cisco asa 8.2与8.4的nat区别.docx

1. NAT(nat-control,8.2有这条命令，开了的话没有nat是不通的)1. 8.2(PAT转换) global (outside) 10 00nat (inside) 10 ASA/pri/act(config)# show xlate 1 in use, 1 most usedPAT Global 00(1024) Local (11298)8.4object network nat subnet object network nat nat (inside,outside) dynamic 00ASA8-4# show xlate 1 in use, 2 most usedFlags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twiceTCP PAT from inside:/53851 to outside:00/5810 flags ri idle 0:00:04 timeout 0:00:302. 8.2（动态的一对一转换）nat (inside) 10 global (outside) 10 10-20 netmask ASA/pri/act# show xlate detail 2 in use, 2 most usedFlags: D - DNS, d - dump, I - identity, i - dynamic, n - no random, r - portmap, s - staticNAT from inside: to outside:10 flags iNAT from inside: to outside:11 flags i8.4object network nat subnet object network outside-nat range 10 20object network nat nat (inside,outside) dynamic outside-natASA8-4# show xlate 1 in use, 2 most usedFlags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twiceNAT from inside: to outside:15 flags i idle 0:01:13 timeout 3:00:003. 8.2(转换成接口地址) nat (inside) 10 global (outside) 10 interfaceASA/pri/act# show xlate detail 1 in use, 2 most usedFlags: D - DNS, d - dump, I - identity, i - dynamic, n - no random, r - portmap, s - staticTCP PAT from inside:/61971 to outside:0/1024 flags ri8.4object network nat subnet object network nat nat (inside,outside) dynamic interfaceASA8-4(config)# show xlate 1 in use, 2 most usedFlags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twiceTCP PAT from inside:/35322 to outside:0/52970 flags ri idle 0:00:03 timeout 0:00:304. 8.2(不同的内部地址转换成不同的外部地址) nat (inside) 9 nat (inside) 10 /排列标准，先看明细，越明细的越在前面，明细相同看IP地址，IP址址小的在前面，在实际作用的时候也是按照这个面序来的。global (outside) 10 interfaceglobal (outside) 9 11ASA/pri/act# show xlate detail 2 in use, 2 most usedFlags: D - DNS, d - dump, I - identity, i - dynamic, n - no random, r - portmap, s - staticTCP PAT from inside:/51343 to outside:11/1026 flags riTCP PAT from inside:/13938 to outside:0/1028 flags ri 8.4ASA8-4# show running-config objectobject network inside1 subnet object network inside2 subnet object network ouside-inside2 host 10ASA8-4# show running-config nat !object network inside1 nat (inside,outside) dynamic interfaceobject network inside2 nat (inside,outside) dynamic ouside-inside2ASA8-4# show xlate 2 in use, 2 most usedFlags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twiceTCP PAT from inside:/59611 to outside:10/34338 flags ri idle 0:00:08 timeout 0:00:30TCP PAT from inside:/22181 to outside:0/53371 flags ri idle 0:00:19 timeout 0:00:305. 8.2(先做一对一转换，当且仅点地址都用完了，在做PAT转换)ASA/pri/act# show running-config natnat (inside) 10 ASA/pri/act# show running-config global global (outside) 10 10-12global (outside) 10 16ASA/pri/act# show xlate detail 4 in use, 5 most usedFlags: D - DNS, d - dump, I - identity, i - dynamic, n - no random, r - portmap, s - staticNAT from inside: to outside:10 flags iNAT from inside: to outside:12 flags iTCP PAT from inside:/19799 to outside:16/1025 flags riNAT from inside: to outside:11 flags i 8.4object network outside range 10 12object network inside subnet object network inside nat (inside,outside) dynamic outside interfaceASA8-4# show xlate 4 in use, 4 most usedFlags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twiceTCP PAT from inside:/49994 to outside:0/52626 flags ri idle 0:00:04 timeout 0:00:30NAT from inside: to outside:11 flags i idle 0:01:31 timeout 3:00:00NAT from inside: to outside:10 flags i idle 0:00:16 timeout 3:00:00NAT from inside: to outside:12 flags i idle 0:00:33 timeout 3:00:006.6. 