CCNA培訓(xùn)教學(xué)課件：15-NAT

NAT(網(wǎng)絡(luò)地址轉(zhuǎn)換)SPOTOKMS為什么需要NATIPv4地址緊缺私有地址Internet公有地址IP:8.8.8.8什么是NATNAT(NetworkAddressTranslation)私有地址Internet公有地址IP:8.8.8.8私有IPv4地址私有地址空間10.0.0.0-10.255.255.255

172.16.0.0-172.31.255.255

192.168.0.0-192.168.255.255NAT術(shù)語(yǔ)內(nèi)部本地轉(zhuǎn)換之前內(nèi)部源地址的名字外部本地轉(zhuǎn)換之前目標(biāo)主機(jī)的名字內(nèi)部全局轉(zhuǎn)換之后內(nèi)部主機(jī)的名字外部全局轉(zhuǎn)換之后外部目標(biāo)主機(jī)的名字內(nèi)部本地Internet內(nèi)部全局外部全局外部本地insideoutsideoutsideinsideNAT三種類型1靜態(tài)NAT將內(nèi)部本地地址與內(nèi)部全局地址進(jìn)行一對(duì)一的明確轉(zhuǎn)換。這種方法主要用在內(nèi)部網(wǎng)絡(luò)中有對(duì)外提供服務(wù)的服務(wù)器，如WEB、MAIL服務(wù)器時(shí)。該方法的缺點(diǎn)是需要獨(dú)占寶貴的合法IP地址。即，如果某個(gè)合法IP地址已經(jīng)被NAT靜態(tài)地址轉(zhuǎn)換定義，即使該地址當(dāng)前沒(méi)有被使用，也不能被用作其它的地址轉(zhuǎn)換。NAT三種類型1靜態(tài)NAT192.168.1.1SA192.168.1.1DA56.101.200.1SA202.101.100.1DA56.101.200.1InsideLocaladdressInsideGlobalAddress192.168.1.1202.101.100.156.101.200.1insideNAT三種類型2動(dòng)態(tài)NAT動(dòng)態(tài)地址轉(zhuǎn)換也是將內(nèi)部本地地址與內(nèi)部全局地址進(jìn)行一對(duì)一的轉(zhuǎn)換。但是，是從內(nèi)部全局地址池中動(dòng)態(tài)地選擇一個(gè)未使用的地址對(duì)內(nèi)部本地地址進(jìn)行轉(zhuǎn)換。該地址是由未被使用的地址組成的地址池中在定義時(shí)排在最前面的一個(gè)。當(dāng)數(shù)據(jù)傳輸完畢后，路由器將把使用完的內(nèi)部全局地址放回到地址池中，以供其它內(nèi)部本地地址進(jìn)行轉(zhuǎn)換。但是在該地址被使用時(shí)，不能用該地址再進(jìn)行一次轉(zhuǎn)換。NAT三種類型2動(dòng)態(tài)NAT192.168.1.1SA192.168.1.1DA56.101.200.1SA202.101.100.1DA56.101.200.1InsideLocaladdressInsideGlobalAddress192.168.1.1202.101.100.156.101.200.1ipnatpoolxx202.101.100.1–202.101.100.10insideNAT三種類型3端口復(fù)用復(fù)用地址轉(zhuǎn)換也稱為端口地址轉(zhuǎn)換（PortAddressTranslation，PAT），首先是一種動(dòng)態(tài)地址轉(zhuǎn)換。路由器將通過(guò)記錄地址、應(yīng)用程序端口等唯一標(biāo)識(shí)一個(gè)轉(zhuǎn)換。通過(guò)這種轉(zhuǎn)換，可以使多個(gè)內(nèi)部本地地址同時(shí)與同一個(gè)內(nèi)部全局地址進(jìn)行轉(zhuǎn)換并對(duì)外部網(wǎng)絡(luò)進(jìn)行訪問(wèn)。對(duì)于只申請(qǐng)到少量IP地址甚至只有一個(gè)合法IP地址，卻經(jīng)常有很多用戶同時(shí)要求上網(wǎng)的情況，這種轉(zhuǎn)換方式非常有用理想狀況下，一個(gè)單一的IP地址可以使用的端口數(shù)為4000個(gè)NAT三種類型3端口復(fù)用192.168.1.1SA192.168.1.1:1723DA56.101.200.1:23SA202.101.100.1:1723DA56.101.200.1:23InsideLocalAddressPortInsideGlobalAddressPortOutsideGlobalAddressPort192.168.1.1:1723202.101.100.1:172356.101.200.1:2356.101.200.1insideEstablishesstatictranslationbetweenaninsidelocaladdressandan

