|
|
一、组网需求：( B* C( \( E8 F- v
某公司平台和办公网的私网用户和互联网相连，路由器上接口GigabitEthernet0/0/0的公网地址为202.169.10.1/24，对端运营商侧地址为202.169.10.2/24。
2 s; ~8 \0 s$ b& K( p允许使用公网IP地址比较少（222.249.230.1），所以使用no-pat转换方式（只转换数据包的IP地址，并不使用端口号）平台的NAT方式替换A部门内部的主机地址{网段为192.168.(100-110).0/24}，访问因特网。# N; u5 I u1 G. x g5 S
允许使用公网IP地址比较少（222.249.230.1），所以使用pat转换方式（同时转换数据包中的IP地址和端口号）办公网的NAT替换内部的主机地址（网段为192.168.0.0/22），访问因特网。
/ b! ?1 G& m7 z8 m" ^4 }# R/ M; T1、网络拓扑
5 G8 U" z8 z4 C. R) g4 V" r略
; D' G& M b3 d3 N) U) t; V2 N5 b" i4 g
2、配置思路$ j& N: E$ h- U( q4 o$ g
配置接口IP地址、缺省路由和在WAN侧接口下配置NAT Outbound，实现内部主机访问外网服务功能。
& O" Q& V* D1 F8 h4 L9 N二、操作步骤# D Z* u0 m9 o
1、配置云平台、办公网主机IP地址，网关分别是192.168.(100-110).254、192.168.0.1 k5 Z! Y& o# ~3 \1 ~4 b
2、在SWA上配置vlan( ^6 G) O; V3 G+ W: {: y; Q0 l
<Huawei>system-view0 V* h; `) S/ C
[Huawei]sysname SW
, A. f4 L7 m+ \" {2 v1 t[SW]vlan （100-110）& t1 s* E& x5 }3 x. T1 p
[SW-vlan（100-110）]q. g6 E) G; P' P6 N
[SW]interface Ethernet0/0/15 J8 B, H+ \1 G3 p; s* ?2 W
[SW-Ethernet0/0/1]port link-type access
) Z( {6 | ]0 u[SW-Ethernet0/0/1]port default vlan 100
+ ~9 X6 n; w7 q* S* R[SW-Ethernet0/0/1]q( j. ~& u; e1 N2 V% h( f
[SW]interface Ethernet 0/0/27 m9 V4 F$ u, ]' B7 N
[SW-Ethernet0/0/2]port link-type trunk/ q2 R+ o, n% A; u8 F3 b" E
[SW-Ethernet0/0/2]port trunk allow-pass vlan all! ?) s- Y$ H4 }$ P U n, ]; R
[SW-Ethernet0/0/2]q, o8 U$ C+ K5 }" f8 L/ w
3、在SWB上配置vlan; ~4 o2 |8 J7 V) _8 O7 g; R
[Huawei]sysname SW1
4 n2 E& r. P8 p7 L* H[SW1]vlan 200
4 N* w0 ]# l5 S7 H( z# l; I[SW1-vlan200]q
, ?" ?" r/ Q+ Z" M7 C[SW1]interface Ethernet0/0/1
4 c1 r: \: G5 [9 S+ Z[SW1-Ethernet0/0/1]port link-type access 8 D% `& g3 M" X* v+ d
[SW1-Ethernet0/0/1]port default vlan 200; m- x3 M; W1 J* f! t5 ?
[SW1-Ethernet0/0/1]q$ w, Y1 J7 v; ~3 U2 Z9 f! C& }6 `
[SW1]interface Ethernet 0/0/21 H" Z. S. B4 K- L( Y+ K4 X
[SW1-Ethernet0/0/2]port link-type trunk . K- M: {8 {9 B5 o j
[SW1-Ethernet0/0/2]port trunk allow-pass vlan all 5 J" n3 R9 O/ ~0 o$ N a& {
[SW1-Ethernet0/0/2]q) [; ]4 u5 D v4 `2 p; `
4、在Router上配置接口IP地址( @, \5 F( V; x' t, |
<Huawei>system-view 0 e+ ?/ {" O: N, a) v& {
[Huawei]sysname Router. `& ^; P! j* Q+ Q8 S- Z
[Router]vlan batch 100 2002 C3 x. X- t: R
[Router]interface Vlanif 1004 t# U9 o4 c( v* |
[Router-Vlanif100]ip address 192.168.20.1 24
; d- o, U6 H! \- ^+ v[Router-Vlanif100]q
* w! U! }: V! F: _# K0 ^[Router]interface Vlanif 2004 @* p0 L1 d5 q; O& N; m, Z$ ?
