NAT实验

配IP

r1:

[r1]int g 0/0/0

[r1-GigabitEthernet0/0/0]ip add 192.168.1.254 24

r2:

[r2]int g 0/0/0

[r2-GigabitEthernet0/0/0]ip add 192.168.12.2 24

[r2-GigabitEthernet0/0/2]ip add 192.168.2.254 24

[r2-GigabitEthernet0/0/1]ip add 23.0.0.2 24

r3:

[r3-GigabitEthernet0/0/0]ip add 23.0.0.3 24

[r3-GigabitEthernet0/0/1]ip add 34.0.0.3 24

test-1:

[test1-GigabitEthernet0/0/0]ip add 34.0.0.1 24

test-2:

[test2-GigabitEthernet0/0/0]ip add 34.0.0.2 24

telnet:

[telnet-GigabitEthernet0/0/0]ip add 192.168.1.100 24

缺省路由

[r2]ip route-static 0.0.0.0 0 23.0.0.3

[r2]ospf 1

[r2-ospf-1]default-route-advertise

[test1]ip route-static 0.0.0.0 0 34.0.0.3

[test2]ip route-static 0.0.0.0 0 34.0.0.3

[telnet]ip route-static 0.0.0.0 0 192.168.1.254

内网路由配置

[r1]ospf 1 router-id 1.1.1.1

[r1-ospf-1]area 0

[r1-ospf-1-area-0.0.0.0]network 192.168.1.254 0.0.0.0

[r1-ospf-1-area-0.0.0.0]network 192.168.12.1 0.0.0.0

[r2]ospf 1 router-id 2.2.2.2

[r2-ospf-1]area 0

[r2-ospf-1-area-0.0.0.0]network 192.168.12.2 0.0.0.0

[r2-ospf-1-area-0.0.0.0]network 192.168.2.254 0.0.0.0

DHCP

[r1]dhcp enable

[r1]ip pool 1

[r1-ip-pool-1]network 192.168.1.0 mask 24

[r1-ip-pool-1]gateway-list 192.168.1.254

[r1-GigabitEthernet0/0/0]dhcp select global

[r2]dhcp enable

[r2]ip pool 1

[r2-ip-pool-1]network 192.168.2.0 mask 24

[r2-ip-pool-1]gateway-list 192.168.2.254

[r2-GigabitEthernet0/0/2]dhcp select global

ACL

[r2]acl 3000

[r2-acl-basic-2000]rule deny ip source192.168.2.0 0.0.0.255 destination 34.0.0.1 0

[r2-GigabitEthernet0/0/2]traffic-filter inbound acl 3000

开启telnet服务

telnet：

[Telnet Server]telnet server enable

[Telnet Server]user-interface vty 0 4

[Telnet Server-ui-vty0-4]authentication-mode aaa

[Telnet Server-ui-vty0-4]quit

[Telnet Server]aaa

[Telnet Server-aaa]local-user huawei password cipher 123456

[Telnet Server-aaa]local-user huawei privilege level 15

[Telnet Server-aaa]local-user huawei service-type telnet
 

端口映射，外网设备登陆内网设备

[r2]int g 0/0/1

[r2-GigabitEthernet0/0/1]nat server protocol tcp global current-interface 2323 inside192.168.1.100 23

[r2]acl 3100

[r2-acl-adv-3100]rule deny tcp source 34.0.0.2 0 destination 23.0.0.2 0 destination-port eq 2323

[r2]int g 0/0/1

[r2-GigabitEthernet0/0/1]traffic-filter inbound acl 3100