8.0 (策略NAT（从inside访问outside不同的端口号转换为不同的外部ip地址）)(策略nat永远是优于普通的nat的)access-list pat1 extended permit tcp host host eq telnet access-list pat2 extended permit tcp host host eq wwwnat (inside) 10 access-list pat1nat (inside) 20 access-list pat2global (outside) 10 00global (outside) 20 00ASA/pri/act# show xlate detaASA/pri/act# show xlate detail 2 in use, 5 most usedFlags: D - DNS, d - dump, I - identity, i - dynamic, n - no random, r - portmap, s - staticTCP PAT from inside:/30449 to outside(pat2):00/1024 flags riTCP PAT from inside:/43167 to outside(pat1):00/1024 flags ri8.42新版本(Twice NAT) ，这个是两次NAT，一般加入了基于目的的元素，而之前的network object 只是基于源的，通常情况下使用object 就能解决问题了，这个只是在特殊情况下使用。一般我们把object 叫做Auto NAT ，而Twice NAT 叫做manual NATobject network outside1 host 00object network outside2 host 00object network inside subnet object network outside host object service telnet service tcp destination eq telnet object service http service tcp destination eq wwwnat (inside,outside) source dynamic inside outside1 destination static outside outside service telnet telnetnat (inside,outside) source dynamic inside outside2 destination static outside outside service http httpASA8-4# show xlate 1 in use, 4 most usedFlags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twiceTCP PAT from outside: 23-23 to inside: 80-80flags srIT idle 0:00:37 timeout 0:00:00注意T是twice nat就是源地址和目的地址都可以转换的。70 （I identity nat 自已转换成自已多用于remote vpn） 8.0 nat (inside) 0 （ The of this group of hosts/networks. This will be referenced by the global command to associate a global pool with the local IP address. 0 is used to indicate no address translation for local IP. The limit is 65535 with access-lists）0表示自已转让换成自已。 ASA/pri/act# show xlate detail 1 in use, 5 most usedFlags: D - DNS, d - dump, I - identity, i - dynamic, n - no random, r - portmap, s - staticNAT from inside: to outside: flags iI注意这里面的I自已转换成自已。(这种情况下外部是不是访问内部的)8.4 object network iden-nat subnet object network iden-nat nat (inside,outside) static iden-natASA8-4# show xlate 1 in use, 4 most usedFlags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twiceNAT from inside:/24 to outside:/24 flags sI idle 0:00:07 timeout 0:00:00上面全部都是其于source的nat转换，下面我们来探论基于static的nat转换。 88.02（静态nat转换，从outside到inside静态的一对一转换） ASA/pri/act# show running-config static static (inside,outside) 00 netmask 55访问列表放行的是转换后的地址access-list out line 1 extended permit tcp host host 00 (hitcnt=9) 0x4a668fb0 ASA/pri/act# show xlate detail 1 in use, 5 most usedFlags: D - DNS, d - dump, I - identity, i - dynamic, n - no random, r - portmap, s - staticNAT from inside: to outside:00 flags s 8.42 ASA8-4# show running-config objectobject network nat host ASA8-4# show running-config nat !object network nat nat (inside,outside) static 00 ASA8-4# show xlate 1 in use, 4 most usedFlags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twiceNAT from inside: to outside:00 flags s idle 0:00:52 timeout 0:00:00 access-list out line 1 extended permit tcp host host (hitcnt=1) 0xe8e098f5 列表放行的是内部主机真实的IP地址。9. 8.0static pat(PORT redirection )只有一个公网地址，将访问公网地址不同的端口号，转换到不同的服务器上去。 ASA/pri/act# show running-config static static (inside,outside) tcp 00 telnet www netmask 55 static (inside,outside) tcp 00 www telnet netmask 55ASA/pri/act# show xlate detail 2 in use, 5 most usedFlags: D - DNS, d - dump, I - identity, i - dynamic, n - no random, r - portmap, s - staticTCP PAT from inside:/80 to outside:00/23 flags srTCP PAT from inside:/23 to outside:00/80 flags sraccess-list out line 1 extended permit tcp host host 00 eq telnet (hitcnt=1) 0x57c792d9 access-list out line 2 extended permit tcp host host 00 eq www (hitcnt=0) 0x463b6a3b列表放行的也是转换后的地址及端口号。