[Router-Vlanif200]ip address 10.0.0.1 24
2 e# L! Z) j- s4 Q' t2 s2 l& Y" L[Router-Vlanif200]q, w9 c% W# k: z& e7 z) j/ s
[Router]interface Ethernet 0/0/0, _3 X+ J& n, U5 p4 ^
[Router-Ethernet0/0/0]port link-type trunk
8 F6 Q. ?$ ^- R, v! o[Router-Ethernet0/0/0]port trunk allow-pass vlan all ) T- t+ W/ r0 E4 }% B/ m$ x
[Router-Ethernet0/0/0]q
4 Z' X0 T- N9 U) n" B, j+ Z, N" q[Router]interface Ethernet 0/0/1
) A/ e* M% l! o! r7 Y' m[Router-Ethernet0/0/1]port link-type trunk 7 a. o# D& p1 [! H" C' f7 ^3 H
[Router-Ethernet0/0/1]port trunk allow-pass vlan all O9 B1 Z* K+ |, x$ E" b
[Router-Ethernet0/0/1]q& L, W. x T6 \& T/ b
[Router]interface GigabitEthernet 0/0/0
# P9 p. S, D1 E[Router-GigabitEthernet0/0/0]ip address 202.169.10.1 24" E& f4 K$ i$ Q9 m$ D
[Router-GigabitEthernet0/0/0]q
5 {$ A# x2 ^7 W2 o. X0 L6 |% X这时候主机就可以ping通网关了
, B* }1 N1 F: [( Q5、在Router上配置缺省路由，指定下一跳为202.169.10.2
5 B( {) b% d/ M8 o[Router]ip route-static 0.0.0.0 0.0.0.0 202.169.10.2
! r- j' M X3 m6、在Router上配置NAT Outbound（记住在出接口上应用）5 U+ Y% s: N# P1 c5 J7 n- d
[Router]nat address-group 1 202.169.10.100 202.169.10.2006 M3 V8 I) Z, z) C6 z* I# W
[Router]nat address-group 2 202.169.10.201 202.169.10.202" [/ y& `0 G6 V9 r) ]; X
[Router]acl number 3001% p1 T5 e8 e5 M* b% }# V2 `7 O: x
[Router-acl-adv-3001]rule 5 permit ip source 192.168.20.0 0.0.0.2552 w! K, ^% W0 ^# C6 b3 q
[Router-acl-adv-3001]q& v, X7 x3 p0 D2 p4 @
[Router]acl number 3002
/ ]1 T, O: f4 f- m! c# ][Router-acl-adv-3002]rule 5 permit ip source 10.0.0.0 0.0.0.2554 B# a6 z _( Q0 e
[Router-acl-adv-3002]q8 n" T" S- C0 i" t
[Router]interface GigabitEthernet 0/0/0
8 M' @6 u- s5 u1 y8 g4 Q" |[Router-GigabitEthernet0/0/0]nat outbound 3001 address-group 1 no-pat
L! T8 q9 n* }0 s2 b" j[Router-GigabitEthernet0/0/0]nat outbound 3002 address-group 2
& ]1 o: p4 G7 S9 I9 X[Router-GigabitEthernet0/0/0]q% I1 v+ X5 t8 ?
