Frame Relay教程 第13章 網(wǎng)絡(luò)地址翻譯NAT.ppt

1、第十三章網(wǎng)絡(luò)地址翻譯 NAT,本章目標(biāo),通過(guò)本章的學(xué)習(xí)，您應(yīng)該掌握以下內(nèi)容: NAT的工作原理及PAT的概念. 靜態(tài)NAT和動(dòng)態(tài)NAT. NAT的配置.,NAT網(wǎng)絡(luò)地址翻譯,隨著Internet的飛速發(fā)展，網(wǎng)上豐富的資源產(chǎn)生著巨大的吸引力接入Internet成為當(dāng)今信息業(yè)最為迫切的需求。 但這受到IP地址的許多限制 首先，許多局域網(wǎng)在未聯(lián)入Internet之前，就已經(jīng)運(yùn)行許多年了，局域網(wǎng)上有了許多現(xiàn)成的資源和應(yīng)用程序，但它的IP地址分配不符合Internet的國(guó)際標(biāo)準(zhǔn)，因而需要重新分配局域網(wǎng)的IP地址，這無(wú)疑是勞神費(fèi)時(shí)的工作。 其二，隨著Internet的膨脹式發(fā)展，其可用的IP地址越來(lái)越少，

2、要想在ISP處申請(qǐng)一個(gè)新的IP地址已不是很容易的事了。,NAT網(wǎng)絡(luò)地址翻譯,NAT（網(wǎng)絡(luò)地址翻譯）能解決不少令人頭疼的問(wèn)題 它解決問(wèn)題的辦法是： 在內(nèi)部網(wǎng)絡(luò)中使用內(nèi)部地址，通過(guò)NAT把內(nèi)部地址翻譯成合法的IP地址，在Internet上使用其具體的做法是把IP包內(nèi)的地址池（內(nèi)部本地）用合法的IP地址段（內(nèi)部全局）來(lái)替換,NAT 術(shù)語(yǔ),內(nèi)部本地地址: 私有IP，不能直接用于互連網(wǎng)。 內(nèi)部全局地址：用來(lái)代替內(nèi)部本地IP地址的，對(duì)外，或在互聯(lián)網(wǎng)上是合法的的IP地址。,NAT工作原理,NAT工作原理,Port Address Translation,復(fù)用內(nèi)部的全局地址,將一個(gè)內(nèi)部全局地址用于同時(shí)代表多個(gè)

3、內(nèi)部局部地址。 主要用IP地址和端口號(hào)的組合來(lái)唯一區(qū)分各個(gè)內(nèi)部主機(jī)。,TCP 負(fù)載均衡,10.1.1.2:80,10.1.1.1:80,NAT table,196.168.2.2:80,196.168.2.2:80,TCP,TCP,10.1.1.3:80,196.168.2.2:80,TCP,Internet,Inside,10.1.1.1,Host B,179.20.7.3,1,3,SA 10.1.1.1,DA 10.1.1.1,SA 196.168.2.2,DA 196.168.2.2,10.1.1.2,10.1.1.3,4,5,2,Host C,179.21.7.3,DA 196.168

4、.2.2,4,Inside Global IP,Address: Port,Protocol,Inside Local IP,Address: Port,10.1.1.1,TCP 負(fù)載均衡,TCP 負(fù)載均衡：用于將一臺(tái)虛擬的主機(jī)映射到幾臺(tái)真實(shí)的主機(jī)上。,NAT 二種類型,NAT有二種類型：靜態(tài)NAT、動(dòng)態(tài)NAT。 其中靜態(tài)NAT設(shè)置起來(lái)最為簡(jiǎn)單，內(nèi)部網(wǎng)絡(luò)中的每個(gè)主機(jī)都被永久映射成外部網(wǎng)絡(luò)中的某個(gè)合法的地址,多用于服務(wù)器。 而動(dòng)態(tài)NAT則是在外部網(wǎng)絡(luò)中定義了一系列的合法地址，采用動(dòng)態(tài)分配的方法映射到內(nèi)部網(wǎng)絡(luò),多用于網(wǎng)絡(luò)中的工作站。 PAT則是把內(nèi)部地址映射到外部網(wǎng)絡(luò)的一個(gè)IP地址的不同端口上。,

5、靜態(tài)NAT配置命令,Establishes static translation between an inside local address and an inside global address,RouterX(config)# ip nat inside source static local-ip global-ip,Marks the interface as connected to the inside,RouterX(config-if)# ip nat inside,Marks the interface as connected to the outside,Route

6、rX(config-if)# ip nat outside,Displays active translations,RouterX# show ip nat translations,靜態(tài)NAT配置,RouterX# show ip nat translations Pro Inside global Inside local Outside local Outside global - 192.168.1.2 10.1.1.2 - -,interface s0 ip address 192.168.1.1 255.255.255.0 ip nat outside ! interface e

