¹¦Ð§ÏÈÈÝ£º

µ±ÎÒÃÇÄÚ²¿Óм¸Ì¨ÌṩÏàͬ·þÎñµÄ·þÎñÆ÷ʱ
£¬ÎÒÃÇ¿ÉÒÔÓÃNATÀ´×öµ½¸ºÔØƽºâ£»¸Ã¹¦Ð§Ò²³ÆΪTCP¸ºÔØƽºâÊÖÒÕ¡£

Ò»¡¢×éÍøÐèÇó

ÄÚÍø·þÎñÆ÷µÄµØַͨ¹ý¾²Ì¬NAT
£¬×ª»»³ÉÏàͬµÄÍâÍøµÄµØÖ·
£¬ÍâÍø»á¼û¸Ã·þÎñÆ÷ʱ
£¬¿ÉÒÔͨ¹ýNATʵÏÖ¸ºÔØƽºâ¡£ 

¶þ¡¢×éÍøÍØÆË

Èý¡¢ÉèÖÃÒªµã

1¡¢»ù±¾ipµØÖ·ÉèÖÃ

2¡¢»ù±¾µÄip·ÓÉÉèÖÃ

3¡¢½ç˵natµÄÄÚÍø¿ÚºÍÍâÍø¿Ú

4¡¢Í¨¹ýACLÆ¥ÅäÍâÍø»á¼ûÄÚÍø·þÎñÆ÷µÄÁ÷Á¿

5¡¢ÉèÖ÷þÎñÆ÷µÄµØÖ·³Ø

6¡¢ÉèÖÃÄ¿µÄµØַת»» 

ËÄ¡¢ÉèÖð취

1¡¢»ù±¾ipµØÖ·ÉèÖÃ

Ruijie(config)#hostname R1

R1(config)#interface gigabitEthernet 0/0

R1(config-GigabitEthernet 0/0)#ip address 192.168.1.1 255.255.255.0

R1(config-GigabitEthernet 0/0)#exit

R1(config)#interface gigabitEthernet 0/1

R1(config-GigabitEthernet 0/2)#ip address 192.168.2.1 255.255.255.0

R1(config-GigabitEthernet 0/2)#exit

Ruijie(config)#hostname R2

R2(config)#interface fastEthernet 0/0

R2(config-if-FastEthernet 0/0)#ip address 192.168.2.2 255.255.255.0

R2(config-if-FastEthernet 0/0)#exit

2¡¢»ù±¾µÄip·ÓÉÉèÖÃ

R2(config)#ip route 192.168.10.0 255.255.255.0 192.168.2.1      //ÉèÖÃÍâÍøµ½·þÎñÆ÷¹«ÍøµØÖ·µÄ·ÓÉ

3¡¢½ç˵natµÄÄÚÍø¿ÚºÍÍâÍø¿Ú

R1(config)#interface gigabitEthernet 0/1

R1(config-GigabitEthernet 0/1)#ip nat outside      //ÉèÖÃnatµÄÍâÍø¿Ú

R1(config-GigabitEthernet 0/1)#exit

R1(config)#int gigabitEthernet 0/0

R1(config-GigabitEthernet 0/0)#ip nat inside     //ÉèÖÃnatµÄÄÚÍø¿Ú

R1(config-GigabitEthernet 0/0)#exit

4¡¢Í¨¹ýACLÆ¥ÅäÍâÍø»á¼ûÄÚÍø·þÎñÆ÷µÄÁ÷Á¿

R1(config)#ip access-list extended 100

R1(config-ext-nacl)#10 permit ip any host 192.168.10.168     //ÍâÍøµ½·þÎñÆ÷¹«ÍøµØÖ·£¨192.168.10.168£©µÄÁ÷Á¿

R1(config-ext-nacl)#exit

×¢ÖØ£º

1£©ÎÒ˾µÄTCP¸ºÔØƽºâÖÐÖ»Ö§³ÖÀ©Õ¹ACLÉèÖÃ
£¬²»Ö§³Ö±ê×¼ACLÉèÖá£

2£©·þÎñÆ÷ÍâÍøIPµØÖ·Ñ¡Ôñ

ÔÚTCP¸ºÔØƽºâµÄÉèÖÃÖÐ
£¬ÈôÊÇ·þÎñÆ÷Ó³ÉäµÄÍâÍøIPÑ¡ÔñÓëÍâÍø¿ÚIPͬÍø¶ÎµÄÆäËüIPµØÖ·
£¬»áÓÉÓÚ×°±¸²î³Ø¸ÃIPµØÖ·µÄARPÇëÇó¾ÙÐлØÓ¦¶øµ¼ÖÂÓ³ÉäʧЧ£¨×°±¸»áÒÔΪÕâÊÇһ̨Óë±¾³ö¿ÚÔÚͳһÍø¶ÎµÄÆäËü×°±¸µØÖ·
£¬¶ø²»ÊÇ×ÔÉíµÄµØÖ·
£¬Òò´Ë²î³Ø¸ÃIPµØÖ·µÄARPÇëÇó¾ÙÐлØÓ¦£©£»Òò´ËTCP¸ºÔØƽºâÖ»Ö§³ÖÓ³ÉäΪÍâÍø¿Ú³ö¿ÚIPµØÖ·»òÆäËüÍø¶ÎµÄIPµØÖ·
£¬²»¿ÉÓ³ÉäΪÓë³ö½Ó¿ÚͬÍø¶ÎµÄÆäËüIPµØÖ·¡£ÈçÒÔÉÏÀý×ÓÖÐ
£¬¿ÉÒÔ½«Á½Ì¨·þÎñÆ÷Ó³ÉäÖÁ192.168.2.1
£¬»òÆäËüÍø¶ÎµØÖ·£¨Èç192.168.10.0/24£©£»µ«ÎÞ·¨Ó³ÉäΪ192.168.2.0/24£¨Óë³ö¿ÚͬÍø¶ÎµÄÆäËüµØÖ·£©¡£

