地址空間管理使用NAT和

PAT擴展網(wǎng)絡IntroducingNATNATallowsprivateuserstoaccesstheInternetbysharingoneormorepublicIPaddresses.TypesofAddressesinNATThesearethemostimportanttypesofaddressesinNAT:Insidelocal:HostontheinsidenetworkInsideglobal:UsuallyassignedbyanISPandallowsthecustomeroutsideaccessOutsideglobal:HostontheoutsidenetworkTypesofAddressesinNAT(Cont.)

TypesofNATThesearethetypesofNAT:StaticNAT:One-to-OneaddressmappingDynamicNAT:Many-to-manyaddressmappingPAT:Many-to-oneaddressmappingUnderstandingStaticNAT

建立內(nèi)部本地地址與內(nèi)部全局地址間的靜態(tài)轉(zhuǎn)換RouterX(config)#ipnatinsidesourcestaticlocal-ip

global-ip將該接口標記為連接內(nèi)部網(wǎng)絡的接口RouterX(config-if)#ipnatinside將該接口標記為連接外部網(wǎng)絡的接口RouterX(config-if)#ipnatoutside顯示活動的轉(zhuǎn)換RouterX#showipnattranslations配置和檢驗靜態(tài)轉(zhuǎn)換ConfiguringStaticNATExample:ConfiguringstaticNATVerifyingStaticNATConfiguration

UnderstandingDynamicNAT

建立動態(tài)源轉(zhuǎn)換，指定上一步定義的ACLRouterX(config)#ipnatinsidesourcelist

access-list-numberpoolname

定義可根據(jù)需要進行分配的全局地址池RouterX(config)#ipnatpoolnamestart-ipend-ip

{netmasknetmask|prefix-lengthprefix-length}定義允許那些要被轉(zhuǎn)換的內(nèi)部本地地址的標準IPACLRouterX(config)#access-listaccess-list-numberpermit

source[source-wildcard]顯示活動的轉(zhuǎn)換RouterX#showipnattranslations配置和檢驗動態(tài)轉(zhuǎn)換ConfiguringDynamicNAT

VerifyingDynamicNATConfiguration

UnderstandingPAT

配置過載建立動態(tài)源轉(zhuǎn)換，指定上一步定義的ACLRouterX(config)#ipnatinsidesourcelist

access-list-numberinterfaceinterfaceoverload定義允許那些要被轉(zhuǎn)換的內(nèi)部本地地址的標準IPACLRouterX(config)#access-listaccess-list-numberpermit

source

source-wildcard顯示活動的轉(zhuǎn)換RouterX#showipnattranslationsConfiguringPAT

VerifyingPATConfiguration

清除包含內(nèi)部轉(zhuǎn)換或同時包含內(nèi)部轉(zhuǎn)換與外部轉(zhuǎn)換的簡單動態(tài)轉(zhuǎn)換條目RouterX#clearipnattranslationinsideglobal-ip

local-ip[outsidelocal-ipglobal-ip]清除所有動態(tài)地址轉(zhuǎn)換條目RouterX#clearipnattranslation*清除包含外部轉(zhuǎn)換的簡單動態(tài)轉(zhuǎn)換條目RouterX#clearipnattranslationoutside

local-ipglobal-ip清除擴展動態(tài)轉(zhuǎn)換條目（PAT條目）RouterX#clearipnattranslationprotocolinsideglobal-ip

global-portlocal-iplocal-port[outsidelocal-ip

local-portglobal-ipglobal-port]清除NAT轉(zhuǎn)換表未執(zhí)行轉(zhuǎn)換：轉(zhuǎn)換表中沒有包含轉(zhuǎn)換檢驗：不存在拒絕數(shù)據(jù)包進入NAT路由器的入站ACLNAT命令所引用的ACL是否允許所有必需的網(wǎng)絡NAT池中是否有足夠的地址路由器接口是否被正確定義為NAT內(nèi)部接口或NAT外部接口RouterX#showipnatstatistics

Totalactivetranslations:1(1static,0dynamic;0extended)

Outsideinterfaces:

Ethernet0,Serial2

Insideinterfaces:

Ethernet1

Hits:5Misses:0

…用show和debug命令顯示信息RouterX#debugipnat

NAT:s=192.168.1.95->172.31.233.209,d=172.31.2.132[6825]NAT:s=172.31.2.132,d=172.31.233.209->192.168.1.95[21852]NAT:s=192.168.1.95->172.31.233.209,d=172.31.1.161[6826]NAT*:s=172.31.1.161,d=172.31.233.209->192.168.1.95[23311]NAT*:s=192.168.1.95->172.31.233.209,d=172.31.1.161[6827]NAT*:s=192.168.1.95->172.31.233.209,d=172.31.1.161[6828]NAT*:s=172.31.1.161,d=172.31.233.209->192.168.1.95[23312]NAT*:s=172.31.1.161,d=172.31.233.209->192.168.1.95[23313]執(zhí)行轉(zhuǎn)換：已添加的未使用轉(zhuǎn)換條目檢驗：應該完成什么樣的NAT配置NAT條目是否準確地存在于轉(zhuǎn)換表中實際上是否由監(jiān)控NAT過程或統(tǒng)計信息引起轉(zhuǎn)換如果數(shù)據(jù)包從內(nèi)部傳向外部，那么NAT路由器的路由表中是否存在正確的路由所有必需的路由器是否有回到轉(zhuǎn)換后地址的返回路由問題示例：無法Ping通遠程主機解決方案：正確的配置總結(jié)有三類NAT：靜態(tài)、動態(tài)和過載(PAT)。靜態(tài)NAT是一