CCNP交换实验(7) -- NAT

1.静态NAT
2.动态NAT
3.复用内部全局地址的NAT(PAT)

enable
conf t
no ip do lo
enable pass cisco
line con 0
logg sync
exec-t 0 0
line vty 0 4
pass cisco
logg sync
exit
host

1.静态NAT

R2为一个ISP接入路由器，客户端为(R1,R3)，ISP分配给客户端一个公网IP地址为12.1.1.1.客户端服务器内网地址为33.1.1.1.
(R1,R3)运行OSPF协议，通过默认路由访问外网。

R1:
int s1/1
ip add 13.1.1.1 255.255.255.0
no shut
exit
int s1/0
ip add 12.1.1.1 255.255.255.0
no shut
exit

router ospf 1
router-id 11.1.1.1
network 13.1.1.0 0.0.0.255 area 0
default-info originate
exit
ip route 0.0.0.0 0.0.0.0 12.1.1.2

R3:
int s1/1
ip add 13.1.1.3 255.255.255.0
no shut
exit
int l0
ip add 33.1.1.1 255.255.255.0
no shut
exit

router ospf 1
router-id 33.1.1.1
network 13.1.1.0 0.0.0.255 area 0
network 33.1.1.0 0.0.0.255 area 0
exit

R2:
int s1/0
ip add 12.1.1.2 255.255.255.0
no shut
exit
int l0
ip add 22.1.1.1 255.255.255.0
no shut
exit

ip route 0.0.0.0 0.0.0.0 12.1.1.1

R1:
ip nat inside source static 33.1.1.1 12.1.1.1
int s1/1
ip nat inside
exit
int s1/0
ip nat outside

debug ip nat

R3:
ping 22.1.1.1 source 33.1.1.1

2.动态NAT
不能用一个本地全局地址访问内部特定地址，因为每次分配的本地全局地址可能不同。
仿真客户从ISP处申请了10个公网IP(12.1.1.1-10/24)

R1:
ip nat pool WBSN 12.1.1.1 12.1.1.10 netmask 255.255.255.0
access-list 1 permit 33.1.1.1 0.0.0.255
ip nat inside source list 1 pool WBSN

int s1/1
ip nat inside
exit
int s1/0
ip nat outside

R3:
int l0
ip add 33.1.1.2 255.255.255.0 secondary
ip add 33.1.1.3 255.255.255.0 secondary
ip add 33.1.1.4 255.255.255.0 secondary
ip add 33.1.1.5 255.255.255.0 secondary
exit

ping 22.1.1.1 source 33.1.1.1
ping 22.1.1.1 source 33.1.1.2
ping 22.1.1.1 source 33.1.1.3
ping 22.1.1.1 source 33.1.1.4
ping 22.1.1.1 source 33.1.1.5

R1:
show ip nat translations
show ip nat translations verbose

3.复用内部全局地址的NAT(PAT)
当多个本地地址映射到同一个全局地址的时候，用端口号来区别不同的本地地址。

R1:
ip nat pool WBSN 12.1.1.1 12.1.1.1 netmask 255.255.255.0
access-list 1 permit 33.1.1.1 0.0.0.255
ip nat inside source list 1 pool WBSN overload

int s1/1
ip nat inside
exit
int s1/0
ip nat outside

R3:
int l0
ip add 33.1.1.2 255.255.255.0 secondary
ip add 33.1.1.3 255.255.255.0 secondary
ip add 33.1.1.4 255.255.255.0 secondary
ip add 33.1.1.5 255.255.255.0 secondary
exit

ping 22.1.1.1 source 33.1.1.1
ping 22.1.1.1 source 33.1.1.2
ping 22.1.1.1 source 33.1.1.3
ping 22.1.1.1 source 33.1.1.4
ping 22.1.1.1 source 33.1.1.5

R1:
show ip nat translations
show ip nat translations verbose