CCNA实验：NAT 配置命令

来源：作者：发布时间：2008-05-23 阅读次数

21.1.在路由器上启用基本的NAT功能

Router#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router(config)#access-list 15 permit 192.168.0.0 0.0.255.255 Router(config)#ip nat inside source list 15 interface FastEthernet0/0 overload Router(config)#interface FastEthernet0/2 Router(config-if)#ip address 192.168.1.1 255.255.255.0 Router(config-if)#ip nat inside Router(config-if)#exit Router(config)#interface FastEthernet0/1 Router(config-if)#ip address 192.168.2.1 255.255.255.0 Router(config-if)#ip nat inside Router(config-if)#exit Router(config)#interface Ethernet0/0 Router(config-if)#ip address 172.16.1.5 255.255.255.252 Router(config-if)#ip nat outside Router(config-if)#exit Router(config)#end Router#

注释例子中的配置实现了对地址段192.168.0.0/16访问外部网络重写为172.16.1.5的功能，基本的地址翻译功能
21.2. 动态分配外部地址

Router#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router(config)#access-list 15 permit 192.168.0.0 0.0.255.255 Router(config)#ip nat pool NATPOOL 172.16.1.100 172.16.1.150 netmask 255.255.255.0 Router(config)#ip nat inside source list 15 pool NATPOOL Router(config)#interface FastEthernet 0/0 Router(config-if)#ip address 192.168.1.1 255.255.255.0 Router(config-if)#ip nat inside Router(config-if)#exit Router(config)#interface FastEthernet 0/1 Router(config-if)#ip address 192.168.2.1 255.255.255.0 Router(config-if)#ip nat inside Router(config-if)#exit Router(config)#interface Ethernet1/0 Router(config-if)#ip address 172.16.1.2 255.255.255.0 Router(config-if)#ip nat outside Router(config-if)#exit Router(config)#end Router#

注释 ip nat inside source list 15 pool NATPOOL 定义了翻译出去的地址池，如果地址池可以地址用完新的翻译将不成功，如果加上了overload参数将会从第一个地址开始翻译进行复用。另外这里的地址池并不一定要和outside端口的地址在同一网段，只要有相应的路由就可以。
21.3. 静态分配外部地址

Router#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router(config)#ip nat inside source static 192.168.1.15 172.16.1.10 Router(config)#ip nat inside source static 192.168.1.16 172.16.1.11 Router(config)#interface FastEthernet 0/0 Router(config-if)#ip address 192.168.1.1 255.255.255.0 Router(config-if)#ip nat inside Router(config-if)#exit Router(config)#interface FastEthernet 0/1 Router(config-if)#ip address 192.168.2.1 255.255.255.0 Router(config-if)#ip nat inside Router(config-if)#exit Router(config)#interface Ethernet1/0 Router(config-if)#ip address 172.16.1.2 255.255.255.0 Router(config-if)#ip nat outside Router(config-if)#exit Router(config)#end Router#

21.4. 地址静态和动态翻译结合

Router#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router(config)#access-list 15 deny 192.168.1.15 0.0.0.0 Router(config)#access-list 15 deny 192.168.1.16 0.0.0.0 Router(config)#access-list 15 permit 192.168.0.0 0.0.255.255 Router(config)#ip nat inside source static 192.168.1.15 172.16.1.10 Router(config)#ip nat inside source static 192.168.1.16 172.16.1.11 Router(config)#ip nat pool NATPOOL 172.16.1.100 172.16.1.150 netmask 255.255.255.0 Router(config)#ip nat inside source list 15 pool NATPOOL overload Router(config)#interface FastEthernet0/0 Router(config-if)#ip address 192.168.1.1 255.255.255.0 Router(config-if)#ip nat inside Router(config-if)#exit Router(config)#interface FastEthernet0/1 Router(config-if)#ip address 192.168.2.1 255.255.255.0 Router(config-if)#ip nat inside Router(config-if)#exit Router(config)#interface Ethernet0/0 Router(config-if)#ip address 172.16.1.2 255.255.255.0 Router(config-if)#ip nat outside Router(config-if)#exit Router(config)#end Router#

注释这里的控制列表把所要静态内部地址排除了，当然这一步也不是必须的，因为静态翻译的优先级要高于动态翻译的，不过静态翻译的外部地址必须要从动态翻译的地址池中排除。
21.5. 使用Route Maps来进行翻译规则控制

