¹¦Ð§ÏÈÈÝ£º

µ±ÎÒÃÇÄÚ²¿Óм¸Ì¨ÌṩÏàͬ·þÎñµÄ·þÎñÆ÷ʱ£¬ÎÒÃÇ¿ÉÒÔÓÃNATÀ´×öµ½¸ºÔØƽºâ£»¸Ã¹¦Ð§Ò²³ÆΪTCP¸ºÔØƽºâÊÖÒÕ
¡£

Ò»¡¢×éÍøÐèÇó

ÄÚÍø·þÎñÆ÷µÄµØַͨ¹ý¾²Ì¬NAT£¬×ª»»³ÉÏàͬµÄÍâÍøµÄµØÖ·£¬ÍâÍø»á¼û¸Ã·þÎñÆ÷ʱ£¬¿ÉÒÔͨ¹ýNATʵÏÖ¸ºÔØƽºâ
¡£ 

¶þ¡¢×éÍøÍØÆË

Èý¡¢ÉèÖÃÒªµã

1¡¢»ù±¾ipµØÖ·ÉèÖÃ

2¡¢»ù±¾µÄip·ÓÉÉèÖÃ

3¡¢½ç˵natµÄÄÚÍø¿ÚºÍÍâÍø¿Ú

4¡¢Í¨¹ýACLÆ¥ÅäÍâÍø»á¼ûÄÚÍø·þÎñÆ÷µÄÁ÷Á¿

5¡¢ÉèÖ÷þÎñÆ÷µÄµØÖ·³Ø

6¡¢ÉèÖÃÄ¿µÄµØַת»» 

ËÄ¡¢ÉèÖð취

1¡¢»ù±¾ipµØÖ·ÉèÖÃ

Ruijie(config)#hostname R1

R1(config)#interface gigabitEthernet 0/0

R1(config-GigabitEthernet 0/0)#ip address 192.168.1.1 255.255.255.0

R1(config-GigabitEthernet 0/0)#exit

R1(config)#interface gigabitEthernet 0/1

R1(config-GigabitEthernet 0/2)#ip address 192.168.2.1 255.255.255.0

R1(config-GigabitEthernet 0/2)#exit

Ruijie(config)#hostname R2

R2(config)#interface fastEthernet 0/0

R2(config-if-FastEthernet 0/0)#ip address 192.168.2.2 255.255.255.0

R2(config-if-FastEthernet 0/0)#exit

2¡¢»ù±¾µÄip·ÓÉÉèÖÃ

R2(config)#ip route 192.168.10.0 255.255.255.0 192.168.2.1      //ÉèÖÃÍâÍøµ½·þÎñÆ÷¹«ÍøµØÖ·µÄ·ÓÉ

3¡¢½ç˵natµÄÄÚÍø¿ÚºÍÍâÍø¿Ú

R1(config)#interface gigabitEthernet 0/1

R1(config-GigabitEthernet 0/1)#ip nat outside      //ÉèÖÃnatµÄÍâÍø¿Ú

R1(config-GigabitEthernet 0/1)#exit

R1(config)#int gigabitEthernet 0/0

R1(config-GigabitEthernet 0/0)#ip nat inside     //ÉèÖÃnatµÄÄÚÍø¿Ú

R1(config-GigabitEthernet 0/0)#exit

4¡¢Í¨¹ýACLÆ¥ÅäÍâÍø»á¼ûÄÚÍø·þÎñÆ÷µÄÁ÷Á¿

R1(config)#ip access-list extended 100

R1(config-ext-nacl)#10 permit ip any host 192.168.10.168     //ÍâÍøµ½·þÎñÆ÷¹«ÍøµØÖ·£¨192.168.10.168£©µÄÁ÷Á¿

R1(config-ext-nacl)#exit

×¢ÖØ£º

1£©ÎÒ˾µÄTCP¸ºÔØƽºâÖÐÖ»Ö§³ÖÀ©Õ¹ACLÉèÖ㬲»Ö§³Ö±ê×¼ACLÉèÖÃ
¡£

2£©·þÎñÆ÷ÍâÍøIPµØÖ·Ñ¡Ôñ

ÔÚTCP¸ºÔØƽºâµÄÉèÖÃÖУ¬ÈôÊÇ·þÎñÆ÷Ó³ÉäµÄÍâÍøIPÑ¡ÔñÓëÍâÍø¿ÚIPͬÍø¶ÎµÄÆäËüIPµØÖ·£¬»áÓÉÓÚ×°±¸²î³Ø¸ÃIPµØÖ·µÄARPÇëÇó¾ÙÐлØÓ¦¶øµ¼ÖÂÓ³ÉäʧЧ£¨×°±¸»áÒÔΪÕâÊÇһ̨Óë±¾³ö¿ÚÔÚͳһÍø¶ÎµÄÆäËü×°±¸µØÖ·£¬¶ø²»ÊÇ×ÔÉíµÄµØÖ·£¬Òò´Ë²î³Ø¸ÃIPµØÖ·µÄARPÇëÇó¾ÙÐлØÓ¦£©£»Òò´ËTCP¸ºÔØƽºâÖ»Ö§³ÖÓ³ÉäΪÍâÍø¿Ú³ö¿ÚIPµØÖ·»òÆäËüÍø¶ÎµÄIPµØÖ·£¬²»¿ÉÓ³ÉäΪÓë³ö½Ó¿ÚͬÍø¶ÎµÄÆäËüIPµØÖ·
¡£ÈçÒÔÉÏÀý×ÓÖУ¬¿ÉÒÔ½«Á½Ì¨·þÎñÆ÷Ó³ÉäÖÁ192.168.2.1£¬»òÆäËüÍø¶ÎµØÖ·£¨Èç192.168.10.0/24£©£»µ«ÎÞ·¨Ó³ÉäΪ192.168.2.0/24£¨Óë³ö¿ÚͬÍø¶ÎµÄÆäËüµØÖ·£©
¡£

