Cisco–NAT和PAT的配置.doc

CiscoNAT和PAT的配置下面是实验拓扑图：相关说明：NAT用于提供几乎无限的地址空间并掩藏内部网络寻址方案，地址管理更加容易，它允许严格控制进入和离开网络的流量；但是静态或动态NAT都存在一个问题，它只能提供一对一的地址转换。使用端口地址转换PAT可以实现地址复用的功能，使用PAT后，所有通过地址转换设备的机器都拥有了分配给它们相同IP地址，因此源端口号用来区分不同的连接。实验过程：I：配置各路由器的IP地址，确保直连接口能Ping通。II：KC-R1模拟企业网关路由器。KC-R1(config)#ip route 0.0.0.0 0.0.0.0 173.16.1.128 #指向外网的静态路由 IV：配置NAT。方法一：静态NATKC-R1(config)#int f0/0KC-R1(config-if)#ip nat inside #将f0/0设置为内网口*Mar 1 00:05:49.875: %LINEPROTO-5-UPDOWN: Line protocol on Interface NVI0, changed state to upKC-R1(config-if)#exitKC-R1(config)#int s1/0KC-R1(config-if)#ip nat outside #将s1/0设置为外网口KC-R1(config-if)#exitKC-R1(config)#ip nat inside source static 10.1.1.1 173.16.1.56 #静态NATKC-R1(config)#exitPing测试:PC-1#ping 202.101.1.149 #测试证明能通Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 202.101.1.149, timeout is 2 seconds:!Success rate is 100 percent (5/5), round-trip min/avg/max = 120/122/132 ms此时PC-1能通，PC-2不能通。KC-R2#debug ip packet #查看数据包*Mar 1 00:09:59.487: IP: tableid=0, s=10.1.1.2 (Serial1/0), d=173.16.1.128 (Serial1/0), routed via RIB*Mar 1 00:09:59.491: IP: s=10.1.1.2 (Serial1/0), d=173.16.1.128 (Serial1/0), len 100, rcvd 3*Mar 1 00:09:59.495: IP: s=173.16.1.128 (local), d=10.1.1.2, len 100, unroutable.*Mar 1 00:23:51.243: IP: s=202.101.1.149 (local), d=173.16.1.56 (Serial1/0), len 100, sending*Mar 1 00:23:51.447: IP: tableid=0, s=173.16.1.56 (Serial1/0), d=202.101.1.149 (Loopback0), routed via RIB 方法二：动态NATKC-R1(config)# ip nat pool kachy 173.16.1.58 173.16.1.126 netmask 255.255.255.0 #创建地址池KC-R1(config)#access-list 1 permit 10.1.1.0 0.0.0.255 #创建ACLKC-R1(config)#ip nat inside source list 1 pool kachy #二者关联KC-R1(config)#exitPing测试PC-1#ping 202.101.1.149 #测试证明能通Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 202.101.1.149, timeout is 2 seconds:!Success rate is 100 percent (5/5), round-trip min/avg/max = 96/125/148 msPC-1#telnet 202.101.1.149 #测试证明能远程连接Trying 202.101.1.149 OpenPassword required, but none setConnection to 202.101.1.149 closed by foreign host此时PC-2也可以ping通，telnet上。查看当前KC-R1的NAT表。KC-R1#sh ip nat translations #查看NAT表Pro Inside global Inside local Outside local Outside global 173.16.1.58 10.1.1.1 173.16.1.59 10.1.1.2 KC-R1# 方法三：配置PATKC-R1(config)#access-list 100 permit ip 10.1.1.0 0.0.0.255 any #创建访问列表KC-R1(config)#ip nat inside source list 100 interface s1/0 overload #二者关联，地址重载KC-R1(config)#exit测试PC-1#ping 202.101.1.149Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 202.101.1.149, timeout is 2 seconds:!Success rate is 100 percent (5/5), round-trip min/avg/max = 84/97/116 msPC-1#PC-1#telnet 202.101.1.149 Trying 202.101.1.149 OpenPassword required, but none setConnection to 202.101.1.149 closed by foreign host同样，PC-2也能到达。在路由器KC-R1上KC-R1#debug ip nat #查看翻译过程*Mar 1 00:19:32.843: NAT*: s=10.1.1.1-173.16.1.56, d=202.101.1.149 46610*Mar 1 00:19:32.847: NAT*: s=10.1.1.1-173.16.1.56, d=202.101.1.149 46611*Mar 1 00:19:33.083: NAT*: s=202.101.1.149, d=173.16.1.56-10.1.1.1 31823在路由器KC-R2上KC-R2#debug ip packet *Mar 1 00:23:34.931: IP: tableid=0, s=173.16.1.56 (Serial1/0), d=202.101.1.149 (Loopback0), routed via RIB*Mar 1 00:23:34.935: IP: s=173.