NAT地址轉(zhuǎn)換技術(shù)(計算機(jī)網(wǎng)絡(luò)實踐—基于GNS3網(wǎng)絡(luò)模擬器（CISCO技術(shù)）課件)

1、ISBN 978-7-115-36692-4NAT地址轉(zhuǎn)換技術(shù)(計算機(jī)網(wǎng)絡(luò)實踐基于GNS3網(wǎng)絡(luò)模擬器（CISCO技術(shù)）課件)ISBN 978-7-115-36692-4本章目標(biāo)本章目標(biāo)通過本章的學(xué)習(xí)，您應(yīng)該掌握以下內(nèi)容通過本章的學(xué)習(xí)，您應(yīng)該掌握以下內(nèi)容:lNAT的工作原理及的工作原理及PAT的概念的概念.l靜態(tài)靜態(tài)NAT和動態(tài)和動態(tài)NAT.lNAT的配置的配置.ISBN 978-7-115-36692-4ISBN 978-7-115-36692-4ISBN 978-7-115-36692-4ISBN 978-7-115-36692-4ISBN 978-7-115-36692-4ISBN 978

2、-7-115-36692-4ISBN 978-7-115-36692-4復(fù)用內(nèi)部的全局地址復(fù)用內(nèi)部的全局地址將一個內(nèi)部全局地址用于同時代表多個內(nèi)部局部地址。將一個內(nèi)部全局地址用于同時代表多個內(nèi)部局部地址。主要用主要用IP地址和端口號的組合來唯一區(qū)分各個內(nèi)部主機(jī)。地址和端口號的組合來唯一區(qū)分各個內(nèi)部主機(jī)。ISBN 978-7-115-36692-4TCP 負(fù)載均衡負(fù)載均衡10.1.1.2:8010.1.1.1:80NAT table196.168.2.2:80196.168.2.2:80TCPTCP10.1.1.3:80196.168.2.2:80TCPInternetInside10.1.1.

3、1Host B179.20.7.313SA10.1.1.1DA10.1.1.1SA196.168.2.2DA196.168.2.210.1.1.210.1.1.3452Host C179.21.7.3DA196.168.2.24Inside Global IP Address: PortProtocolInside Local IP Address: Port10.1.1.1ISBN 978-7-115-36692-4TCP 負(fù)載均衡負(fù)載均衡 TCP 負(fù)載均衡：用于將一臺虛擬的主機(jī)映射到幾臺真負(fù)載均衡：用于將一臺虛擬的主機(jī)映射到幾臺真實的主機(jī)上。實的主機(jī)上。ISBN 978-7-115-366

4、92-4NAT NAT 二種類型二種類型NATNAT有二種類型：靜態(tài)有二種類型：靜態(tài)NATNAT、動態(tài)、動態(tài)NATNAT。 其中靜態(tài)其中靜態(tài)NATNAT設(shè)置起來最為簡單，內(nèi)部網(wǎng)絡(luò)中的每個主機(jī)都被永設(shè)置起來最為簡單，內(nèi)部網(wǎng)絡(luò)中的每個主機(jī)都被永久映射成外部網(wǎng)絡(luò)中的某個合法的地址久映射成外部網(wǎng)絡(luò)中的某個合法的地址, ,多用于服務(wù)器。多用于服務(wù)器。 而動態(tài)而動態(tài)NATNAT則是在外部網(wǎng)絡(luò)中定義了一系列的合法地址，采用動則是在外部網(wǎng)絡(luò)中定義了一系列的合法地址，采用動態(tài)分配的方法映射到內(nèi)部網(wǎng)絡(luò)態(tài)分配的方法映射到內(nèi)部網(wǎng)絡(luò), ,多用于網(wǎng)絡(luò)中的工作站。多用于網(wǎng)絡(luò)中的工作站。 PAT PAT則是把內(nèi)部地址映射到外

5、部網(wǎng)絡(luò)的一個則是把內(nèi)部地址映射到外部網(wǎng)絡(luò)的一個IPIP地址的不同端口上地址的不同端口上。ISBN 978-7-115-36692-4靜態(tài)靜態(tài)NAT配置命令配置命令 Establishes static translation between an inside local address and an inside global addressRouterX(config)# ip nat inside source static local-ip global-ip Marks the interface as connected to the insideRouterX(config-if

6、)# ip nat inside Marks the interface as connected to the outsideRouterX(config-if)# ip nat outside Displays active translations RouterX# show ip nat translationsISBN 978-7-115-36692-4靜態(tài)靜態(tài)NAT配置配置RouterX# show ip nat translations Pro Inside global Inside local Outside local Outside global - 192.168.1.