5¡¢ÉèÖ÷þÎñÆ÷µÄµØÖ·³Ø

R1(config)#ip nat pool server 192.168.1.100 192.168.1.101 netmask 255.255.255.0 type rotary     //½ç˵ÃûΪserverµÄµØÖ·³Ø
£¬µØÖ·³ØÀàÐÍΪrotary£¨Ñ­»·£©
£¬ÔÚ×öÄ¿µÄnatת»»Ê±
£¬Ñ­»·×ª»»ÎªÄÚÍø·þÎñÆ÷µÄµØÖ·

6¡¢ÉèÖÃÄ¿µÄµØַת»»

R1(config)#ip nat inside destination list 100 pool server      //½«acl 100µÄÁ÷Á¿
£¬±¨ÎĵÄÄ¿µÄµØַת»»³ÉserverµØÖ·³ØµÄµØÖ·

×¢ÖØ£º

1£©Â·ÓÉÆ÷²»¼ì²âÄÚÍø·þÎñÆ÷µÄ¿ÉÓÃÐÔ

ÈôÊÇÄÚÍø·þÎñÆ÷ȺÀïÓÐһ̨»ò¶ą̀¡¢ÉõÖÁÊÇËùÓзþÎñÆ÷¶¼²»ÊÂÇéÁË
£¬ÓÉÓÚ·ÓÉÆ÷ÉÏûÓÐÏà¹Ø¼ì²â·þÎñÆ÷ÊÇ·ñÕý³£ÊÂÇéµÄ¹¦Ð§
£¬Òò´Ë·ÓÉÆ÷ÊÇÎÞ·¨ÅжÏÄÚÍø·þÎñÆ÷µÄ¿ÉÓÃÐÔ
£¬ÒÀ¾É»á½«Á÷Á¿¾ÙÐиºÔØƽºâ
£¬¶ø²»¹Ü·þÎñÆ÷ÄÜ·ñÓ¦´ð¡£

2£©Ö»¶ÔTCPÁ÷Á¿¾ÙÐÐת»»

Ö»¶ÔTCPÁ÷Á¿¾ÙÐÐת»»
£¬²»»á¶ÔICMPµÈÆäËüЭÒé¾ÙÐÐת»»¡£

3£©ÎÒ˾װ±¸¾ÙÐÐTCP¸ºÔØƽºâʱ
£¬ÊÇ»ùÓÚÔ´ipµØÖ·µÄhashÖµ¾ÙÐиºÔØƽºâ
£¬ÈôÍâÍø2¸öip»á¼ûûÓÐʵÏÖ¸ºÔØƽºâ
£¬ÊÇÓÉÓÚÕâ2¸öipµØÖ·µÄhashÖµÒ»Ñù
£¬¿ÉÒÔʵÑé±ä»»ÍâÍøipµØÖ·×ö²âÊÔ¡£ 

Îå¡¢ÉèÖÃÑéÖ¤

»®·Ö²âÊÔ¶à¸öÍâÍøPC»á¼û·þÎñÆ÷µÄ¹«ÍøµØÖ·
£¬ÈôµÚÒ»PC»á¼û¸Ã·þÎñÆ÷ʱת»»³É192.168.1.100µÄÄÚÍøµØÖ·
£¬µÚ¶þPC»á¼û¸Ã·þÎñÆ÷ʱת»»³É192.168.1.101µÄÄÚÍøµØÖ·
£¬ÔòNATÖØ´óƽºâÉèÖÃ׼ȷ¡£

µÚÒ»¸öPC»á¼û·þÎñÆ÷ʱ
£¬»á¼ûµ½server-1
£¬Éó²énatת»»±íÈçÏÂ

R2#telnet 192.168.10.168

Trying 192.168.10.168, 23...

server-1>

R1#show ip nat translations

Pro Inside global            Inside local            Outside local          Outside global

tcp 192.168.10.168:23  192.168.1.100:23   192.168.2.2:1052   192.168.2.2:1052

µÚ¶þ¸öPC»á¼û·þÎñÆ÷ʱ
£¬»á¼ûµ½server-2
£¬Éó²énatת»»±íÈçÏÂ

R4#telnet 192.168.10.168

Trying 192.168.10.168, 23...

server-2>

R1#show ip nat translations

Pro Inside global            Inside local             Outside local          Outside global

tcp 192.168.10.168:23  192.168.1.101:23   192.168.2.3:1053   192.168.2.3:1053