[Router]ip soft-forward enhance enable( n8 [& o2 ]% D6 R D+ Y5 Q
如果需要在Router上执行ping -a source-ip-address命令通过指定发送ICMP ECHO-REQUEST报文的源IP地址来验证内网用户可以访问因特网，需要配置命令ip soft-forward enhance enable使能设备产生的控制报文的增强转发功能，这样，私网的源地址才能通过NAT转换为公网地址。
! l4 h1 _' h, E7、查看结果
% w+ z, R, U( u2 z- Y5 S[Router]display nat outbound
' k" s& U7 w4 x6 R NAT Outbound Information:) a9 ~$ x8 x6 }
--------------------------------------------------------------------------/ s( A! e% `# N: _0 Z2 C* D0 N
Interface Acl Address-group/IP/Interface Type; T& n1 ?: Z. K* C! X1 E! G- g
--------------------------------------------------------------------------8 L9 Y3 l: o Q# ~, }( e+ ~
GigabitEthernet0/0/0 3001 1 no-pat
4 R) u/ H Z* H GigabitEthernet0/0/0 3002 2 pat
# j, j, o5 E, I8 _ --------------------------------------------------------------------------9 O5 M1 Z% |/ H) d/ b/ h' U: G
Total : 2
* _& |9 R6 b- I) \" k[Router]ping -a 192.168.20.1 202.169.10.2
: h0 q: `; N8 G+ e4 N PING 202.169.10.2: 56 data bytes, press CTRL_C to break
1 u$ d4 {" P+ g9 m0 `) } Reply from 202.169.10.2: bytes=56 Sequence=1 ttl=255 time=10 ms* p/ Z0 o, D0 ? |0 [: f
Reply from 202.169.10.2: bytes=56 Sequence=2 ttl=255 time=10 ms
5 {; f: M- K8 q( x( ]0 T! P Reply from 202.169.10.2: bytes=56 Sequence=3 ttl=255 time=10 ms/ P3 I) V( B$ v z( I( @
Reply from 202.169.10.2: bytes=56 Sequence=4 ttl=255 time=10 ms' }. m1 x" S3 p Q [
Reply from 202.169.10.2: bytes=56 Sequence=5 ttl=255 time=10 ms
# A8 a' n% M- w) J S/ a2 k/ }. j/ s, {
--- 202.169.10.2 ping statistics ---/ C) N9 n: c1 D3 s! [& S v4 P; \+ {
5 packet(s) transmitted6 k4 N+ }8 x [8 ? e; K* y, y
5 packet(s) received
% b! O+ a# p! i* K7 D( } 0.00% packet loss
0 t1 _. A, x% d: h# d9 {) g round-trip min/avg/max = 10/10/10 ms; B) y0 d& E' g8 p: P- E2 g
5 o; A/ P' K% d& c W$ u[Router]ping -a 10.0.0.1 202.169.10.2
4 Z& \ d& [4 i$ z' |) N9 a PING 202.169.10.2: 56 data bytes, press CTRL_C to break
% R3 Z% w/ G& t. A! ~2 k$ y Reply from 202.169.10.2: bytes=56 Sequence=1 ttl=255 time=10 ms2 p1 K) R1 d3 k) K
Reply from 202.169.10.2: bytes=56 Sequence=2 ttl=255 time=10 ms2 l" H, ?. ]1 o* ?
Reply from 202.169.10.2: bytes=56 Sequence=3 ttl=255 time=10 ms
, G9 M$ [5 K# g Reply from 202.169.10.2: bytes=56 Sequence=4 ttl=255 time=10 ms- Q0 Y$ ~& G% s& I# ~
Reply from 202.169.10.2: bytes=56 Sequence=5 ttl=255 time=10 ms
! X* n( f) P j, r" j+ |( f8 H 4 m1 D' H3 a. x
--- 202.169.10.2 ping statistics ---7 Y5 k7 f W( C- P% \- J2 b
5 packet(s) transmitted$ |) F8 Z+ e! F2 B W8 r
5 packet(s) received
) _8 Q& x: f/ j2 ^2 E0 X 0.00% packet loss5 Z' H2 q% U4 i5 H, |# Q: W
round-trip min/avg/max = 10/10/10 ms% p0 j0 K$ }' i" s5 A5 s1 e2 `
8、查看NAT映射表项* d) n- T4 Z2 Y! r( r' p& C; f
[Router]display nat session all verbose5 U3 a$ V! l8 ?4 T' O" h/ \
————————————————3 v2 _, p+ ~& {% z3 H- G
版权声明：本文为CSDN博主「友人a笔记」的原创文章，遵循CC 4.0 BY-SA版权协议，转载请附上原文出处链接及本声明。
% N! v1 R, Q; O' v- J- U原文链接：https://blog.csdn.net/tladagio/article/details/80725043
/ I( w H% u( F/ ^, i1 z |
|
发表于 2022-3-15 11:50:24