NAT实验一(静态nat实验)

网友投稿 268 2022-09-17


NAT实验一(静态nat实验)

网络实验拓扑:

配置IP:

iou1:

IOU1(config)#interface ethernet 0/0IOU1(config-if)#ip address 200.1.1.2 255.255.255.0IOU1(config-if)#duplex fullIOU1(config-if)#no shutdownIOU1(config-if)#exIOU1(config)#interface loopback 0IOU1(config-if)#ip address 218.85.152.99 255.255.255.255IOU1(config-if)#ex

iou2:

IOU2(config)#interface ethernet 0/0IOU2(config-if)#duplex fullIOU2(config-if)#ip address 192.168.0.11 255.255.255.0IOU2(config-if)#no shutdownIOU2(config-if)#exIOU2(config)#interface loopback 0IOU2(config-if)#ip address 192.168.1.11 255.255.255.255IOU2(config-if)#ex

iou3:

IOU3(config)#interface ethernet 0/0IOU3(config-if)#duplex fullIOU3(config-if)#ip address 172.16.1.1 255.255.255.0IOU3(config-if)#no shutdownIOU3(config-if)#exIOU3(config)#interface loopback 0IOU3(config-if)#ip address 172.16.88.11 255.255.255.255IOU3(config-if)#ex

asa:

ciscoasa(config)# interface gigabitEthernet 0ciscoasa(config-if)# nameif outsideINFO: Security level for "outside" set to 0 by default.ciscoasa(config-if)# security-level 0ciscoasa(config-if)# ip address 200.1.1.1 255.255.255.0ciscoasa(config-if)# no shuciscoasa(config-if)# exciscoasa(config)# interface gigabitEthernet 1ciscoasa(config-if)# nameif dmzINFO: Security level for "dmz" set to 0 by default.ciscoasa(config-if)# security-level 50ciscoasa(config-if)# ip address 192.168.0.254 255.255.255.0ciscoasa(config-if)# no shuciscoasa(config-if)# exciscoasa(config)# interface gigabitEthernet 2ciscoasa(config-if)# nameif insideINFO: Security level for "inside" set to 100 by default.ciscoasa(config-if)# security-level 100ciscoasa(config-if)# ip address 172.16.1.254 255.255.255.0ciscoasa(config-if)# no shuciscoasa(config-if)# ex

配置默认/静态路由:

iou1:

IOU1(config)#ip route 0.0.0.0 0.0.0.0 200.1.1.1

iou2:

IOU2(config)#ip route 0.0.0.0 0.0.0.0 192.168.0.254

iou3:

IOU3(config)#ip route 0.0.0.0 0.0.0.0 172.16.1.254

asa:

ciscoasa(config)# route outside 0 0 200.1.1.2ciscoasa(config)# route dmz 192.168.1.0 255.255.255.0 192.168.0.11ciscoasa(config)# route inside 172.16.88.0 255.255.255.0 172.16.1.1

配置vty:

iou1:

IOU1(config)#username bdqn privilege 15 password ciscoIOU1(config)#line vty 0 4IOU1(config-line)#login localIOU1(config-line)#transport input telnet

iou2:

IOU2(config)#username bdqn privilege 15 password ciscoIOU2(config)#line vty 0 4IOU2(config-line)#login localIOU2(config-line)#transport input telnet

配置动态NAT:

asa:

ASA(config)# object network out-poolASA(config-network-object)# range 200.1.1.10 200.1.1.20ASA(config-network-object)# exitASA(config)# object network in-ldASA(config-network-object)# subnet 172.16.88.0 255.255.255.0ASA(config-network-object)# exitASA(config)# object network in-xd ASA(config-network-object)# subnet 172.16.1.0 255.255.255.0 ASA(config-network-object)# exitASA(config)# object network dmz-1 ASA(config-network-object)# subnet 192.168.0.0 255.255.255.0ASA(config-network-object)# exitASA(config)# object network dmz-2 ASA(config-network-object)# subnet 192.168.1.0 255.255.255.0ASA(config-network-object)# exitASA(config)# object-group network in-lanASA(config-network-object-group)# network-object object in-ldASA(config-network-object-group)# network-object object in-xdASA(config-network-object-group)# exitASA(config)# object-group network dmz-lanASA(config-network-object-group)# network-object object dmz-1 ASA(config-network-object-group)# network-object object dmz-2ASA(config-network-object-group)# exitASA(config)# nat (inside,outside) source dynamic in-lan out-poolASA(config)# nat (dmz,outside) source dynamic dmz-lan out-pool

测试:

查看:

PAT,多内网架构,多个网段,多个zone,直接使用外网接口:

ASA(config)# nat (inside,outside) source dynamic in-lan interface ASA(config)# nat (dmz,outside) source dynamic dmz-lan interface

PAT,多内网架构使用一个指定外网IP:

ASA(config)# object network out-pat3ASA(config-network-object)# host 200.1.1.3ASA(config-network-object)# exitASA(config)# nat (inside,outside) source dynamic in-ld pat-pool out-pat3ASA(config)# object network out-pool4ASA(config-network-object)# host 200.1.1.4ASA(config-network-object)# exitASA(config)# nat (inside,outside) source dynamic in-xd pat-pool out-pool4

先动态NAT。最后用指定IP做PAT:

ASA(config)# object network out-poolASA(config-network-object)# range 200.1.1.10 200.1.1.20ASA(config-network-object)# exitASA(config)# object network out-pat3ASA(config-network-object)# host 200.1.1.3ASA(config-network-object)# exitASA(config)# object-group network out-natASA(config-network-object-group)# network-object object out-pat3ASA(config-network-object-group)# network-object object out-poolASA(config-network-object-group)# exitASA(config)# nat (inside,outside) source dynamic in-lan out-nat

静态NAT(一对一):

ASA(config)# object network webASA(config-network-object)# host 200.1.1.21ASA(config-network-object)# exitASA(config)# object network dmz-webASA(config-network-object)# host 192.168.1.11ASA(config-network-object)# exitASA(config)# access-list web extended permit tcp any host 192.168.1.11ASA(config)# access-group web in interface outside ASA(config)# nat (dmz,outside) source static dmz-web web

端口一对一:

ASA(config)# object network teldmzASA(config-network-object)# host 200.1.1.22ASA(config-network-object)# exitASA(config)# object network dmz-webASA(config-network-object)# host 192.168.1.11ASA(config-network-object)# exitASA(config)# object service telnetASA(config-service-object)# service tcp source eq telnet ASA(config-service-object)# exitASA(config)# nat (dmz,outside) source static dmz-web teldmz service telnet telnet

实验结束谢谢观看!


版权声明:本文内容由网络用户投稿,版权归原作者所有,本站不拥有其著作权,亦不承担相应法律责任。如果您发现本站中有涉嫌抄袭或描述失实的内容,请联系我们jiasou666@gmail.com 处理,核实后本网站将在24小时内删除侵权内容。

上一篇:cisco防火墙ASA配置NAT(Cisco 防火墙)
下一篇:HCIA-Datacom 网络层_网络层协议(HCIA-Datacom V1.0模拟考试)
相关文章

 发表评论

暂时没有评论,来抢沙发吧~