NAT网络地址转换

NAT网络地址转换

NAT网络地址转化产生背景

• IPV4地址紧缺
• 保证内网的部分安全性

NAT的类型

• 静态NAT（固定IP地址）【应用场景，就是映射内网中某个特定服务，可以使用外网连接进去】
  • 一对一转化，内外网映射（特别是服务器的IP，不让别人用）
  • 端口映射
  • 缺点：配置量大，公网地址要求多

//上图为全网图

访问23.1.1.10地址跳转到192.168.1.1地址

//测试连接状态
[R3]ping 23.1.1.10
  PING 23.1.1.10: 56  data bytes, press CTRL_C to break
    Request time out
    Request time out
    Request time out
    Request time out
    Request time out

  --- 23.1.1.10 ping statistics ---
    5 packet(s) transmitted
    0 packet(s) received
    100.00% packet loss

//global是公网地址，inside 是内网地址
[R2]nat static global 23.1.1.10 inside 192.168.1.1

//你在哪个接口启用
[R2]int g0/0/1
[R2-GigabitEthernet0/0/1]nat static enable 

查看静态nat

[R2]dis nat static 
  Static Nat Information:
  Global Nat Static 
    Global IP/Port     : 23.1.1.10/---- 
    Inside IP/Port     : 192.168.1.1/----
    Protocol : ----     
    VPN instance-name  : ----                            
    Acl number         : ----
    Netmask  : 255.255.255.255 
    Description : ----

  Total :    1

[R3]ping 23.1.1.10
  PING 23.1.1.10: 56  data bytes, press CTRL_C to break
    Reply from 23.1.1.10: bytes=56 Sequence=1 ttl=254 time=20 ms
    Reply from 23.1.1.10: bytes=56 Sequence=2 ttl=254 time=30 ms
    Reply from 23.1.1.10: bytes=56 Sequence=3 ttl=254 time=30 ms
    Reply from 23.1.1.10: bytes=56 Sequence=4 ttl=254 time=30 ms

  --- 23.1.1.10 ping statistics ---
    4 packet(s) transmitted
    4 packet(s) received
    0.00% packet loss
    round-trip min/avg/max = 20/27/30 ms

单独映射telnet地址

//这里可以映射端口
[R2]nat static protocol tcp global 23.1.1.10 23 inside 192.168.1.1 6553
//在哪个接口上开启
[R2]int g0/0/1
[R2-GigabitEthernet0/0/1]nat static enable 

<R3>telnet 192.168.1.1
  Press CTRL_] to quit telnet mode
  Trying 192.168.1.1 ...
  Connected to 192.168.1.1 ...

Login authentication


Username:kk
Password:
  -----------------------------------------------------------------------------     
  User last login information:     
  -----------------------------------------------------------------------------
  Access Type: Telnet      
  IP-Address : 10.1.12.1     
  Time       : 2020-12-22 14:46:08-08:00     
  -----------------------------------------------------------------------------
<R1>

• 动态NAT（还是一个私网IP对于一个公网IP，公网IP随机分配）
  • 使用公网IP地址池，好处：减少配置量
  • 缺点：成本高
  • 配置
    • ACL抓取感兴趣流量
    • 地址池
    • 接口调用

//配置子地址sub
[R1]int l 0
[R1-LoopBack0]ip add 192.168.1.2 32 sub
[R1-LoopBack0]ip add 192.168.1.3 32 sub
[R1-LoopBack0]ip add 192.168.1.4 32 sub
[R1-LoopBack0]ip add 192.168.1.5 32 sub

//配置R2指向R3的默认路由
[R2]ip route-static 0.0.0.0 0 23.1.1.3
//R1指向R2的默认路由
[R1]ip route-static 0.0.0.0 0 10.1.12.2

//R3上配置loopback 114接口
[R3-LoopBack114]dis this
[V200R003C00]
#
interface LoopBack114
 ip address 114.114.114.114 255.255.255.255 
#
return

//R1进行子接口地址测试
[R1]ping -a 192.168.1.2 114.114.114.114
  PING 114.114.114.114: 56  data bytes, press CTRL_C to break
    Request time out
    Request time out
    Request time out
    Request time out
    Request time out

  --- 114.114.114.114 ping statistics ---
    5 packet(s) transmitted
    0 packet(s) received
    100.00% packet loss

1.抓取ACL流量进行访问控制

[R2]acl 2000
[R2-acl-basic-2000]rule 10 permit source 192.168.1.0 0.0.0.255
[R2-acl-basic-2000]rule 20 deny

[R2-acl-basic-2000]dis this
[V200R003C00]
#
acl number 2000  
 rule 10 permit source 192.168.1.0 0.0.0.255 
 rule 20 deny 
#
return

2.配置地址池【这个地址池的公网数量一定要和你的内网IP需求的数量相对应，不然就会有的内网地址没有衣服穿等待】

//配置连续的5个地址，对于loopbacp0的5个地址
[R2]nat address-group 1 23.1.1.11 23.1.1.15

3.哪个接口调用【nat必须在出接口的地方设置】

[R2]int g0/0/1
//2000 是指基础ACL的编号，no-pat是指不使用端口nat，传输层不用
[R2-GigabitEthernet0/0/1]nat outbound 2000 address-group 1 no-pat

4.进行测试

[R1]ping -a 192.168.1.2 114.114.114.114
  PING 114.114.114.114: 56  data bytes, press CTRL_C to break
    Reply from 114.114.114.114: bytes=56 Sequence=1 ttl=254 time=60 ms
    Reply from 114.114.114.114: bytes=56 Sequence=2 ttl=254 time=40 ms
    Reply from 114.114.114.114: bytes=56 Sequence=3 ttl=254 time=30 ms

  --- 114.114.114.114 ping statistics ---
    3 packet(s) transmitted
    3 packet(s) received
    0.00% packet loss
    round-trip min/avg/max = 30/43/60 ms

查看nat表对于的信息

[R2]dis nat session all
  NAT Session Table Information:

     Protocol          : ICMP(1)
     SrcAddr   Vpn     : 192.168.1.3                                    
     DestAddr  Vpn     : 114.114.114.114                                
     Type Code IcmpId  : 0   8   44018
     NAT-Info
       New SrcAddr     : 23.1.1.11      
       New DestAddr    : ----
       New IcmpId      : ----

     Protocol          : ICMP(1)
     SrcAddr   Vpn     : 192.168.1.4                                    
     DestAddr  Vpn     : 114.114.114.114                                
     Type Code IcmpId  : 0   8   44019
     NAT-Info
       New SrcAddr     : 23.1.1.12      
       New DestAddr    : ----
       New IcmpId      : ----

     Protocol          : ICMP(1)
     SrcAddr   Vpn     : 192.168.1.5                                    
     DestAddr  Vpn     : 114.114.114.114                                
     Type Code IcmpId  : 0   8   44020

• 端口NAT【最常用的nat】
• 端口NAT就是一个公网地址，通过不同端口号对应不同的内网地址，默认是从1端口向下类推
  • 单个公网地址通过一个IP地址不同端口号，对于N个私有IP地址
  • 对应关系
    • 公网IP：123.1.1.1
    • PC1：123.1.1.1：1000
    • PC2：123.1.1.1：1001

1.ACL抓取感兴趣流

acl 2000
rule 10 permit source 192.168.1.0 0.0.0.255
rule 20

2.出接口开启

int g0/0/1
nat outbound 2000

该接口下的IP地址作为NAT地址

查看nat表的命令

dis nat session all verbose