Network-Operation---Cisco Route NAT 設(shè)定.docx

cisco Route NAT 設(shè)定21.1.在路由器上啟用基本的NAT功能Router#configure terminalEnter configuration commands, one per line. End with CNTL/Z.Router(config)#access-list 15 permit 55Router(config)#ip nat inside source list 15 interface FastEthernet0/0 overloadRouter(config)#interface FastEthernet0/2Router(config-if)#ip address Router(config-if)#ip nat insideRouter(config-if)#exitRouter(config)#interface FastEthernet0/1Router(config-if)#ip address Router(config-if)#ip nat insideRouter(config-if)#exitRouter(config)#interface Ethernet0/0Router(config-if)#ip address 52Router(config-if)#ip nat outsideRouter(config-if)#exitRouter(config)#endRouter# 注釋 例子中的配置實現(xiàn)了對地址段/16訪問外部網(wǎng)絡(luò)重寫為的功能，基本的地址翻譯功能21.2. 動態(tài)分配外部地址 Router#configure terminalEnter configuration commands, one per line. End with CNTL/Z.Router(config)#access-list 15 permit 55Router(config)#ip nat pool NATPOOL 00 50 netmask Router(config)#ip nat inside source list 15 pool NATPOOLRouter(config)#interface FastEthernet 0/0Router(config-if)#ip address Router(config-if)#ip nat insideRouter(config-if)#exitRouter(config)#interface FastEthernet 0/1Router(config-if)#ip address Router(config-if)#ip nat insideRouter(config-if)#exitRouter(config)#interface Ethernet1/0Router(config-if)#ip address Router(config-if)#ip nat outsideRouter(config-if)#exitRouter(config)#endRouter#注釋 ip nat inside source list 15 pool NATPOOL 定義了翻譯出去的地址池，如果地址池可以地址用完新的翻譯將不成功，如果加上了overload參數(shù)將會從第一個地址開始翻譯進行復(fù)用。另外這里的地址池并不一定要和outside端口的地址在同一網(wǎng)段，只要有相應(yīng)的路由就可以。21.3. 靜態(tài)分配外部地址 Router#configure terminalEnter configuration commands, one per line. End with CNTL/Z.Router(config)#ip nat inside source static 5 0Router(config)#ip nat inside source static 6 1Router(config)#interface FastEthernet 0/0Router(config-if)#ip address Router(config-if)#ip nat insideRouter(config-if)#exitRouter(config)#interface FastEthernet 0/1Router(config-if)#ip address Router(config-if)#ip nat insideRouter(config-if)#exitRouter(config)#interface Ethernet1/0Router(config-if)#ip address Router(config-if)#ip nat outsideRouter(config-if)#exitRouter(config)#endRouter#21.4. 地址靜態(tài)和動態(tài)翻譯結(jié)合 Router#configure terminalEnter configuration commands, one per line. End with CNTL/Z.Router(config)#access-list 15 deny 5 Router(config)#access-list 15 deny 6 Router(config)#access-list 15 permit 55Router(config)#ip nat inside source static 5 0Router(config)#ip nat inside source static 6 1Router(config)#ip nat pool NATPOOL 00 50 netmask Router(config)#ip nat inside source list 15 pool NATPOOL overloadRouter(config)#interface FastEthernet0/0Router(config-if)#ip address Router(config-if)#ip nat insideRouter(config-if)#exitRouter(config)#interface FastEthernet0/1Router(config-if)#ip address Router(config-if)#ip nat insideRouter(config-if)#exitRouter(config)#interface Ethernet0/0Router(config-if)#ip address Router(config-if)#ip nat outsideRouter(config-if)#exitRouter(config)#endRouter#注釋 這里的控制列表把所要靜態(tài)內(nèi)部地址排除了，當然這一步也不是必須的，因為靜態(tài)翻譯的優(yōu)先級要高于動態(tài)翻譯的，不過靜態(tài)翻譯的外部地址必須要從動態(tài)翻譯的地址池中排除。21.5. 使用Route Maps來進行翻譯規(guī)則控制 Router1#configure terminalEnter configuration commands, one per line. End with CNTL/Z.Router(config)#interface FastEthernet0/0Router(config-if)#ip address 52Router(config-if)#ip nat outsideRouter(config-if)#exitRouter(config)#interface FastEthernet0/1Router(config-if)#ip address 52Router(config-if)#ip nat outsideRouter(config-if)#exitRouter(config)#interface FastEthernet0/2Router(config-if)#ip address Router(config-if)#ip nat insideRouter(config-if)#exitRouter(config)#ip nat inside source route-map ISP-1 interface FastEthernet0/0 overloadRouter(config)#ip nat inside source route-map ISP-2 interface FastEthernet0/1 overloadRouter(config)#route-map ISP-1 permit 10Router(config-route-map)#match interface FastEthernet0/0Router(config-route-map)#exitRouter(config)#route-map ISP-2 permit 10Router(config-route-map)#match interface FastEthernet0/1Router(config-route-map)#exitRouter(config)#endRouter#注釋 適用于多個outside端口的情況21.6. 