CISCONAT配置命令doc.docx
《CISCONAT配置命令doc.docx》由会员分享，可在线阅读，更多相关《CISCONAT配置命令doc.docx（12页珍藏版）》请在冰点文库上搜索。
CISCONAT配置命令doc
CISCONAT配置命令
21.1.在路由器上启用基本的NAT功能
Router#configureterminal
Enterconfigurationcommands,oneperline.EndwithCNTL/Z.
Router（config）#access-list15permit192.168.0.00.0.255.255
Router（config）#ipnatinsidesourcelist15interfaceFastEthernetO/Ooverload
Router（config）#interfaceFastEthernetO/2
Router（config-if）#ipaddress192.168.1.1255.255.255.0
Router（config-if）#ipnatinside
Router（config-if）#exit
Router（config）#interfaceFastEthernetO/1
Router（config-if）#ipaddress192.168.2.1255.255.255.0
Router（config-if）#ipnatinside
Router（config-if）#exit
Router（config）#interfaceEthernetO/O
Router（config-if）#ipaddress172.16.1.5255.255.255.252
Router（config-if）#ipnatoutside
Router（config-if）#exit
Router（config）#end
Router#
注释例子中的配置实现了对地址段192.168.0.0/16访问外部网络重写为172.16.1.5的功能，基本的
地址翻译功能
21.2.动态分配外部地址
Router#configureterminal
Enterconfigurationcommands,oneperline.EndwithCNTL/Z.
Router（config）#access-list15permit192.168.0.00.0.255.255
Router（config）#ipnatpoolNATPOOL172.16.1.100172.16.1.150netmask255.255.255.0
Router（config）#ipnatinsidesourcelist15poolNATPOOL
Router（config）#interfaceFastEthernet0/0
Router（config-if）#ipaddress192.168.1.1255.255.255.0
Router（config-if）#ipnatinside
Router（config-if）#exit
Router（config）#interfaceFastEthernet0/1
Router（config-if）#ipaddress192.16821255.255.255.0
Router（config-if）#ipnatinside
Router（config-if）#exit
Router（config）#interfaceEthernet1/0
Router（config-if）#ipaddress172.16.1.2255.255.255.0
Router（config-if）#ipnatoutside
Router（config-if）#exit
Router（config）#end
Router#
注释ipnatinsidesourcelist15poolNATPOOL定义了翻译出去的地址池，如果地址池可以地址用
完新的翻译将不成功，如果加上了overload参数将会从第一个地址开始翻译进行复用。
另外这里的地址池并不一定要和outside端口的地址在同一网段，只要有相应的路由就可以。
21.3.静态分配外部地址
Router#configureterminal
Enterconfigurationcommands,oneperline.EndwithCNTL/Z.
Router（config）#ipnatinsidesourcestatic192.168.1.15172.16.1.10
Router（config）#ipnatinsidesourcestatic192.168.1.16172.16.1.11
Router（config）#interfaceFastEthernet0/0
Router（config-if）#ipaddress192.168.1.1255.255.255.0
Router（config-if）#ipnatinside
Router（config-if）#exit
Router（config）#interfaceFastEthernet0/1
Router（config-if）#ipaddress192.168.2.1255.255.255.0
Router（config-if）#ipnatinside
Router（config-if）#exit
Router（config）#interfaceEthernet1/0
Router（config-if）#ipaddress172.16.1.2255.255.255.0
Router（config-if）#ipnatoutside
Router（config-if）#exit
Router（config）#end
Router#
21.4.地址静态和动态翻译结合
Router#configureterminal
Enterconfigurationcommands,oneperline.EndwithCNTL/Z.
