ASA 8.4.2基于twice nat的 NAT的配置方式
关于twice nat的配置
twice nat的配置提供给用户能够利用一条rule就能匹配流量的源和目的的应用
在twice nat中的目的的匹配和转换是可选的，可以使idendity NAT和进行静态转换
在twice nat中虽然设计的初衷是可以匹配目的地址但是在实际使用中匹配目的地址是可选的
利用twice nat来配置动态nat的配置
object network realsource
subnet 2.2.2.0 255.255.255.0
object network mappedsource
range 1.1.1.100 1.1.1.150
object network realdest
host 1.1.1.1
object network mappeddst
host 1.1.1.1
最后调用nat进行相应的匹配
nat (inside,outside) source dynamic realsource mappedsource destination static mappeddst
realdest
ASA# show xlate
2 in use, 2 most used
Flags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twice
NAT from outside:1.1.1.1 to inside:1.1.1.1
flags sIT idle 0:02:22 timeout 0:00:00
NAT from inside:2.2.2.101 to outside:1.1.1.100 flags i idle 0:02:22 timeout 3:00:00
2.利用twice nat配置pat
object network realsource
subnet 2.2.2.0 255.255.255.0
object network mappedsource
range 1.1.1.100 1.1.1.150
object network realdest
host 2.2.2.100
object network mappeddst
host 1.1.1.100
nat (inside,outside) source dynamic realsource pat-pool mappedsource destination static mappeddst realdest
注意配置的顺序和关键字，亲自测试过如果destination中mapped配置错误的话是会影响通信的，如果配置错误ASA是不会对配置中object network中的地址做代理ARP应答的。
实际测试结果
接收方
R1#
*Mar 1 01:24:44.207: ICMP: echo reply sent, src 1.1.1.1, dst 1.1.1.100
*Mar 1 01:24:44.295: ICMP: echo reply sent, src 1.1.1.1, dst 1.1.1.100
*Mar 1 01:24:44.331: ICMP: echo reply sent, src 1.1.1.1, dst 1.1.1.100
*Mar 1 01:24:44.347: ICMP: echo reply sent, src 1.1.1.1, dst 1.1.1.100
*Mar 1 01:24:44.371: ICMP: echo reply sent, src 1.1.1.1, dst 1.1.1.100
R1#
发送方
R2#ping 2.2.2.200
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2.2.2.200, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 16/48/140 ms
R2#
*Mar 1 01:24:33.515: ICMP: echo reply rcvd, src 2.2.2.200, dst 2.2.2.101
*Mar 1 01:24:33.567: ICMP: echo reply rcvd, src 2.2.2.200, dst 2.2.2.101
*Mar 1 01:24:33.587: ICMP: echo reply rcvd, src 2.2.2.200, dst 2.2.2.101
*Mar 1 01:24:33.611: ICMP: echo reply rcvd, src 2.2.2.200, dst 2.2.2.101
*Mar 1 01:24:33.623: ICMP: echo reply rcvd, src 2.2.2.200, dst 2.2.2.101
注意R2收到的reply数据包中的源ip地址
ASA上查看信息
ASA# show xlate
2 in use, 3 most used
Flags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twice
NAT from outside:1.1.1.1 to inside:2.2.2.200
flags sT idle 0:00:02 timeout 0:00:00
ICMP PAT from inside:2.2.2.101/19 to outside:1.1.1.100/19 flags ri idle 0:00:02 timeout 0:00:30
ASA#
3.利用twice-nat来配置static nat和基于 静态nat和端口的转换
object network mappedsource
subnet 1.1.1.0 255.255.255.0
object network source
subnet 2.2.2.0 255.255.255.0
object network realdest
host 1.1.1.1
object network mappeddest
host 2.2.2.101
nat (inside,outside) source static mappedsource mappedsource destination static mappeddest realdest
这个时候进行静态的转换
2 in use, 3 most used
Flags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twice
NAT from inside:2.2.2.0/24 to outside:1.1.1.0/24
flags sT idle 0:00:06 timeout 0:00:00
NAT from outside:1.1.1.1 to inside:2.2.2.101
flags sT idle 0:10:47 timeout 0:00:00
注意在静态的转换中是对应关系是这样的 2.2.2.201转换为1.1.1.201
4.对于twice nat的identity nat的配置和基于object network的配置方式一样，只是可以配置目的地址的转换。