nat444配置脚本.doc

CGN割接步骤 增加radius服务器配置：radius-server group nat-pppoe-radius radius-server authentication X.X.X.X xxx weight 0 radius-server authentication X.X.X.X xxx weight 0 radius-server accounting X.X.X.X xxx weight 0 radius-server accounting X.X.X.X xxx weight 0 radius-server shared-key xxxx radius-server class-as-car radius-server source interface LoopBack0 undo radius-server user-name domain-included给CGN单板分配session资源Licensenat session-table size XM slot 11 engine 0nat session-table size XM slot 16 engine 0创建用户组配置user-group nat-pppoe-1user-group nat-pppoe-2创建地址池配置（私网地址，使用84个C）ip pool nat-pppoe-pool-1 bas localgateway 10.2.0.1 255.255.0.0section 0 10.2.0.2 10.2.7.255section 1 10.2.8.2 10.2.15.255section 2 10.2.16.2 10.2.23.255section 3 10.2.24.2 10.2.31.255section 4 10.2.32.2 10.2.39.255section 5 10.2.40.2 10.2.47.255section 6 10.2.48.2 10.2.55.255section 7 10.2.56.2 10.2.63.255section 8 10.2.64.2 10.2.71.255section 9 10.2.72.2 10.2.79.255section 10 10.2.80.2 10.2.87.255section 11 10.2.88.2 10.2.95.255section 12 10.2.96.2 10.2.103.255section 13 10.2.104.2 10.2.111.255dns-server 202.103.224.68 202.103.225.68warning-threshold 80创建ACL配置（匹配私网地址，用于NAT实例下的nat outbound）acl number xxxxrule permit source xxxx.xxx.xxx.xxx xxx.xxx.xxx.xxxrule permit source xxx.xxx.xxx.xxx xxx.xxx.xxx.xxxrule permit source xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx创建NAT实例配置#service-location 1 location slot 11 engine 0 backup slot 16 engine 0#service-location 2 location slot 16 engine 0 backup slot 11 engine 0#service-instance-group nat-pppoe-1 service-location 1service-instance-group nat-pppoe-2 service-location 2nat instance nat-pppoe-1 id 1 port-range 4096 service-instance-group nat-pppoe-1 nat address-group nat-pppoe-1 group-id 1section 0 X.X.X0.0 mask 24section 1 X.X.X1.0 mask 24section 2 X.X.X2.0 mask 24section 3 X.X.X3.0 mask 24nat outbound 2011 address-group nat-pppoe-1nat alg allnat filter mode full-conenat instance nat-pppoe-2 id 2 port-range 4096 service-instance-group nat-pppoe-2 nat address-group nat-pppoe-2 group-id 1section 0 X.X.X4.0 mask 24section 0 X.X.X5.0 mask 24section 0 X.X.X6.0 mask 24section 2 X.X.X7.0 mask 24 nat outbound 2011 address-group nat-pppoe-2 nat alg all nat filter mode full-cone创建域 domain nat-pppoeauthentication-scheme radiusaccounting-scheme cy-accountingtimeip-pool nat-pppoe-pool-1user-group nat-pppoe-1 bind nat instance nat-pppoe-1user-group nat-pppoe-2 bind nat instance nat-pppoe-2radius-server group nat-pppoe-radius在对接的radius服务器上增加需要割接的用户名对应的私网域名规则，该步骤以用户割接步骤为准在BGP中已network方式发布公网侧路由：bgp xxxxnetwork X.X.X0.0 24network X.X.X1.0 24network X.X.X2.0 24network X.X.X3.0 24network X.X.X4.0 24network X.X.X5.0 24network X.X.X6.0 24network X.X.X7.0 24创建并使能流策略配置acl xxxxrule permit ip source user-group nat-pppoe-1acl xxxxrule permit ip source user-group nat-pppoe-2traffic classifier pppoe-nat-1 operator or if-match acl xxxx traffic classifier pppoe-nat-2 operator or if-match acl xxxxtraffic behavior pppoe-nat-1 remark ip-precedence 0 nat bind instance nat-pppoe-1traffic behavior pppoe-nat-2remark ip-precedence 0 nat bind