7、2 10.1.1.2 - -interface s0ip address 192.168.1.1 255.255.255.0ip nat outside!interface e0ip address 10.1.1.1 255.255.255.0ip nat inside!ip nat inside source static 10.1.1.2 192.168.1.2ISBN 978-7-115-36692-4動態(tài)動態(tài)NAT的配置命令的配置命令 Establishes dynamic source translation, specifying the ACL that was defined

8、in the previous stepRouterX(config)# ip nat inside source listaccess-list-number pool name Defines a pool of global addresses to be allocated as neededRouterX(config)# ip nat pool name start-ip end-ipnetmask netmask | prefix-length prefix-length Defines a standard IP ACL permitting those inside loca

9、l addresses that are to be translatedRouterX(config)# access-list access-list-number permitsource source-wildcard Displays active translationsRouterX# show ip nat translationsISBN 978-7-115-36692-4動態(tài)動態(tài)NAT的配置的配置RouterX# show ip nat translations Pro Inside global Inside local Outside local Outside glo

10、bal - 171.69.233.209 192.168.1.100 - - - 171.69.233.210 192.168.1.101 - -ISBN 978-7-115-36692-4復(fù)用內(nèi)部全局地址的配置復(fù)用內(nèi)部全局地址的配置RouterX# show ip nat translations Pro Inside global Inside local Outside local Outside global TCP 172.17.38.1:1050 192.168.3.7:1050 10.1.1.1:23 10.1.1.1:23 TCP 172.17.38.1:1776 192.16

11、8.4.12:1776 10.2.2.2:25 10.2.2.2:25hostname RouterX!interface Ethernet0 ip address 192.168.3.1 255.255.255.0 ip nat inside!interface Ethernet1 ip address 192.168.4.1 255.255.255.0 ip nat inside!interface Serial0 description To ISP ip address 172.17.38.1 255.255.255.0 ip nat outside!ip nat inside sou

12、rce list 1 interface Serial0 overload!ip route 0.0.0.0 0.0.0.0 Serial0!access-list 1 permit 192.168.3.0 0.0.0.255access-list 1 permit 192.168.4.0 0.0.0.255!ISBN 978-7-115-36692-4NAT調(diào)試調(diào)試Router#sh ip nat transPro Inside global Inside local Outside local Outside globaltcp 192.2.2.1:11003 10.1.1.1:11003

13、 172.16.2.2:23 172.16.2.2:23tcp 192.2.2.1:1067 10.1.1.2:1067 172.16.2.3:23 172.16.2.3:23A translation for a Telnet is still active. Two different inside hosts appear on the outside with a single IP address.Basic IP address translation Unique TCP port numbers are used to distinguishbetween hosts. Rou

14、ter#show ip nat transPro Inside globalInside localOutside local Outside global-192.2.2.110.1.1.1- - -192.2.2.210.1.1.2- -IP address translation with overloadingISBN 978-7-115-36692-4Clearing NAT Translation EntriesAll entries are cleared.192.16.2.2 is cleared.Router#sh ip nat transPro Inside global

15、Inside local Outside local Outside globaltcp 192.16.2.1:11003 10.1.1.1:11003 172.16.2.2:23 172.16.2.2:23tcp 192.16.2.1:1067 10.1.1.2:1067 172.16.2.3:23 172.16.2.3:23router#clear ip nat trans *router#router#show ip nat trans router#show ip nat transPro Inside global Inside local Outside localOutside

16、globaludp 192.16.2.2:1220 10.1.1.2:1120 171.69.2.132:53 171.69.2.132:53 tcp 192.16.2.1:11003 10.1.1.1:11003 172.16.2.2:23 172.16.2.2:23tcp 192.16.2.1:1067 10.1.1.1:1067 172.16.2.3:23 172.16.2.3:23router#clear ip nat trans udp inside 192.16.2.2 10.1.1.2 1220171.69.2.132 53 171.69.2.132 53 router#show

17、 ip nat transPro Inside global Inside local Outside localOutside globaltcp 192.16.2.1:11003 10.1.1.1:11003 172.16.2.2:23 172.16.2.2:23tcp 192.16.2.1:1067 10.1.1.3:1067 172.16.2.3:23 172.16.2.3:23ISBN 978-7-115-36692-4NAT調(diào)試調(diào)試Router#debug ip natNAT: s=10.1.1.1-192.16.2.1, d=172.166.2.2 0NAT*: s=172.16

18、6.2.2, d=192.16.2.1-10.1.1.1 0NAT: s=10.1.1.1-192.16.2.1, d=172.166.2.2 1NAT: s=10.1.1.1-192.16.2.1, d=172.166.2.2 2NAT: s=10.1.1.1-192.16.2.1, d=172.166.2.2 3NAT*: s=172.166.2.2, d=192.16.2.1-10.1.1.1 1NAT: s=10.1.1.1-192.16.2.1, d=172.166.2.2 4NAT: s=10.1.1.1-192.16.2.1, d=172.166.2.2 5NAT: s=10.1.1.1-192.16.2.1, d=172.166.2.2 6NAT*: s=172.166.2.