.20:8137 10.1.1 .2:8137 192.168.1.2:8137 192.168.1.2:8137
icmp 192.168.1.20:8393 10.1.1 .2:8393 192.168.1.2:8393 192.168.1.2:8393
icmp 192.168.1.20:8649 10.1.1 .2:8649 192.168.1.2:8649 192.168.1.2:8649
icmp 192.168.1.20:8905 10.1.1 .2:8905 192.168.1.2:8905 192.168.1.2:8905
icmp 192.168.1.20:10185 10.1.1 .3:10185 192.168.1.2:10185 192.168.1.2:10185
icmp 192.168.1.20:10697 10.1.1 .3:10697 192.168.1.2:10697 192.168.1.2:10697
icmp 192.168.1.20:10953 10.1.1 .3:10953 192.168.1.2:10953 192.168.1.2:10953
icmp 192.168.1.20:11209 10.1.1 .3:11209 192.168.1.2:11209 192.168.1.2:11209
icmp 192.168.1.20:11465 10.1.1 .3:11465 192.168.1.2:11465 192.168.1.2:11465
icmp 192.168.1.20:11721 10.1.1 .3:11721 192.168.1.2:11721 192.168.1.2:11721
Router#sh ip nat translations
（
R2
）
Pro Inside global Inside local Outside local Outside global
icmp 192.168.1.2:13001 172.16.1.2:13001 192.168.1.1:13001 192.168.1.1:13001
icmp 192.168.1.2:13257 172.16.1.2:13257 192.168.1.1:13257 192.168.1.1:13257
icmp 192.168.1.2:13769 172.16.1.2:13769 192.168.1.1:13769 192.168.1.1:13769
icmp 192.168.1.2:14025 172.16.1.2:14025 192.168.1.1:14025 192.168.1.1:14025
icmp 192.168.1.2:14281 172.16.1.2:14281 192.168.1.1:14281 192.168.1.1:14281
icmp 192.168.1.2:14537 172.16.1.2:14537 192.168.1.1:14537 192.168.1.1:14537
icmp 192.168.1.2:15817 172.16.1.3:15817 192.168.1.1:15817 192.168.1.1:15817
icmp 192.168.1.2:16073 172.16.1.3:16073 192.168.1.1:16073 192.168.1.1:16073
icmp 192.168.1.2:16329 172.16.1.3:16329 192.168.1.1:16329 192.168.1.1:16329
icmp 192.168.1.2:16585 172.16.1.3:16585 192.168.1.1:16585 192.168.1.1:16585
icmp 192.168.1.2:16841 172.16.1.3:16841 192.168.1.1:16841 192.168.1.1:16841
icmp 192.168.1.2:17097 172.16.1.3:17097 192.168.1.1:17097 192.168.1.1:17097
从实验结果可以看出
PAT
配置的灵活性即多个主机共用一个公网
IP
，用端口号来识别
四、
实验总结
三种方法都到达了地址转换，其中应用最多的还是
PAT
。
NAT
的工作原理：
当内部网络中的一台主机想传输数据到外部网络时，它先将数据包传输到 NAT 路由器上，路由器检查数据包的报头，获取该数据包的源 IP 信息，并从它的 NAT 映射表中找出与该 IP 匹配的转换条目，用所选用的内部全局地址（全球唯一的 IP 地址）来替换内部局部地址，并转发数据包。
当外部网络对内部主机进行应答时，数据包被送到 NAT 路由器上，路由器接收到目的地址为内部全局地址的数据包后，它将用内部全局地址通过 NAT 映射表查找出内部局部地址，然后将数据包的目的地址替换成内部局部地址，并将数据包转发到内部主机。
当内部网络中的一台主机想传输数据到外部网络时，它先将数据包传输到 NAT 路由器上，路由器检查数据包的报头，获取该数据包的源 IP 信息，并从它的 NAT 映射表中找出与该 IP 匹配的转换条目，用所选用的内部全局地址（全球唯一的 IP 地址）来替换内部局部地址，并转发数据包。
当外部网络对内部主机进行应答时，数据包被送到 NAT 路由器上，路由器接收到目的地址为内部全局地址的数据包后，它将用内部全局地址通过 NAT 映射表查找出内部局部地址，然后将数据包的目的地址替换成内部局部地址，并将数据包转发到内部主机。