地址空間管理使用NAT和

PAT擴(kuò)展網(wǎng)絡(luò)IntroducingNATNATallowsprivateuserstoaccesstheInternetbysharingoneormorepublicIPaddresses.TypesofAddressesinNATThesearethemostimportanttypesofaddressesinNAT:Insidelocal:HostontheinsidenetworkInsideglobal:UsuallyassignedbyanISPandallowsthecustomeroutsideaccessOutsideglobal:HostontheoutsidenetworkTypesofAddressesinNAT(Cont.)

TypesofNATThesearethetypesofNAT:StaticNAT:One-to-OneaddressmappingDynamicNAT:Many-to-manyaddressmappingPAT:Many-to-oneaddressmappingUnderstandingStaticNAT

建立內(nèi)部本地地址與內(nèi)部全局地址間的靜態(tài)轉(zhuǎn)換RouterX(config)#ipnatinsidesourcestaticlocal-ip

global-ip將該接口標(biāo)記為連接內(nèi)部網(wǎng)絡(luò)的接口RouterX(config-if)#ipnatinside將該接口標(biāo)記為連接外部網(wǎng)絡(luò)的接口RouterX(config-if)#ipnatoutside顯示活動(dòng)的轉(zhuǎn)換RouterX#showipnattranslations配置和檢驗(yàn)靜態(tài)轉(zhuǎn)換ConfiguringStaticNATExample:ConfiguringstaticNATVerifyingStaticNATConfiguration

UnderstandingDynamicNAT

建立動(dòng)態(tài)源轉(zhuǎn)換，指定上一步定義的ACLRouterX(config)#ipnatinsidesourcelist

access-list-numberpoolname

定義可根據(jù)需要進(jìn)行分配的全局地址池RouterX(config)#ipnatpoolnamestart-ipend-ip

{netmasknetmask|prefix-lengthprefix-length}定義允許那些要被轉(zhuǎn)換的內(nèi)部本地地址的標(biāo)準(zhǔn)IPACLRouterX(config)#access-listaccess-list-numberpermit

source[source-wildcard]顯示活動(dòng)的轉(zhuǎn)換RouterX#showipnattranslations配置和檢驗(yàn)動(dòng)態(tài)轉(zhuǎn)換ConfiguringDynamicNAT

VerifyingDynamicNATConfiguration

UnderstandingPAT

配置過(guò)載建立動(dòng)態(tài)源轉(zhuǎn)換，指定上一步定義的ACLRouterX(config)#ipnatinsidesourcelist

access-list-numberinterfaceinterfaceoverload定義允許那些要被轉(zhuǎn)換的內(nèi)部本地地址的標(biāo)準(zhǔn)IPACLRouterX(config)#access-listaccess-list-numberpermit

source

source-wildcard顯示活動(dòng)的轉(zhuǎn)換RouterX#showipnattranslationsConfiguringPAT

VerifyingPATConfiguration

清除包含內(nèi)部轉(zhuǎn)換或同時(shí)包含內(nèi)部轉(zhuǎn)換與外部轉(zhuǎn)換的簡(jiǎn)單動(dòng)態(tài)轉(zhuǎn)換條目RouterX#clearipnattranslationinsideglobal-ip

local-ip[outsidelocal-ipglobal-ip]清除所有動(dòng)態(tài)地址轉(zhuǎn)換條目RouterX#clearipnattranslation*清除包含外部轉(zhuǎn)換的簡(jiǎn)單動(dòng)態(tài)轉(zhuǎn)換條目RouterX#clearipnattranslationoutside

local-ipglobal-ip清除擴(kuò)展動(dòng)態(tài)轉(zhuǎn)換條目（PAT條目）RouterX#clearipnattranslationprotocolinsideglobal-ip

global-portlocal-iplocal-port[outsidelocal-ip

local-portglobal-ipglobal-port]清除NAT轉(zhuǎn)換表未執(zhí)行轉(zhuǎn)換：轉(zhuǎn)換表中沒(méi)有包含轉(zhuǎn)換檢驗(yàn)：不存在拒絕數(shù)據(jù)包進(jìn)入NAT路由器的入站ACLNAT命令所引用的ACL是否允許所有必需的網(wǎng)絡(luò)NAT池中是否有足夠的地址路由器接口是否被正確定義為NAT內(nèi)部接口或NAT外部接口RouterX#showipnatstatistics

Totalactivetranslations:1(1static,0dynamic;0extended)

Outsideinterfaces:

Ethernet0,Serial2

Insideinterfaces:

Ethernet1

Hits:5Misses:0

…用show和debug命令顯示信息RouterX#debugipnat

NAT:s=192.168.1.95->172.31.233.209,d=172.31.2.132[6825]NAT:s=172.31.2.132,d=172.31.233.209->192.168.1.95[21852]NAT:s=192.168.1.95->172.31.233.209,d=172.31.1.161[6826]NAT*:s=172.31.1.161,d=172.31.233.209->192.168.1.95[23311]NAT*:s=192.168.1.95->172.31.233.209,d=172.31.1.161[6827]NAT*:s=192.168.1.95->172.31.233.209,d=172.31.1.161[6828]NAT*:s=172.31.1.161,d=172.31.233.209->192.168.1.95[23312]NAT*:s=172.31.1.161,d=172.31.233.209->192.168.1.95[23313]執(zhí)行轉(zhuǎn)換：已添加的未使用轉(zhuǎn)換條目檢驗(yàn)：應(yīng)該完成什么樣的NAT配置NAT條目是否準(zhǔn)確地存在于轉(zhuǎn)換表中實(shí)際上是否由監(jiān)控NAT過(guò)程或統(tǒng)計(jì)信息引起轉(zhuǎn)換如果數(shù)據(jù)包從內(nèi)部傳向外部，那么NAT路由器的路由表中是否存在正確的路由所有必需的路由器是否有回到轉(zhuǎn)換后地址的返回路由問(wèn)題示例：無(wú)法Ping通遠(yuǎn)程主機(jī)解決方案：正確的配置總結(jié)有三類NAT：靜態(tài)、動(dòng)態(tài)和過(guò)載(PAT)。靜態(tài)NAT是一