insideglobaladdressRouter(config)#ipnatinsidesourcestaticlocal-ipglobal-ipMarkstheinterfaceasconnectedtotheinsideRouter(config-if)#ipnatinsideMarkstheinterfaceasconnectedtotheoutsideRouter(config-if)#ipnatoutsideDisplaysactivetranslationsRouter#showipnattranslations配置靜態(tài)NAT轉(zhuǎn)換配置靜態(tài)NAT轉(zhuǎn)換192.168.1.1SA192.168.1.1SA202.101.100.1InsideF0/0Internetipnatinsidesourcestatic192.168.1.1202.101.100.1interfaces1/0ipnatoutsideinterfacef0/0ipnatinsideRouter#showipnattranslations

ProInsideglobalInsidelocalOutsidelocalOutsideglobal

---202.101.100.1

192.168.1.1------S1/0建立動(dòng)態(tài)轉(zhuǎn)換源和ACL匹配網(wǎng)段的關(guān)聯(lián)Router(config)#ipnatinsidesourcelistaccess-list-numberpoolname定義一個(gè)地址池Router(config)#ipnatpoolnamestart-ipend-ip

{netmasknetmask|prefix-lengthprefix-length}使用ACL匹配需要配轉(zhuǎn)換的網(wǎng)段Router(config)#access-listaccess-list-numberpermitsource[source-wildcard]顯示轉(zhuǎn)換表Router#showipnattranslations配置動(dòng)態(tài)NAT轉(zhuǎn)換配置動(dòng)態(tài)NAT轉(zhuǎn)換192.168.1.1SA192.168.1.1SA202.101.100.1InsideF0/0Internetipnatpoolnat1202.101.100.1202.101.100.10netmask255.255.255.0access-list1permit192.168.1.00.0.0.255ipnatinsidesourcelist1poolnat1interfaces1/0ipnatoutsideinterfacef0/0ipnatinsideRouter#showipnattranslations

ProInsideglobal

Insidelocal

OutsidelocalOutsideglobal

---171.69.233.209192.168.1.100------S1/0pool配置PAT地址轉(zhuǎn)換(Overloading)Establishesdynamicsourcetranslation,specifyingtheACLthatwas

definedinthepreviousstepRouter(config)#ipnatinsidesourcelist

access-list-numberinterfaceinterfaceoverloadDefinesastandardIPACLthatwillpermittheinsidelocaladdresses

thataretobetranslatedRouter(config)#access-listaccess-list-numberpermit

sourcesource-wildcardDisplaysactivetranslationsRouter#showipnattranslations配置PAT地址轉(zhuǎn)換(Overloading)Interfacef0/0ipnatinsideinterfaceSerial1/0ipnatoutsideipnatinsidesourcelist1interfaceSerial1/0overload!iproute0.0.0.00.0.0.0Serial0!access-list1permit192.168.1.00.0.0.255Router#showipnattranslations

ProInsideglobalInsidelocalOutsidelocalOutsideglobal

TCP172.17.38.1:1050192.168.1.1:1050211.21.12.1:23211.21.12.1:23192.168.1.1InsideF0/0InternetS1/0Clearsasimpledynamictranslationentrythatcontainsaninside

translationorbothaninsideandoutsidetranslation

Router#clearipnattranslationinsideglobal-ip

local-ip[outsidelocal-ipglobal-ip]ClearsalldynamicaddresstranslationentriesRouter#clearipnattranslation*Clearsasimpledynamictranslationentrythatcontainsanoutside

translationRouter#clearipnattranslati