Router1#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router(config)#interface FastEthernet0/0 Router(config-if)#ip address 172.16.1.5 255.255.255.252 Router(config-if)#ip nat outside Router(config-if)#exit Router(config)#interface FastEthernet0/1 Router(config-if)#ip address 172.16.2.5 255.255.255.252 Router(config-if)#ip nat outside Router(config-if)#exit Router(config)#interface FastEthernet0/2 Router(config-if)#ip address 192.168.1.1 255.255.255.0 Router(config-if)#ip nat inside Router(config-if)#exit Router(config)#ip nat inside source route-map ISP-1 interface FastEthernet0/0 overload Router(config)#ip nat inside source route-map ISP-2 interface FastEthernet0/1 overload Router(config)#route-map ISP-1 permit 10 Router(config-route-map)#match interface FastEthernet0/0 Router(config-route-map)#exit Router(config)#route-map ISP-2 permit 10 Router(config-route-map)#match interface FastEthernet0/1 Router(config-route-map)#exit Router(config)#end Router#

注释适用于多个outside端口的情况
21.6. 同时两个方向地址翻译

Router#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router(config)#access-list 15 deny 192.168.1.15 Router(config)#access-list 15 permit 192.168.0.0 0.0.255.255 Router(config)#access-list 16 deny 172.16.5.25 Router(config)#access-list 16 permit 172.16.0.0 0.0.255.255 Router(config)#ip nat pool NATPOOL 172.16.1.100 172.16.1.150 netmask 255.255.255.0 Router(config)#ip nat pool INBOUNDNAT 192.168.15.100 192.168.15.200 netmask 255.255.255.0 Router(config)#ip nat inside source list 15 pool NATPOOL overload Router(config)#ip nat inside source list 16 pool INBOUNDNAT overload Router(config)#ip nat inside source static 192.168.1.15 172.16.1.10 Router(config)#ip nat outside source static 172.16.5.25 192.168.15.5 Router(config)#ip route 192.168.15.0 255.255.255.0 Ethernet0/0 Router(config)#interface FastEthernet 0/0 Router(config-if)#ip address 192.168.1.1 255.255.255.0 Router(config-if)#ip nat inside Router(config-if)#exit Router(config)#interface FastEthernet 0/1 Router(config-if)#ip address 192.168.2.1 255.255.255.0 Router(config-if)#ip nat inside Router(config-if)#interface Ethernet0/0 Router(config-if)#ip address 172.16.1.2 255.255.255.0 Router(config-if)#ip nat outside Router(config-if)#exit Router(config)#end Router#

21.7. 网络前缀重写简单的改变某个网络段的前缀

Router#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router(config)#ip nat outside source static network 172.16.0.0 172.17.0.0 /16 no-alias Router(config)#ip route 172.16.0.0 255.255.0.0 Ethernet1/0 Router(config)#ip route 172.17.0.0 255.255.0.0 Ethernet1/0 Router(config)#interface FastEthernet 0/0 Router(config-if)#ip address 10.1.1.1 255.255.255.0 Router(config-if)#ip nat inside Router(config-if)#exit Router(config)#interface Ethernet1/0 Router(config-if)#ip address 172.16.1.6 255.255.255.252 Router(config-if)#ip nat outside Router(config-if)#exit Router(config)#end Router#

注释适用于两个网络互访而地址段冲突的情况
21.8. 使用NAT来进行服务器负荷分担

Router#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router(config)#interface FastEthernet0/0 Router(config-if)#ip address 192.168.1.1 255.255.255.0 Router(config-if)#ip nat inside Router(config-if)#exit Router(config)#interface FastEthernet0/1 Router(config-if)#ip address 192.168.2.1 255.255.255.0 Router(config-if)#ip nat outside Router(config-if)#exit Router(config)#ip nat pool WEBSERVERS 192.168.1.101 192.168.1.105 netmask 255.255.255.0 type rotary Router(config)#access-list 20 permit host 192.168.1.100 Router(config)#ip nat inside destination list 20 pool WEBSERVERS Router(config)#end Router#

注释这里不同点在于使用了rotary的参数和使用了destination而不是source在翻译规则中，当然这种是穷人的负载均衡解决方案
21.9. 基于状态的NAT切换

RouterA

Router-A#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router-A(config)#access-list 11 permit any Router-A(config)#ip nat pool NATPOOL 172.17.100.100 172.17.100.150 netmask 255.255.255.0 Router-A(config)#ip nat inside source list 11 pool NATPOOL mapping-id 1 Router-A(config)#interface FastEthernet0/0 Router-A(config-if)#ip address 192.168.1.3 255.255.255.0 Router-A(config-if)#ip nat inside Router-A(config-if)#standby 1 ip 192.168.1.1 Router-A(config-if)#standby 1 preempt Router-A(config-if)#standby 1 name SNATGROUP Router-A(config-if)#exit Router-A(config)#interface Serial0/0 Router-A(config-if)#ip address 172.17.55.2 255.255.255.252 Router-A(config-if)#ip nat outside Router-A(config-if)#exit Router-A(config)#ip nat Stateful id 1 Router-A(config-ipnat-snat)#redundancy SNATGROUP Router(config-ipnat-snat-red)#mapping-id 1 Router(config-ipnat-snat-red)#exit Router-A(config)#end Router-A#