5¡¢ÉèÖ÷þÎñÆ÷µÄµØÖ·³Ø

R1(config)#ip nat pool server 192.168.1.100 192.168.1.101 netmask 255.255.255.0 type rotary     //½ç˵ÃûΪserverµÄµØÖ·³Ø£¬µØÖ·³ØÀàÐÍΪrotary£¨Ñ­»·£©£¬ÔÚ×öÄ¿µÄnatת»»Ê±£¬Ñ­»·×ª»»ÎªÄÚÍø·þÎñÆ÷µÄµØÖ·

6¡¢ÉèÖÃÄ¿µÄµØַת»»

R1(config)#ip nat inside destination list 100 pool server      //½«acl 100µÄÁ÷Á¿£¬±¨ÎĵÄÄ¿µÄµØַת»»³ÉserverµØÖ·³ØµÄµØÖ·

×¢ÖØ£º

1£©Â·ÓÉÆ÷²»¼ì²âÄÚÍø·þÎñÆ÷µÄ¿ÉÓÃÐÔ

ÈôÊÇÄÚÍø·þÎñÆ÷ȺÀïÓÐһ̨»ò¶ą̀¡¢ÉõÖÁÊÇËùÓзþÎñÆ÷¶¼²»ÊÂÇéÁË£¬ÓÉÓÚ·ÓÉÆ÷ÉÏûÓÐÏà¹Ø¼ì²â·þÎñÆ÷ÊÇ·ñÕý³£ÊÂÇéµÄ¹¦Ð§£¬Òò´Ë·ÓÉÆ÷ÊÇÎÞ·¨ÅжÏÄÚÍø·þÎñÆ÷µÄ¿ÉÓÃÐÔ£¬ÒÀ¾É»á½«Á÷Á¿¾ÙÐиºÔØƽºâ£¬¶ø²»¹Ü·þÎñÆ÷ÄÜ·ñÓ¦´ð
¡£

2£©Ö»¶ÔTCPÁ÷Á¿¾ÙÐÐת»»

Ö»¶ÔTCPÁ÷Á¿¾ÙÐÐת»»£¬²»»á¶ÔICMPµÈÆäËüЭÒé¾ÙÐÐת»»
¡£

3£©ÎÒ˾װ±¸¾ÙÐÐTCP¸ºÔØƽºâʱ£¬ÊÇ»ùÓÚÔ´ipµØÖ·µÄhashÖµ¾ÙÐиºÔØƽºâ£¬ÈôÍâÍø2¸öip»á¼ûûÓÐʵÏÖ¸ºÔØƽºâ£¬ÊÇÓÉÓÚÕâ2¸öipµØÖ·µÄhashÖµÒ»Ñù£¬¿ÉÒÔʵÑé±ä»»ÍâÍøipµØÖ·×ö²âÊÔ
¡£ 

Îå¡¢ÉèÖÃÑéÖ¤

»®·Ö²âÊÔ¶à¸öÍâÍøPC»á¼û·þÎñÆ÷µÄ¹«ÍøµØÖ·£¬ÈôµÚÒ»PC»á¼û¸Ã·þÎñÆ÷ʱת»»³É192.168.1.100µÄÄÚÍøµØÖ·£¬µÚ¶þPC»á¼û¸Ã·þÎñÆ÷ʱת»»³É192.168.1.101µÄÄÚÍøµØÖ·£¬ÔòNATÖØ´óƽºâÉèÖÃ׼ȷ
¡£

µÚÒ»¸öPC»á¼û·þÎñÆ÷ʱ£¬»á¼ûµ½server-1£¬Éó²énatת»»±íÈçÏÂ

R2#telnet 192.168.10.168

Trying 192.168.10.168, 23...

server-1>

R1#show ip nat translations

Pro Inside global            Inside local            Outside local          Outside global

tcp 192.168.10.168:23  192.168.1.100:23   192.168.2.2:1052   192.168.2.2:1052

µÚ¶þ¸öPC»á¼û·þÎñÆ÷ʱ£¬»á¼ûµ½server-2£¬Éó²énatת»»±íÈçÏÂ

R4#telnet 192.168.10.168

Trying 192.168.10.168, 23...

server-2>

R1#show ip nat translations

Pro Inside global            Inside local             Outside local          Outside global

tcp 192.168.10.168:23  192.168.1.101:23   192.168.2.3:1053   192.168.2.3:1053