网络地址转换NAT四种方式及访问控制策略ACL应用.docx
《网络地址转换NAT四种方式及访问控制策略ACL应用.docx》由会员分享，可在线阅读，更多相关《网络地址转换NAT四种方式及访问控制策略ACL应用.docx（8页珍藏版）》请在冰豆网上搜索。
网络地址转换NAT四种方式及访问控制策略ACL应用
NAT实验总结：
在配置静态NAT/动态NAT/NAPT时映射外部地址不能使用外部接口地址，要不会出现IP冲突
网络搭建配置情况
[LSW1]
interfaceVlanif1
ipaddress192.168.1.1255.255.255.0
#
interfaceVlanif2
ipaddress192.168.2.1255.255.255.0
#
interfaceVlanif3
ipaddress172.16.1.1255.255.255.0
#
interfaceVlanif4
ipaddress172.16.2.1255.255.255.0
#
interfaceEthernet0/0/2
portlixxxxnk-typeaccess
portdefaultvlan2
#
interfaceEthernet0/0/3
portlixxxxnk-typeaccess
portdefaultvlan3
#
interfaceEthernet0/0/4
portlixxxxnk-typeaccess
portdefaultvlan4
#
iproute-static0.0.0.00.0.0.0192.168.1.254
#
[AR1]
#
interfaceGigabitEthernet0/0/0
ipaddress192.168.1.254255.255.255.0
#
interfaceGigabitEthernet0/0/1
ipaddress10.0.0.1255.0.0.0
#
rip1
version2
network10.0.0.0
#
iproute-static172.16.0.0255.255.0.0192.168.1.1
iproute-static192.168.0.0255.255.0.0192.168.1.1
#
[AR2]
#
interfaceGigabitEthernet0/0/0
ipaddress10.0.0.2255.0.0.0
#
interfaceGigabitEthernet0/0/1
ipaddress20.0.0.1255.0.0.0
#
rip1
version2
network20.0.0.0
network10.0.0.0
#
[AR3]
#
interfaceGigabitEthernet0/0/0
ipaddress20.0.0.2255.0.0.0
#
interfaceGigabitEthernet0/0/1
ipaddress180.1.1.1255.255.255.0
#
rip1
version2
network20.0.0.0
#
iproute-static0.0.0.00.0.0.010.0.0.1
#
ACL访问控制策略
简单ACL
[LSW1]
#
aclnumber2000
rule1denysource172.16.1.20
#
interfaceEthernet0/0/5
traffic-filteroutboundacl2000
#
高级ACL
[LSW1]
#
aclnumber3000
rule1denyipsource192.168.2.00.0.0.255destination20.0.0.10
#
interfaceEthernet0/0/5
traffic-filteroutboundacl3000
#
静态NAT
[AR1]
#
interfaceGigabitEthernet0/0/1
natstaticglobal10.0.0.3inside192.168.1.2netmask255.255.255.255
natstaticenable
#
验证静态NAT
使用抓包工具可以看到静态映射访问AR3时使用的IP地址是10.0.0.3
动态NAT
[AR1]
#
nataddress-group110.0.0.410.0.0.5
#
aclnumber2000
rule1permitsource192.168.2.00.0.0.255
#
interfaceGigabitEthernet0/0/1
natoutbound2000address-group1
#
验证
NAPT（端口映射）
[AR3]
#
interfaceGigabitEthernet0/0/0
natserverprotocoltcpglobal20.0.0.38080inside180.1.1.2www
#
使用AR1下的http客户端进行访问验证已成功访问
EasyIP
[AR1]
#
aclnumber2001
rule1permitsource172.16.0.00.0.255.255
#
interfaceGigabitEthernet0/0/1
natoutbound2001
#
升级会员 