cisco Routing-配置动态NAT

问题

    在R1通过动态NAT实现企业内网192.168.1.0/24转换为公网地址61.159.62.131-61.159.62.134，访问192.168.2.1

方案

拓扑图

步骤

动态NAT配置

删除配置端口映射中的端口映射

tarena-R1 (config)#noip nat inside source static tcp 192.168.1.3 80 61.159.62.133 80

在R1上配置ACL

tarena-R1(config)#access-list1 permit 192.168.1.0 0.0.0.255

在R1上配置可转换的公网IP地址池

地址池是向ISP(Internet服务提供商，如电信、联通,移动)申请得到的，内网主机(上一步ACL中所包含的IP地址)到外网的访问，内网地址将被动态的、随机的转换为这些合法地址。

arena-R1(config)#ipnat pool natpool 61.159.62.131 61.159.62.134 netmask 255.255.255.248

关联ACL和公网的IP地址池

tarena-R1(config)#ipnat inside source list 1 pool natpool

在R1上配置NAT内、外端口

tarena-R1(config)#interface f0/0

tarena-R1(config-if)#ip nat inside

tarena-R1(config-if)#interface f0/1

tarena-R1(config-if)#ip nat outside

分别在两台PC机上测试到外网主机的通信

PC1测试如下所示：PC>ipconfig

FastEthernet0 Connection:(default port)

Link-local IPv6 Address.........: FE80::2D0:FFFF:FE45:CACC

IP Address......................: 192.168.1.1

Subnet Mask.....................: 255.255.255.0

Default Gateway.................: 192.168.1.254

PC>ping 192.168.2.1

Pinging 192.168.2.1 with 32 bytes of data:

Reply from 192.168.2.1: bytes=32 time=1ms TTL=126

Reply from 192.168.2.1: bytes=32 time=0ms TTL=126

Reply from 192.168.2.1: bytes=32 time=0ms TTL=126

Reply from 192.168.2.1: bytes=32 time=0ms TTL=126

Ping statistics for 192.168.2.1:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 0ms, Maximum = 1ms, Average = 0ms

PC2测试如下所示：PC>ipconfig

FastEthernet0 Connection:(default port)

Link-local IPv6 Address.........: FE80::2D0:FFFF:FE45:CACC

IP Address......................: 192.168.1.2

Subnet Mask.....................: 255.255.255.0

Default Gateway.................: 192.168.1.254

PC>ping 192.168.2.1

Pinging 192.168.2.1 with 32 bytes of data:

Reply from 192.168.2.1: bytes=32 time=1ms TTL=126

Reply from 192.168.2.1: bytes=32 time=0ms TTL=126

Reply from 192.168.2.1: bytes=32 time=0ms TTL=126

Reply from 192.168.2.1: bytes=32 time=0ms TTL=126

Ping statistics for 192.168.2.1:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 0ms, Maximum = 1ms, Average = 0ms

在R1上查看NAT转换表

转换表中的对应关系是动态的，如192.168.1.1被转换为61.159.62.131，但是下一次对外网的访问很有可能被转换为其他地址。

tarena-R1#show ip nat translations

Pro Inside global Inside local Outside local Outside global

icmp 61.159.62.131:1362192.168.1.1:1362 192.168.2.1:1362 192.168.2.1:1362

icmp 61.159.62.131:1392192.168.1.1:1392 192.168.2.1:1392 192.168.2.1:1392

icmp 61.159.62.131:1393192.168.1.1:1393 192.168.2.1:1393 192.168.2.1:1393

icmp 61.159.62.131:1394192.168.1.1:1394 192.168.2.1:1394 192.168.2.1:1394

icmp 61.159.62.132:13 192.168.1.2:13 192.168.2.1:13 192.168.2.1:13

icmp 61.159.62.132:14 192.168.1.2:14 192.168.2.1:14 192.168.2.1:14

icmp 61.159.62.132:15 192.168.1.2:15 192.168.2.1:15 192.168.2.1:15

icmp 61.159.62.132:16 192.168.1.2:16 192.168.2.1:16 192.168.2.1:16