8.4新版本(Twice NAT)object network inside1 host object network inside2 host object network outside host 00object service telnet service tcp destination eq telnet object service http service tcp destination eq www object network outside-des host ASA8-4(config)# show running-config nat nat (outside,inside) source static outside-des outside-des destination static outside inside1 service http telnetaccess-list out line 1 extended permit tcp host host eq telnet (hitcnt=1) 0x213cb7ceR5-outside8.4#telnet 00 80Trying 00, 80 . OpenR4-inside1-8.4108.2 static-Identity转换，将内部地址自已转换成自已，并且外部可以访问。外面可以访部内的static-Identity转换。ASA/pri/act# show running-config static static (inside,outside) netmask 55ASA/pri/act# show xlate detail 1 in use, 5 most usedFlags: D - DNS, d - dump, I - identity, i - dynamic, n - no random, r - portmap, s - staticNAT from inside: to outside: flags saccess-list out line 1 extended permit tcp host host (hitcnt=1) 0xe8e098f5R2-outside#telnet Trying . OpenR1-insideR1-insideshow userR1-insideshow users Line User Host(s) Idle Location 0 con 0 idle 00:00:08 *130 vty 0 idle 00:00:00 Interface User Mode Idle Peer Address8.4 ASA8-4# show running-config objectobject network iden-nat host object network iden-nat nat (inside,outside) static ASA8-4# show xlate 1 in use, 4 most usedFlags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twiceNAT from inside: to outside: flags sI idle 0:00:07 timeout 0:00:00R5-outside8.4#telR5-outside8.4#telnet Trying . Open11.静态的网段转换(整个网段一对一转换)8.0static (inside,outside) netmask ASA/pri/act# show xlate detail 1 in use, 5 most usedFlags: D - DNS, d - dump, I - identity, i - dynamic, n - no random, r - portmap, s - staticNAT from inside: to outside: flags saccess-list out line 1 extended permit tcp (hitcnt=1) 0x34f8fd73R2-outside#telnet Trying . Open8.4object network inside subnet object network outside subnet object network inside nat (inside,outside) static outsideASA# show xlate 1 in use, 1 most usedFlags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twiceNAT from inside:/24 to outside:/24 flags s idle 0:03:19 timeout 0:00:00access-list out line 1 extended permit tcp host host (hitcnt=1) 0x0b722de5R5-outside8.4#telnet Trying . OpenR4-inside1-8.4R4-inside1-8.4show userR4-inside1-8.4show users Line User Host(s) Idle Location 0 con 0 idle 00:00:04 *130 vty 0 idle 00:00:00 Interface User Mode Idle Peer Address12. 8.0 nat (inside) 0 access-list特殊的nat 称为no-nat或者nat by-pass一般用于vpnVpn的流量不能被nat掉。Nat (inside) 0 access-list(匹配vpn流量),access-list的流量是不会被nat转换的。access-list vpn line 1 extended permit ip host host (hitcnt=0) 0x732d93c0nat (inside) 0 access-list vpnnat (inside) 10 匹配的流量没有做nat 没有匹配的流量做了nat转换。R1-inside#show running-config interface eth0/0Building configuration.Current configuration : 77 bytes!interface Ethernet0/0 ip address half-duplexendR1-inside#R1-inside#telnet Trying . OpenR2-outsideshow userR2-outsideshow users Line User Host(s) Idle Location 0 con 0 idle 00:04:19 *130 vty 0 idle 00:00:00 Interface User Mode Idle Peer AddressR1-inside#show running-config interface ethernet 0/0Building configuration.Current configuration : 77 bytes!interface Ethernet0/0 ip address half-duplexendR1-inside#R1-inside#R1-inside#tleR1-inside#te R1-inside#telR1-inside#telnet Trying . OpenR2-outsideshow userR2-outsideshow users Line User Host(s) Idle Location 0 con 0 idle 00:04:49 *130 vty 0 idl