NAT转换配置
配置环境:华为最新模拟器
1、要求:
现有一台防火墙和两台PC机。要求用这些设备模拟NAT转换,其中一台PC机代表一个局域网,另一台PC机代表广域网,局域网内用的是私有IP地址,广域网用的是公有IP地址,在局域网设备要访问广域网需要用NAT转换。
2、网络拓扑图:
用亿图绘图工具绘制出网络拓扑图为如图1所示:
图1:网络拓扑图
3、设备配置
(1)防火墙的配置:
[R1]sysname firewall
[firewall]
Apr 14 2014 22:24:38-08:00 firewall DS/4/DATASYNC_CFGCHANGE:OID 1.3.6.1.4.1.2011.
5.25.191.3.1 configurations have been changed. The current change number is 2, th
e change loop count is 0, and the maximum number of records is 4095.
[firewall]
[firewall]int et0/0/0
[firewall-Ethernet0/0/0]ip add
[firewall-Ethernet0/0/0]ip address 192.168.2.1 ?
[firewall-Ethernet0/0/0]ip address 192.168.2.1 ?
INTEGER<0-32> Length of IP address mask
X.X.X.X IP address mask
[firewall-Ethernet0/0/0]ip address 192.168.2.1 24
[firewall-Ethernet0/0/0]int et0/0/1
[firewall-Ethernet0/0/1]ip add
[firewall-Ethernet0/0/1]ip address 192.168.1.4 24
(2)PC1的配置:
4、未配置NAT转换的测试
(1)在PC1上ping192.168.2.1和192.168.1.1,结果如下:
(2)在PC1上ping192.168.2.1和192.168.1.4,结果如下:
5、NAT转换配置
firewall]acl number 2000
[firewall-acl-basic-2000]
firewall-acl-basic-2000]rule 10 permit sou
[firewall-acl-basic-2000]rule 10 permit source ?
X.X.X.X Address of source
any Any source
[firewall-acl-basic-2000]rule 10 permit source 192.168.2.0 ?
0 Wildcard bits : 0.0.0.0 ( a host )
X.X.X.X Wildcard of source
[firewall-acl-basic-2000]rule 10 permit source 192.168.2.0 0.0.0.255
[firewall-acl-basic-2000]
[firewall-acl-basic-2000]rule20 deny sou
[firewall-acl-basic-2000]rule20 deny source an
[firewall-acl-basic-2000]rule 20 deny source any
[firewall-acl-basic-2000]dis acl all
Total nonempty ACL number is 1
Basic ACL 2000, 2 rules
ACL's step is 5
rule 10 permit source 192.168.2.0 0.0.0.255 (0 times matched)
rule 20 deny (0 times matched)
[firewall-Ethernet0/0/1]nat ou
[firewall-Ethernet0/0/1]nat outbound ?
INTEGER<2000-3999> Apply basic or advanced ACL
[firewall-Ethernet0/0/1]nat outbound 2000 in
[firewall-Ethernet0/0/1]nat outbound 2000 interface ?
loopback Interface type
[firewall-Ethernet0/0/1]nat outbound 2000
6、NAT转换配置验证