RouterB

Router-B#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router-B(config)#access-list 11 permit any Router-B(config)#ip nat pool NATPOOL 172.17.100.100 172.17.100.150 netmask 255.255.255.0 Router-B(config)#ip nat inside source list 11 pool NATPOOL mapping-id 1 Router-B(config)#interface FastEthernet0/0 Router-B(config-if)#ip address 192.168.1.2 255.255.255.0 Router-B(config-if)#ip nat inside Router-B(config-if)#standby 1 ip 192.168.1.1 Router-B(config-if)#standby 1 priority 90 Router-B(config-if)#standby 1 preempt Router-B(config-if)#standby 1 name SNATGROUP Router-B(config-if)#exit Router-B(config)#interface Serial0/0 Router-B(config-if)#ip address 172.17.55.6 255.255.255.252 Router-B(config-if)#ip nat outside Router-B(config-if)#exit Router-B(config)#ip nat Stateful id 1 Router-B(config-ipnat-snat)#redundancy SNATGROUP Router(config-ipnat-snat-red)#mapping-id 1 Router(config-ipnat-snat-red)#exit Router-B(config)#end Router-B#

注释虽然说通过使用HSRP可以解决可用性的问题，但是不能同步NAT翻译表，从12.2(13)T以后思科引入了基于状态的NAT（SNAT），这样可以保持两台设备的翻译表同步，其关键命令为ip nat Stateful 要注意的是这里的Stateful是大写开头的，这里是区分大小写的。另外SNAT只和HSRP连用，不能跟VRRP或者GLBP一起作用。同时也可以使用多组HSRP的形式来保持负载均衡。
21.10. 调整NAT 时长

Router#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router(config)#ip nat translation tcp-timeout 500 Router(config)#ip nat translation udp-timeout 30 Router(config)#ip nat translation dns-timeout 30 Router(config)#ip nat translation icmp-timeout 30 Router(config)#ip nat translation finrst-timeout 30 Router(config)#ip nat translation syn-timeout 30 Router(config)#end Router#

也可以限制翻译表的最大条目数

Router#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router(config)#ip nat translation max-entries 1000 Router(config)#end Router#

注释缺省TCP为24小时，UDP为5分钟，DNS为1分钟
21.11. 修改FTP的TCP端口

Router#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router(config)#access-list 19 permit 192.168.55.5 Router(config)#ip nat service list 19 ftp tcp port 8021 Router(config)#ip nat service list 19 ftp tcp port 21 Router(config)#end Router#

注释在12.2(4)T后思科引入了no-payload关键词来防止对数据包载荷的地址信息进行修改

Router#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router(config)#interface FastEthernet0/0 Router(config-if)#ip address 172.16.1.5 255.255.255.252 Router(config-if)#ip nat outside Router(config-if)#exit Router(config)#interface FastEthernet0/1 Router(config-if)#ip address 192.168.1.1 255.255.255.0 Router(config-if)#ip nat inside Router(config-if)#exit Router(config)#ip nat inside source static 192.168.1.10 172.16.1.5 no-payload Router(config)#end Router#

21.12. 检查NAT状态

Router#show ip nat translation Router#clear ip nat translation * Router#clear ip nat translation inside 172.18.3.2 Router#clear ip nat translation outside 192.168.1.10 Router#show ip nat statistics Router#clear ip nat statistics

注释

Router#show ip nat translation Pro Inside global Inside local Outside local Outside global

"Inside global" 为内部设备翻译的地址"Inside local"为内部设备的真实地址"Outside local" 为外部设备翻译的地址"Outside global" 为外部设备的真实地址，global addresses在outside, local addresses 在 inside.
21.13.NAT排错

Router#debug ip nat Router#debug ip nat detailed Router#debug ip nat 15 Router#debug ip nat 15 detailed

上一篇：56CTO（NA）拓展：光模块的常用知识
下一篇：CCNA实验：Router和Switch的最基本配置

[收藏] [推荐] [评论] [打印] [关闭]

频道推荐

·CCNP实验：GRE隧道流	·用RACL和CBAC实现简单
·详解:路由器工作原理	·帧中继下的EIGRP水平
·EIGRP over FR-Hub_S	·IE分解:Modular QoS C
·CCIE分解:帧中继子接	·NP_ISCW试验：Cisco支
·CCNA802实验：浮动静	·CCIE-Lab特性之一:交

·CCNP实验：GRE隧道流量的IPSEC	·用RACL和CBAC实现简单的基于包
·详解:路由器工作原理及路由算	·帧中继下的EIGRP水平分割解决
·EIGRP over FR-Hub_Spoke中的	·IE分解:Modular QoS CLI（MQC
·CCIE分解:帧中继子接口和流量	·NP_ISCW试验：Cisco支持AAA的
·CCNA802实验：浮动静态路由命	·CCIE-Lab特性之一:交换网络安
·CCIE实验考试特性之一:如何描	·CCIE RS之VLAN-MAP详解(IE实验