ASA中NAT动态内部转换

 

 

 

R1#show run
!        
interface FastEthernet0/0
 ip address 1.1.1.1 255.255.255.0
!
interface FastEthernet0/1
 ip address 1.1.2.1 255.255.255.0
 no keepalive
!
router ospf 1
 log-adjacency-changes
 network 1.1.1.0 0.0.0.255 area 0
 network 1.1.2.0 0.0.0.255 area 1
!
R3#show run
!        
interface FastEthernet0/0
 ip address 192.168.1.3 255.255.255.0
 duplex auto
 speed auto
!
interface FastEthernet0/1
 ip address 192.168.2.3 255.255.255.0
 duplex auto
 speed auto
 no keepalive
!
ip route 0.0.0.0 0.0.0.0 192.168.1.2
!

ciscoasa(config)# show run
!
interface Ethernet0/0
 nameif inside
 security-level 100
 ip address 1.1.1.2 255.255.255.0
!
interface Ethernet0/1
 nameif outside
 security-level 0
 ip address 192.168.1.2 255.255.255.0

access-list aclin extended permit icmp any any
access-group aclin in interface outside

global (outside) 1 192.168.0.1-192.168.0.14 netmask 255.255.255.240
nat (inside) 1 0.0.0.0 0.0.0.0
（你也可以针对不同的源地址来进行动态转换，如：
nat(inside) 1 1.1.1.0 255.255.255.0
nat(inside) 2 1.1.2.0 255.255.255.0
global(outside) 1 192.168.0.1-192.168.0.14 netmask 255.255.255.240
global(outside) 2 192.168.0.17-192.168.0.30 netmask 255.255.255.240）

!
router ospf 1
 network 1.1.1.0 255.255.255.0 area 0
 log-adj-changes
 default-information originate
!
route outside 0.0.0.0 0.0.0.0 192.168.1.3 1

 

使用下面工具进行测试：
show xlate 可以查看转换槽的内容
clear xlate 可以消除转换槽的内容
show conn 可以查看所有处于活跃的边接

NAT动态内部转换测试
在R1上扩展ping 指定不同的源地址ping 192.168.1.3，然后查看asa转换槽的内容，如下
ciscoasa(config)# show xlate
2 in use, 2 most used
Global 192.168.0.1 Local 1.1.1.1（源为1.1.1.1的地址转换为192.168.0.1）
Global 192.168.0.2 Local 1.1.2.1（源为1.1.2.1的地址转换为192.168.0.2）
使用debug icmp trace可以看到
ICMP echo request from inside:1.1.1.1 to outside:192.168.1.3 ID=11 seq=3 len=72
ICMP echo request translating inside:1.1.1.1 to outside:192.168.0.1
ICMP echo reply from outside:192.168.1.3 to inside:192.168.0.1 ID=11 seq=3 len=72
ICMP echo reply untranslating outside:192.168.0.1 to inside:1.1.1.1

ICMP echo request from inside:1.1.2.1 to outside:192.168.1.3 ID=12 seq=3 len=72
ICMP echo request translating inside:1.1.2.1 to outside:192.168.0.2
ICMP echo reply from outside:192.168.1.3 to inside:192.168.0.2 ID=12 seq=3 len=72
ICMP echo reply untranslating outside:192.168.0.2 to inside:1.1.2.1