Router（config）#access-list15deny192.168.1.150.0.0.0
Router（config）#access-list15deny192.168.1.160.0.0.0
Router（config）#access-list15permit192.168.0.00.0.255.255
Router（config）#ipnatinsidesourcestatic192.168.1.15172.16.1.10
Router（config）#ipnatinsidesourcestatic192.168.1.16172.16.1.11
Router（config）#ipnatpoolNATPOOL172.16.1.100172.16.1.150netmask255.255.255.0
Router（config）#ipnatinsidesourcelist15poolNATPOOLoverload
Router（config）#interfaceFastEthernet0/0
Router（config-if）#ipaddress192.168.1.1255.255.255.0
Router（config-if）#ipnatinside
Router（config-if）#exit
Router（config）#interfaceFastEthernet0/1
Router（config-if）#ipaddress192.168.2.1255.255.255.0
Router（config-if）#ipnatinside
Router（config-if）#exit
Router（config）#interfaceEthernet0/0
Router（config-if）#ipaddress172.16.1.2255.255.255.0
Router（config-if）#ipnatoutside
Router（config-if）#exit
Router（config）#end
Router#
注释这里的控制列表把所要静态内部地址排除了，当然这一步也不是必须的，因为静态翻译的优先级要高
于动态翻译的，不过静态翻译的外部地址必须要从动态翻译的地址池中排除。
21.5.使用RouteMaps来进行翻译规则控制
Router1#configureterminal
Enterconfigurationcommands,oneperline.EndwithCNTL/Z.
Router（config）#interfaceFastEthernet0/0
Router（config-if）#ipaddress172.16.1.5255.255.255.252
Router（config-if）#ipnatoutside
Router（config-if）#exit
Router（config）#interfaceFastEthernet0/1
Router（config-if）#ipaddress172.16.2.5255.255.255.252
Router（config-if）#ipnatoutside
Router（config-if）#exit
Router（config）#interfaceFastEthernet0/2
Router（config-if）#ipaddress192.168.1.1255.255.255.0
Router（config-if）#ipnatinside
Router（config-if）#exit
Router（config）#ipnatinsidesourceroute-mapISP-1interface
FastEthernetO/Ooverload
Router（config）#ipnatinsidesourceroute-mapISP-2interface
FastEthernetO/1overload
Router（config）#route-mapISP-1permit10
Router（config-route-map）#matchinterfaceFastEthernet0/0
Router（config-route-map）#exit
Router（config）#route-mapISP-2permit10
Router（config-route-map）#matchinterfaceFastEthernet0/1
Router（config-route-map）#exit
Router（config）#end
Router#
注释适用于多个outside端口的情况
21.6.同时两个方向地址翻译
Router#configureterminal
Enterconfigurationcommands,oneperline.EndwithCNTL/Z.
Router（config）#access-list15deny192.168.1.15
Router（config）#access-list15permit192.168.0.00.0.255.255
Router（config）#access-list16deny172.16.5.25
Router（config）#access-list16permit172.16.0.00.0.255.255
Router（config）#ipnatpoolNATPOOL172.16.1.100172.16.1.150netmask255.255.255.0
Router（config）#ipnatpoolINBOUNDNAT192.168.15.100192.168.15.200netmask255.255.255.0
Router（config）#ipnatinsidesourcelist15poolNATPOOLoverloadRouter（config）#ipnatinsidesourcelist16poolINBOUNDNAToverload
Router（config）#ipnatinsidesourcestatic192.168.1.15172.16.1.10Router（config）#ipnatoutsidesourcestatic172.16.5.25192.168.15.5Router（config）#iproute192.168.15.0255.255.255.0Ethernet0/0Router（config）#interfaceFastEthernet0/0
Router（config-if）#ipaddress192.168.1.1255.255.255.0
Router（config-if）#ipnatinside
Router（config-if）#exit
Router（config）#interfaceFastEthernet0/1
Router（config-if）#ipaddress192.168.2.1255.255.255.0
Router（config-if）#ipnatinside
Router（config-if）#interfaceEthernetO/O
Router（config-if）#ipaddress172.16.1.2255.255.255.0
Router（config-if）#ipnatoutside
Router（config-if）#exit
Router（config）#end
Router#
21.7.网络前缀重写简单的改变某个网络段的前缀
Router#configureterminal
Enterconfigurationcommands,oneperline.EndwithCNTL/Z.Router（config）#ipnatoutsidesourcestaticnetwork172.16.0.0172.17.0.0/16no-alias
Router（config）#iproute172.16.0.0255.255.0.0Ethernet1/0
Router（config）#iproute172.17.0.0255.255.0.0Ethernet1/0Router（config）#interfaceFastEthernet0/0
Router（config-if）#ipaddress10.1.1.1255.255.255.0
Router（config-if）#ipnatinside
Router（config-if）#exit
Router（config）#interfaceEthernet1/0
Router（config-if）#ipaddress172.16.1.6255.255.255.252
Router（config-if）#ipnatoutside
Router（config-if）#exit
Router（config）#end
Router#
注释适用于两个网络互访而地址段冲突的情况
21.8.使用NAT来进行服务器负荷分担
Router#configureterminal
Enterconfigurationcommands,oneperline.EndwithCNTL/Z.