7、0 ip address 10.1.1.1 255.255.255.0 ip nat inside ! ip nat inside source static 10.1.1.2 192.168.1.2,動(dòng)態(tài)NAT的配置命令,Establishes dynamic source translation, specifying the ACL that was defined in the previous step,RouterX(config)# ip nat inside source listaccess-list-number pool name,Defines a pool of gl

8、obal addresses to be allocated as needed,RouterX(config)# ip nat pool name start-ip end-ipnetmask netmask | prefix-length prefix-length,Defines a standard IP ACL permitting those inside local addresses that are to be translated,RouterX(config)# access-list access-list-number permitsource source-wild

9、card,Displays active translations,RouterX# show ip nat translations,動(dòng)態(tài)NAT的配置,RouterX# show ip nat translations Pro Inside global Inside local Outside local Outside global - 171.69.233.209 192.168.1.100 - - - 171.69.233.210 192.168.1.101 - -,復(fù)用內(nèi)部全局地址的配置,RouterX# show ip nat translations Pro Inside gl

10、obal Inside local Outside local Outside global TCP 172.17.38.1:1050 192.168.3.7:1050 10.1.1.1:23 10.1.1.1:23 TCP 172.17.38.1:1776 192.168.4.12:1776 10.2.2.2:25 10.2.2.2:25,hostname RouterX ! interface Ethernet0 ip address 192.168.3.1 255.255.255.0 ip nat inside ! interface Ethernet1 ip address 192.1

11、68.4.1 255.255.255.0 ip nat inside ! interface Serial0 description To ISP ip address 172.17.38.1 255.255.255.0 ip nat outside ! ip nat inside source list 1 interface Serial0 overload ! ip route 0.0.0.0 0.0.0.0 Serial0 ! access-list 1 permit 192.168.3.0 0.0.0.255 access-list 1 permit 192.168.4.0 0.0.

12、0.255 !,NAT調(diào)試,Router#sh ip nat trans Pro Inside global Inside local Outside local Outside global tcp 192.2.2.1:11003 10.1.1.1:11003 172.16.2.2:23 172.16.2.2:23 tcp 192.2.2.1:1067 10.1.1.2:1067 172.16.2.3:23 172.16.2.3:23,A translation for a Telnet is still active. Two different inside hosts appear o

13、n the outside with a single IP address.,Basic IP address translation,Unique TCP port numbers are used to distinguishbetween hosts.,Router#show ip nat trans ProInside globalInside localOutside local Outside global -192.2.2.110.1.1.1- -192.2.2.210.1.1.2-,IP address translation with overloading,Clearin

14、g NAT Translation Entries,All entries are cleared.,192.16.2.2 is cleared.,Router#sh ip nat trans Pro Inside global Inside local Outside local Outside global tcp 192.16.2.1:11003 10.1.1.1:11003 172.16.2.2:23 172.16.2.2:23 tcp 192.16.2.1:1067 10.1.1.2:1067 172.16.2.3:23 172.16.2.3:23 router#clear ip n

15、at trans * router# router#show ip nat trans,router#show ip nat trans Pro Inside global Inside local Outside localOutside global udp 192.16.2.2:1220 10.1.1.2:1120 171.69.2.132:53 171.69.2.132:53 tcp 192.16.2.1:11003 10.1.1.1:11003 172.16.2.2:23 172.16.2.2:23 tcp 192.16.2.1:1067 10.1.1.1:1067 172.16.2

16、.3:23 172.16.2.3:23 router#clear ip nat trans udp inside 192.16.2.2 10.1.1.2 1220 171.69.2.132 53 171.69.2.132 53 router#show ip nat trans Pro Inside global Inside local Outside localOutside global tcp 192.16.2.1:11003 10.1.1.1:11003 172.16.2.2:23 172.16.2.2:23 tcp 192.16.2.1:1067 10.1.1.3:1067 172.

17、16.2.3:23 172.16.2.3:23,NAT調(diào)試,Router#debug ip nat NAT: s=10.1.1.1-192.16.2.1, d=172.166.2.2 0 NAT*: s=172.166.2.2, d=192.16.2.1-10.1.1.1 0 NAT: s=10.1.1.1-192.16.2.1, d=172.166.2.2 1 NAT: s=10.1.1.1-192.16.2.1, d=172.166.2.2 2 NAT: s=10.1.1.1-192.16.2.1, d=172.166.2.2 3 NAT*: s=172.166.2.2, d=192.16.2.1-10.1.1.1 1 NAT: s=10.1.1.1-192.16.2.1, d=172.166.2.2 4 NAT: s=10.1.1.1-192.16.2.1, d=172.166.2.2 5 NAT: s=10.1.1.1-192.16.2.1, d=172.166.2.2 6 NAT*: s=172