NAT实验

要求：
1.公网设备只配IP

2.全网可达

3.外网设备不允许存在私网路由

4内网设备不允许存在公网路由

5.test-1可以登录Telnet；test-2不可以

6.PC1可以访问test-1，PC2不可以

7.PC使用DHCP获取IP地址

1.公网设备只配IP

分别配置所有的ip，test-1和test-2需要配置缺省路由，然后还有各自的ip

[test-1]int	
[test-1]interface Giga	
[test-1]interface GigabitEthernet 0/0/0
[test-1-GigabitEthernet0/0/0]ip add	
[test-1-GigabitEthernet0/0/0]ip address 34.0.0.1 24
Oct 31 2023 17:36:08-08:00 test-1 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol
 IP on the interface GigabitEthernet0/0/0 has entered the UP state. 
[test-1-GigabitEthernet0/0/0]q	
[test-1-GigabitEthernet0/0/0]qinq
                                  ^
Error:Incomplete command found at '^' position.
[test-1-GigabitEthernet0/0/0]qui	
[test-1-GigabitEthernet0/0/0]quit 
[test-1]ip rou	
[test-1]ip route-s	
[test-1]ip route-static 0.0.0.0 0 34.0.0.254
[test-1]

[test-2]int	
[test-2]interface Giag	
[test-2]interface Giga	
[test-2]interface GigabitEthernet 0/0/0
[test-2-GigabitEthernet0/0/0]ip add	
[test-2-GigabitEthernet0/0/0]ip address 34.0.0.2 24
Oct 31 2023 17:37:11-08:00 test-2 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol
 IP on the interface GigabitEthernet0/0/0 has entered the UP state. 
[test-2-GigabitEthernet0/0/0]quit	
[test-2-GigabitEthernet0/0/0]quit 
[test-2]ip rou	
[test-2]ip route-st	
[test-2]ip route-static 0.0.0.0 0 34.0.0.254
[test-2]

2.全网可达

[r2]ping 23.0.0.3
  PING 23.0.0.3: 56  data bytes, press CTRL_C to break
    Reply from 23.0.0.3: bytes=56 Sequence=1 ttl=255 time=70 ms
    Reply from 23.0.0.3: bytes=56 Sequence=2 ttl=255 time=10 ms
    Reply from 23.0.0.3: bytes=56 Sequence=3 ttl=255 time=10 ms
    Reply from 23.0.0.3: bytes=56 Sequence=4 ttl=255 time=20 ms
    Reply from 23.0.0.3: bytes=56 Sequence=5 ttl=255 time=20 ms

  --- 23.0.0.3 ping statistics ---
    5 packet(s) transmitted
    5 packet(s) received
    0.00% packet loss
    round-trip min/avg/max = 10/26/70 ms

3.外网设备不允许存在私网路由

4内网设备不允许存在公网路由

启动ospf协议：R2不需要宣告外网的ospf，telnet也不需要启动ospf，内网全网可达，R2写一条缺省路由指向R3

内网全网可达：
PC>ping 192.168.1.100

Ping 192.168.1.100: 32 data bytes, Press Ctrl_C to break
Request timeout!
From 192.168.1.100: bytes=32 seq=2 ttl=253 time=63 ms
From 192.168.1.100: bytes=32 seq=3 ttl=253 time=62 ms
From 192.168.1.100: bytes=32 seq=4 ttl=253 time=47 ms
From 192.168.1.100: bytes=32 seq=5 ttl=253 time=47 ms

--- 192.168.1.100 ping statistics ---
  5 packet(s) transmitted
  4 packet(s) received
  20.00% packet loss
  round-trip min/avg/max = 0/54/63 ms



[r2]ip route-static 0.0.0.0 0 23.0.0.3

缺省路由有了
[r1]display ip routing-table 
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Routing Tables: Public
         Destinations : 12       Routes : 12       

Destination/Mask    Proto   Pre  Cost      Flags NextHop         Interface

        0.0.0.0/0   O_ASE   150  1           D   192.168.12.2    GigabitEthernet
0/0/1

配完后，PC1可以通test-1：

PC>ping 34.0.0.1

Ping 34.0.0.1: 32 data bytes, Press Ctrl_C to break
Request timeout!
From 34.0.0.1: bytes=32 seq=2 ttl=252 time=93 ms
From 34.0.0.1: bytes=32 seq=3 ttl=252 time=63 ms
From 34.0.0.1: bytes=32 seq=4 ttl=252 time=78 ms
From 34.0.0.1: bytes=32 seq=5 ttl=252 time=78 ms

--- 34.0.0.1 ping statistics ---
  5 packet(s) transmitted
  4 packet(s) received
  20.00% packet loss
  round-trip min/avg/max = 0/78/93 ms

6.PC1可以访问test-1，PC2不可以

使用高级acl，

[r2-acl-adv-3000]display this
[V200R003C00]
#
acl number 3000  
 rule 5 deny ip source 192.168.2.0 0.0.0.255 destination 34.0.0.1 0 
#
return

7.DHCP分配

[r1-GigabitEthernet0/0/0]dhcpsel	
[r1-GigabitEthernet0/0/0]dhcp se	
[r1-GigabitEthernet0/0/0]dhcp select
                                     ^
Error:Incomplete command found at '^' position.
[r1-GigabitEthernet0/0/0]dhcp select glo	
[r1-GigabitEthernet0/0/0]dhcp select global 
[r1-GigabitEthernet0/0/0]q	
[r1-GigabitEthernet0/0/0]q
[r1]ip po	
[r1]ip pool 1
[r1-ip-pool-1]gat	
[r1-ip-pool-1]gateway-list 192.168.1.254
[r1-ip-pool-1]q	
[r1-ip-pool-1]quit