劉雄NAT配置實例(NATP)秒會.ppt

星云科技有限公司,劉雄,NAPT實驗,劉雄,基本命令,# 進(jìn)入系統(tǒng)視圖 sys # 配置設(shè)備名 H3Csysname RouterA # 設(shè)置super(明文)密碼 RouterAsuper password simple quidway # 設(shè)置super(密文)密碼 RouterAsuper password cipher quidway,基本命令,# 啟用telnet 管理功能 RouterAuser-interface vty 0 4 RouterA-ui-vty0-4authentication-mode password RouterA-ui-vty0-4set authentication password quidway RouterA-ui-vty0-4user privilege level 3 RouterA-ui-vty0-4quit RouterAtelnet server enable,基本命令,# 配置端口IP地址 RouterAint e 0 RouterA-Ethernet0ip add 192.168.1.1 24 # 啟動端口 RouterA-Ethernet0undo shutdown RouterA-Ethernet0quit,配置 NATP,配置ACL 用于判斷哪些數(shù)據(jù)包的地址應(yīng)被轉(zhuǎn)換 被ACL允許（permit）的報文將被進(jìn)行NAT轉(zhuǎn)換，被拒絕（deny）的報文將不會被轉(zhuǎn)換 配置地址池 nat address-group group-number start-addr end-addr 配置地址轉(zhuǎn)換 nat outbound acl-number address-group group-number no-pat,NAPT配置舉例,10.0.0.1,RTA,10.0.0.254/24,198.76.28.1/24,10.0.0.2,Internet,Server,地址池 （198.76.28.11）,Internet,# 通過ACL定義一條rule，匹配源地址屬于10.0.0.0/24網(wǎng)段的數(shù)據(jù) RTAacl number 2000 RTA-acl-basic-2000rule 0 permit source 10.0.0.0 0.0.0.255 # 配置NAT地址池1，地址池中只放入一個地址198.76.28.11 RTAnat address-group 1 198.76.28.11 # 進(jìn)入接口模式視圖 RTAinterface Ethernet0/1 # 將地址池1與acl 2000關(guān)聯(lián)，并在接口出方向上應(yīng)用NAT RTA-Ethernet0/1nat outbound 2000 address-group 1,Eth0/1,RT2,RT1,198.76.29.4/24,RT2,sys H3Csysname RT2 RT2interface Serial 0/2/0 RT2-Serial0/2/0ip add 10.0.0.2 8 RT2-Serial0/2/0undo shutdown RT2-Serial0/2/0ospf RT2-ospf-1area 1 RT2-ospf-1-area-0.0.0.1network 10.0.0.0 0.255.255.255,RTA,RTA: RTAsysname RTA RTAinterface Serial 0/2/0 RTA-Serial0/2/0ip add 10.0.0.1 8 RTAinterface Serial 0/2/2 RTA-Serial0/2/2ip add 198.168.10.1 24 RTA-Serial0/2/2undo shutdown RTA-Serial0/2/2ospf RTA-ospf-1area 1 RTA-ospf-1-area-0.0.0.1network 10.0.0.0 0.255.255.255 RTA-ospf-1-area-0.0.0.1network 198.168.10.0 0.0.0.255 RTA-ospf-1-area-0.0.0.1quit RTAfirewall enable RTAacl number 2000 RTA-acl-basic-2000rule 0 permit source 10.0.0.0 0.0.0.255 RTA-acl-basic-2000quit RTAnat address-group 1 198.168.10.10 198.168.10.10 RTAinterface Serial 0/2/2 RTA-Serial0/2/2nat outbound 2000 address-group 1 no-pat,Server,sys H