NAT实验一-CFANZ编程社区

网络实验拓扑：

NAT实验一_ide

配置IP：

iou1：

IOU1(config)#interface ethernet 0/0
IOU1(config-if)#ip address 200.1.1.2 255.255.255.0
IOU1(config-if)#duplex full
IOU1(config-if)#no shutdown
IOU1(config-if)#ex
IOU1(config)#interface loopback 0
IOU1(config-if)#ip address 218.85.152.99 255.255.255.255
IOU1(config-if)#ex

iou2：

IOU2(config)#interface ethernet 0/0
IOU2(config-if)#duplex full
IOU2(config-if)#ip address 192.168.0.11 255.255.255.0
IOU2(config-if)#no shutdown
IOU2(config-if)#ex
IOU2(config)#interface loopback 0
IOU2(config-if)#ip address 192.168.1.11 255.255.255.255
IOU2(config-if)#ex

iou3:

IOU3(config)#interface ethernet 0/0
IOU3(config-if)#duplex full
IOU3(config-if)#ip address 172.16.1.1 255.255.255.0
IOU3(config-if)#no shutdown
IOU3(config-if)#ex
IOU3(config)#interface loopback 0
IOU3(config-if)#ip address 172.16.88.11 255.255.255.255
IOU3(config-if)#ex

asa:

ciscoasa(config)# interface gigabitEthernet 0
ciscoasa(config-if)# nameif outside
INFO: Security level for "outside" set to 0 by default.
ciscoasa(config-if)# security-level 0
ciscoasa(config-if)# ip address 200.1.1.1 255.255.255.0
ciscoasa(config-if)# no shu
ciscoasa(config-if)# ex
ciscoasa(config)# interface gigabitEthernet 1
ciscoasa(config-if)# nameif dmz
INFO: Security level for "dmz" set to 0 by default.
ciscoasa(config-if)# security-level 50
ciscoasa(config-if)# ip address 192.168.0.254 255.255.255.0
ciscoasa(config-if)# no shu
ciscoasa(config-if)# ex
ciscoasa(config)# interface gigabitEthernet 2
ciscoasa(config-if)# nameif inside
INFO: Security level for "inside" set to 100 by default.
ciscoasa(config-if)# security-level 100
ciscoasa(config-if)# ip address 172.16.1.254 255.255.255.0
ciscoasa(config-if)# no shu
ciscoasa(config-if)# ex

配置默认/静态路由:

iou1:

IOU1(config)#ip route 0.0.0.0 0.0.0.0 200.1.1.1

iou2:

IOU2(config)#ip route 0.0.0.0 0.0.0.0 192.168.0.254

iou3:

IOU3(config)#ip route 0.0.0.0 0.0.0.0 172.16.1.254

asa:

ciscoasa(config)# route outside 0 0 200.1.1.2
ciscoasa(config)# route dmz 192.168.1.0 255.255.255.0 192.168.0.11
ciscoasa(config)# route inside 172.16.88.0 255.255.255.0 172.16.1.1

NAT实验一_内网_02

配置vty：

iou1：

IOU1(config)#username bdqn privilege 15 password cisco
IOU1(config)#line vty 0 4
IOU1(config-line)#login local
IOU1(config-line)#transport input telnet

iou2：

IOU2(config)#username bdqn privilege 15 password cisco
IOU2(config)#line vty 0 4
IOU2(config-line)#login local
IOU2(config-line)#transport input telnet

配置动态NAT：

asa:

ASA(config)# object network out-pool
ASA(config-network-object)# range 200.1.1.10 200.1.1.20
ASA(config-network-object)# exit
ASA(config)# object network in-ld
ASA(config-network-object)# subnet 172.16.88.0 255.255.255.0
ASA(config-network-object)# exit
ASA(config)# object network in-xd            
ASA(config-network-object)# subnet 172.16.1.0 255.255.255.0 
ASA(config-network-object)# exit
ASA(config)# object network dmz-1           
ASA(config-network-object)# subnet 192.168.0.0 255.255.255.0
ASA(config-network-object)# exit
ASA(config)# object network dmz-2            
ASA(config-network-object)# subnet 192.168.1.0 255.255.255.0
ASA(config-network-object)# exit
ASA(config)# object-group network in-lan
ASA(config-network-object-group)# network-object object in-ld
ASA(config-network-object-group)# network-object object in-xd
ASA(config-network-object-group)# exit
ASA(config)# object-group network dmz-lan
ASA(config-network-object-group)# network-object object dmz-1 
ASA(config-network-object-group)# network-object object dmz-2
ASA(config-network-object-group)# exit
ASA(config)# nat (inside,outside) source dynamic in-lan out-pool
ASA(config)# nat (dmz,outside) source dynamic dmz-lan out-pool

测试：

NAT实验一_一对一_03

NAT实验一_ide_04

查看：

NAT实验一_一对一_05

PAT，多内网架构，多个网段，多个zone，直接使用外网接口：

ASA(config)# nat (inside,outside) source dynamic in-lan interface 
ASA(config)# nat (dmz,outside) source dynamic dmz-lan interface

NAT实验一_内网_06

NAT实验一_内网_07

PAT，多内网架构使用一个指定外网IP：

ASA(config)# object network out-pat3
ASA(config-network-object)# host 200.1.1.3
ASA(config-network-object)# exit
ASA(config)# nat (inside,outside) source dynamic in-ld pat-pool out-pat3
ASA(config)# object network out-pool4
ASA(config-network-object)# host 200.1.1.4
ASA(config-network-object)# exit
ASA(config)# nat (inside,outside) source dynamic in-xd pat-pool out-pool4

NAT实验一_ide_08

先动态NAT。最后用指定IP做PAT：

ASA(config)# object network out-pool
ASA(config-network-object)# range 200.1.1.10 200.1.1.20
ASA(config-network-object)# exit
ASA(config)# object network out-pat3
ASA(config-network-object)# host 200.1.1.3
ASA(config-network-object)# exit
ASA(config)# object-group network out-nat
ASA(config-network-object-group)# network-object object out-pat3
ASA(config-network-object-group)# network-object object out-pool
ASA(config-network-object-group)# exit
ASA(config)# nat (inside,outside) source dynamic in-lan out-nat

NAT实验一_一对一_09

NAT实验一_内网_10

静态NAT（一对一）：

ASA(config)# object network web
ASA(config-network-object)# host 200.1.1.21
ASA(config-network-object)# exit
ASA(config)# object network dmz-web
ASA(config-network-object)# host 192.168.1.11
ASA(config-network-object)# exit
ASA(config)# access-list web extended permit tcp any host 192.168.1.11
ASA(config)# access-group web in interface outside 
ASA(config)# nat (dmz,outside) source static dmz-web web

NAT实验一_ide_11

NAT实验一_内网_12

端口一对一:

ASA(config)# object network teldmz
ASA(config-network-object)# host 200.1.1.22
ASA(config-network-object)# exit
ASA(config)# object network dmz-web
ASA(config-network-object)# host 192.168.1.11
ASA(config-network-object)# exit
ASA(config)# object service telnet
ASA(config-service-object)# service tcp source eq telnet 
ASA(config-service-object)# exit
ASA(config)# nat (dmz,outside) source static dmz-web teldmz service telnet telnet

NAT实验一_一对一_13

实验结束谢谢观看！