Router（config）#interfaceFastEthernet0/0
Router（config-if）#ipaddress192.168.1.1255.255.255.0
Router（config-if）#ipnatinside
Router（config-if）#exit
Router（config）#interfaceFastEthernet0/1
Router（config-if）#ipaddress192.168.2.1255.255.255.0
Router（config-if）#ipnatoutside
Router（config-if）#exit
Router（config）#ipnatpoolWEBSERVERS192.168.1.101192.168.1.105
netmask255.255.255.0typerotary
Router（config）#access-list20permithost192.168.1.100
Router（config）#ipnatinsidedestinationlist20poolWEBSERVERS
Router（config）#end
Router#
注释这里不同点在于使用了rotary的参数和使用了destination而不是source在翻译规则中，当然这种是穷人的负载均衡解决方案
21.9.基于状态的NAT切换
RouterA
Router-A#configureterminal
Enterconfigurationcommands,oneperline.EndwithCNTL/Z.
Router-A（config）#access-list11permitany
Router-A（config）#ipnatpoolNATPOOL172.17.100.100172.17.100.150netmask255.255.255.0
Router-A（config）#ipnatinsidesourcelist11poolNATPOOLmapping-id1
Router-A（config）#interfaceFastEthernet0/0
Router-A（config-if）#ipaddress192.168.1.3255.255.255.0
Router-A（config-if）#ipnatinside
Router-A（config-if）#standby1ip192.168.1.1
Router-A（config-if）#standby1preempt
Router-A（config-if）#standby1nameSNATGROUP
Router-A（config-if）#exit
Router-A（config）#interfaceSerial0/0
Router-A（config-if）#ipaddress172.17.55.2255.255.255.252
Router-A（config-if）#ipnatoutside
Router-A（config-if）#exit
Router-A（config）#ipnatStatefulid1
Router-A（config-ipnat-snat）#redundancySNATGROUP
Router（config-ipnat-snat-red）#mapping-id1
Router（config-ipnat-snat-red）#exit
Router-A（config）#end
Router-A#
Router-B#configureterminal
Enterconfigurationcommands,oneperline.EndwithCNTL/Z.
Router-B（config）#access-list11permitany
Router-B（config）#ipnatpoolNATPOOL172.17.100.100172.17.100.150
netmask255.255.255.0
Router-B（config）#ipnatinsidesourcelist11poolNATPOOLmapping-id1
Router-B（config）#interfaceFastEthernet0/0
Router-B（config-if）#ipaddress192.168.1.2255.255.255.0
Router-B（config-if）#ipnatinside
Router-B（config-if）#standby1ip192.168.1.1
Router-B（config-if）#standby1priority90
Router-B（config-if）#standby1preempt
Router-B（config-if）#standby1nameSNATGROUP
Router-B（config-if）#exit
Router-B（config）#interfaceSerial0/0
Router-B（config-if）#ipaddress172.17.55.6255.255.255.252
Router-B（config-if）#ipnatoutside
Router-B（config-if）#exit
Router-B（config）#ipnatStatefulid1
Router-B（config-ipnat-snat）#redundancySNATGROUP
Router（config-ipnat-snat-red）#mapping-id1
Router（config-ipnat-snat-red）#exit
Router-B（config）#end
Router-B#
注释虽然说通过使用HSRP
升级会员 