同時兩個方向地址翻譯 Router#configure terminalEnter configuration commands, one per line. End with CNTL/Z.Router(config)#access-list 15 deny 5Router(config)#access-list 15 permit 55Router(config)#access-list 16 deny 5Router(config)#access-list 16 permit 55Router(config)#ip nat pool NATPOOL 00 50 netmask Router(config)#ip nat pool INBOUNDNAT 00 00 netmask Router(config)#ip nat inside source list 15 pool NATPOOL overloadRouter(config)#ip nat inside source list 16 pool INBOUNDNAT overloadRouter(config)#ip nat inside source static 5 0Router(config)#ip nat outside source static 5 Router(config)#ip route Ethernet0/0Router(config)#interface FastEthernet 0/0Router(config-if)#ip address Router(config-if)#ip nat insideRouter(config-if)#exitRouter(config)#interface FastEthernet 0/1Router(config-if)#ip address Router(config-if)#ip nat insideRouter(config-if)#interface Ethernet0/0Router(config-if)#ip address Router(config-if)#ip nat outsideRouter(config-if)#exitRouter(config)#endRouter#21.7. 網(wǎng)絡(luò)前綴重寫 簡單的改變某個網(wǎng)絡(luò)段的前綴 Router#configure terminalEnter configuration commands, one per line. End with CNTL/Z.Router(config)#ip nat outside source static network /16 no-aliasRouter(config)#ip route Ethernet1/0Router(config)#ip route Ethernet1/0Router(config)#interface FastEthernet 0/0Router(config-if)#ip address Router(config-if)#ip nat insideRouter(config-if)#exitRouter(config)#interface Ethernet1/0Router(config-if)#ip address 52Router(config-if)#ip nat outsideRouter(config-if)#exitRouter(config)#endRouter#注釋 適用于兩個網(wǎng)絡(luò)互訪而地址段沖突的情況21.8. 使用NAT來進行服務(wù)器負荷分擔(dān) Router#configure terminalEnter configuration commands, one per line. End with CNTL/Z.Router(config)#interface FastEthernet0/0Router(config-if)#ip address Router(config-if)#ip nat insideRouter(config-if)#exitRouter(config)#interface FastEthernet0/1Router(config-if)#ip address Router(config-if)#ip nat outsideRouter(config-if)#exitRouter(config)#ip nat pool WEBSERVERS 01 05 netmask type rotaryRouter(config)#access-list 20 permit host 00Router(config)#ip nat inside destination list 20 pool WEBSERVERSRouter(config)#endRouter#注釋 這里不同點在于使用了rotary的參數(shù)和使用了destination而不是source在翻譯規(guī)則中，當然這種是窮人的負載均衡解決方案21.9. 基于狀態(tài)的NAT切換RouterA Router-A#configure terminalEnter configuration commands, one per line. End with CNTL/Z.Router-A(config)#access-list 11 permit anyRouter-A(config)#ip nat pool NATPOOL 00 50 netmask Router-A(config)#ip nat inside source list 11 pool NATPOOL mapping-id 1Router-A(config)#interface FastEthernet0/0Router-A(config-if)#ip address Router-A(config-if)#ip nat insideRouter-A(config-if)#standby 1 ip Router-A(config-if)#standby 1 preemptRouter-A(config-if)#standby 1 name SNATGROUPRouter-A(config-if)#exitRouter-A(config)#interface Serial0/0Router-A(config-if)#ip address 52Router-A(config-if)#ip nat outsideRouter-A(config-if)#exitRouter-A(config)#ip nat Stateful id 1Router-A(config-ipnat-snat)#redundancy SNATGROUPRouter(config-ipnat-snat-red)#mapping-id 1Router(config-ipnat-snat-red)#exitRouter-A(config)#endRouter-A#RouterB Router-B#configure terminalEnter configuration commands, one per line. End with CNTL/Z.Router-B(config)#access-list 11 permit anyRouter-B(config)#ip nat pool NATPOOL 00 50 netmask Router-B(config)#ip nat inside source list 11 pool NATPOOL mapping-id 1Router-B(config)#interface FastEthernet0/0Router-B(config-if)#ip address Router-B(config-if)#ip nat insideRouter-B(config-if)#standby 1 ip Router-B(config-if)#standby 1 priority 90Router-B(config-if)#standby 1 preemptRouter-B(config-if)#standby 1 name SNATGROUPRouter-B(config-if)#exitRouter-B(config)#interface Serial0/0Router-B(config-if)#ip address 52Router-B(config-if)#ip nat outsideRouter-B(config-if)#exitRouter-B(config)#ip nat Stateful id 1Router-B(config-ipnat-snat)#redundancy SNATGROUPRouter(config-ipnat-snat-red)#mapping-id 1Router(config-ipnat-snat-red)#exitRouter-B(config)#endRouter-B#注釋 雖然說通過使用HSRP可以解決可用性的問題，但是不能同步NAT翻譯表，從12.2(13)T以后思科引入了基于狀態(tài)的NAT（SNAT），這樣可以保持兩臺設(shè)備的翻譯表同步，其關(guān)鍵命令為ip nat Stateful 要注意的是這里的Stateful是大寫開頭的，這里是區(qū)分大小寫的。另外SNAT只和HSRP連用，不能跟VRRP或者GLBP一起作用。同時也可以使用多組HSRP的形式來保持負載均衡。21.10. 調(diào)整NAT 時長 Router#configure terminalEnter configuration commands, one per line. End with CNTL/Z.Router(config)#ip nat translation tcp-timeout 500Router(config)#ip nat translation udp-timeout 30Router(config)#ip nat translation dns-timeout 30Router(config)#ip nat translation icmp-timeout 30Router(config)#ip nat translation finrst-timeout 30Router(config)#ip nat translation syn-timeout 30Router(config)#endRouter#也可以限制翻譯表的最大條目數(shù) Router#configure terminalEnter configuration commands, one per line. End with CNTL/Z.Router(config)#ip nat translation max-entries 1000Router(config)#endRouter#注釋 缺省TCP為24小時，UDP為5分鐘，DNS為1分鐘21.11. 修改FTP的TCP端口 Router#configure terminalEnter configuration commands, one per line. End with CNTL/Z.Router(config)#access-list 19 permit Router(config)#ip nat service list 19 ftp tcp port 8021Router(config)#ip nat service list 19 ftp tcp port 21Router(config)#endRo