华为nat配置实例.doc

窗体顶端NAT【Router】当前路由器提示视图依次输入的配置命令，重要的命令红色突出显示简单说明Quidwayacl number 2000Quidway-acl-basic-2000rule permit source 55配置允许进行NAT转换的内网地址段Quidway-acl-basic-2000rule denyQuidwayinterface Ethernet0/1Quidway-Ethernet0/1ip address 内网网关Quidwayinterface Ethernet0/0Quidway-Ethernet0/1ip address 48Quidway-Ethernet0/1nat outbound 2000在出接口上进行NAT转换Quidwayip route-static preference 60配置默认路由华为路由器单臂路由配置实例组网描述:PC-3050C-AR28-31-INTERNET组网实现:3050C上划分多个VLAN,在AR28-31上终结VLAN信息,下面的所有VLAN中的PC都可以上公网,所有的PC机都通过AR28-31分配IP地址和DNSAR28-31dis cu#sysname Quidway#FTP server enable#nat address-group 0 0 用于上公网的地址池#radius scheme system#domain system#local-user adminpassword cipher .USE=B,53Q=QMAF41!service-type telnet terminallevel 3service-type ftplocal-user huawei telnet用户,用于远程管理password simple huaweiservice-type telnetlevel 3#dhcp server ip-pool 10 为VLAN10分配IP地址network mask gateway-list dns-list 00#dhcp server ip-pool 20 为VLAN20分配IP地址network mask gateway-list dns-list 00#dhcp server ip-pool 30 为VLAN30分配IP地址network mask gateway-list dns-list 00#dhcp server ip-pool 40 为VLAN40分配IP地址network mask gateway-list dns-list 00#interface Aux0async mode flow#interface Ethernet1/0 用于与交换机的管理IP互通ip address firewall packet-filter 3000 inbound#interface Ethernet1/0.1 终结交换机上的VLAN10tcp mss 1024ip address firewall packet-filter 3000 inboundvlan-type dot1q vid 10#interface Ethernet1/0.2 终结交换机上的VLAN20tcp mss 1024ip address firewall packet-filter 3000 inboundvlan-type dot1q vid 20#interface Ethernet1/0.3 终结交换机上的VLAN30tcp mss 1024ip address firewall packet-filter 3000 inboundvlan-type dot1q vid 30#interface Ethernet1/0.4 终结交换机上的VLAN40tcp mss 1024ip address firewall packet-filter 3000 inboundvlan-type dot1q vid 40#interface Ethernet2/0ip address nat outbound 2000 address-group 0 进行私网到公网的地址转换#interface NULL0#acl number 2000 允许 这个网段的地址进行地址转换rule 0 permit source 55rule 1 deny#acl number 3000rule 0 deny udp destination-port eq tftprule 1 deny tcp destination-port eq 135rule 2 deny udp destination-port eq 135rule 3 deny udp destination-port eq netbios-nsrule 4 deny udp destination-port eq netbios-dgmrule 5 deny tcp destination-port eq 139rule 6 deny udp destination-port eq netbios-ssnrule 7 deny tcp destination-port eq 445rule 8 deny udp destination-port eq 445rule 9 deny tcp destination-port eq 539rule 10 deny udp destination-port eq 539rule 11 deny udp destination-port eq 593rule 12 deny tcp destination-port eq 593rule 13 deny udp destination-port eq 1434rule 14 deny tcp destination-port eq 4444rule 15 deny tcp destination-port eq 9996rule 16 deny tcp destination-port eq 5554rule 17 deny udp destination-port eq 9996rule 18 deny udp destination-port eq 5554rule 19 deny tcp destination-port eq 137rule 20 deny tcp destination-port eq 138rule 21 deny tcp destination-port eq 1025rule 22 deny udp destination-port eq 1025rule 23 deny tcp destination-port eq 9995rule 24 deny udp destination-port eq 9995rule 25 deny tcp destination-port eq 1068rule 26 deny udp destination-port eq 1068rule 27 deny tcp destination-port eq 1023rule 28 deny udp destination-port eq 1023#ip route-static 54 preference 60 到电信网关的缺省路由#user-interface con 0user-interface aux 0user-interface vty 0 4authentication-mode scheme#return=dis cu#sysname Quidway#radius scheme systemserver-type huaweiprimary authentication 1645primary accounting 1646user-name-format without-domaindomain systemradius-scheme systemaccess-limit disablestate activevlan-assignment-mode integeridle-cut disableself-service-url disablemessenger time disabledomain default enable system#local-server nas-ip key huaweilocal-user huawei 用于WEB网管和TELNETpassword simple huaweiservice-type telnet level 3#vlan 1#vlan 10#vlan 20#vlan 30#vlan 40#interface Vlan-interface1 管理IPip address #interface Aux0/0#interface Ethernet0/1port access vlan 10#interface Ethernet0/2port access vlan 10#interface Ethernet0/3port access vlan 10#interface Ethernet0/4port access vlan 10#interface Ethernet0/5port access vlan 10#interface Ethernet0/6port access vlan 10#interface Ethernet0/7port access vlan 10#interface Ethernet0/8port access vlan 10#interface Ethernet0/9port access vlan 10#interface Ethernet0/10port access vlan 10#interface Ethernet0/11port access vlan 20#interface Ethernet0/12port access vlan 20#interface Ethernet0/13port access vlan 20#interface Ethernet0/14port access vlan 20#interface Ethernet0/15port access vlan 20#interface Ethernet0/16port access vlan 20#interface Ethernet0/17port access vlan 20#interface Ethernet0/18port access vlan 20#interface Ethernet0/19port access vlan 20#interface Ethernet0/20port access vlan 20#interface Ethernet0/21port access vlan 30#interface Ethernet0/22port access vlan 30#interface Ethernet0/23port access vlan 30#interface Ethernet0/24port access vlan 30#interface Ethernet0/25port access vlan 30#interface Ethernet0/26port access vlan 30#interface Ethernet0/27port access vlan 30#interface Ethernet0/28port access vlan 30#interface Ethernet0/29port access vlan 30#interface Ethernet0/30port access vlan 30#interface Ethernet0/31port access vlan 40#interface Ethernet0/32port access vlan 40#interface Ethernet0/33port access vlan 40#interface Ethernet0/34port access vlan 40#interface Ethernet0/35port access vlan 40#interface Ethernet0/36port ac