一、實驗目標
- 理解NAT網絡地址轉換的原理及功能；
- 掌握NAPT的配置，實現局域網訪問互聯網；
二、實驗背景
公司辦公網需要接入互聯網，公司只向ISP申請了一條專線，該專線分配了一個公網IP地址，配置實現全公司的主機都能訪問外網。
三、技術原理
- NAT將網絡划分為內部網絡和外部網絡兩部分，局域網主機利用NAT訪問網絡時，是將局域網內部的本地地址轉換為全局地址（互聯網合法的IP地址）后轉發數據包；
- NAT分為兩種類型：NAT（網絡地址轉換）和NAPT（網絡端口地址轉換IP地址對應一個全局地址）。
- NAPT：使用不同的端口來映射多個內網IP地址到一個指定的外網IP地址，多對一。
- NAPT采用端口多路復用方式。內部網絡的所有主機均可共享一個合法外部IP地址實現對Internet的訪問，從而可以最大限度節約IP地址資源。同時，又可隱藏網絡內部的所有主機，有效避免來自Internet的攻擊。因此，目前網絡中應用最多的就是端口多路復用方式。
四、實驗步驟
實驗拓撲
1、R1為公司出口路由器，其與ISP路由器之間通過V.35電纜串口連接，DCE端連接在R1上，配置其時鍾頻率為64000；
2、配置PC機、服務器及路由器接口IP地址；
3、在各路由器上配置靜態路由協議，讓PC間能相互ping通；
4、在R1上配置NAPT；
5、在R1上定義內外部網絡接口；
6、驗證主機之間的互通性。
R1:
Router>en Router#conf t Enter configuration commands, one per line. End with CNTL/Z. Router(config)#host R1 R1(config)#int fa0/0 R1(config-if)#ip add 192.168.1.1 255.255.255.0 R1(config-if)#no shut %LINK-5-CHANGED: Interface FastEthernet0/0, changed state to up %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up R1(config-if)#exit R1(config)#int s2/0 R1(config-if)#ip add 200.1.1.1 255.255.255.0 R1(config-if)#no shut %LINK-5-CHANGED: Interface Serial2/0, changed state to down R1(config-if)#clock rate 64000 R1(config-if)#exit R1(config)# R1(config)# R1(config)# R1(config)# %LINK-5-CHANGED: Interface Serial2/0, changed state to up %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial2/0, changed state to up R1(config)# R1(config)#ip route 200.1.2.0 255.255.255.0 200.1.1.2 //配置靜態路由 R1(config)#end R1# %SYS-5-CONFIG_I: Configured from console by console R1#show ip route Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area * - candidate default, U - per-user static route, o - ODR P - periodic downloaded static route Gateway of last resort is not set C 192.168.1.0/24 is directly connected, FastEthernet0/0 C 200.1.1.0/24 is directly connected, Serial2/0 S 200.1.2.0/24 [1/0] via 200.1.1.2 R1# R1# R1# R1# R1# R1#conf t Enter configuration commands, one per line. End with CNTL/Z. R1(config)#int fa0/0 R1(config-if)#ip nat inside R1(config-if)#exit R1(config)#int s2/0 R1(config-if)#ip nat outside R1(config-if)#exit R1(config)#access-list ? <1-99> IP standard access list <100-199> IP extended access list R1(config)#access-list 1 ? deny Specify packets to reject permit Specify packets to forward remark Access list entry comment R1(config)#access-list 1 permit ? A.B.C.D Address to match any Any source host host A single host address R1(config)#access-list 1 permit 192.168.1.0 ? A.B.C.D Wildcard bits <cr> R1(config)#access-list 1 permit 192.168.1.0 0.0.0.255 ? <cr> R1(config)#access-list 1 permit 192.168.1.0 0.0.0.255 //定義訪問控制列表 R1(config)#ip nat ? inside Inside address translation outside Outside address translation pool Define pool of addresses R1(config)#ip nat pool ? WORD Pool name R1(config)#ip nat pool david ? A.B.C.D Start IP address R1(config)#ip nat pool david 200.1.1.3 ? A.B.C.D End IP address R1(config)#ip nat pool david 200.1.1.3 200.1.1.3 ? netmask Specify the network mask R1(config)#ip nat pool david 200.1.1.3 200.1.1.3 netmask ? A.B.C.D Network mask R1(config)#ip nat pool david 200.1.1.3 200.1.1.3 netmask 255.255.255.0 ? <cr> R1(config)#ip nat pool david 200.1.1.3 200.1.1.3 netmask 255.255.255.0 R1(config)#ip nat inside ? source Source address translation R1(config)#ip nat inside source ? list Specify access list describing local addresses static Specify static local->global mapping R1(config)#ip nat inside source list 1 ? interface Specify interface for global address pool Name pool of global addresses R1(config)#ip nat inside source list 1 pool ? WORD Name pool of global addresses R1(config)#ip nat inside source list 1 pool david ? overload Overload an address translation <cr> R1(config)#ip nat inside source list 1 pool david overload ? <cr> R1(config)#ip nat inside source list 1 pool david overload R1(config)#end R1# %SYS-5-CONFIG_I: Configured from console by console R1#show ip nat ? statistics Translation statistics translations Translation entries R1#show ip nat translations //沒有主機訪問Web Server的時候，沒有記錄
R1# R1#show ip nat translations //有主機訪問Web Server，產生記錄 Pro Inside global Inside local Outside local Outside global tcp 200.1.1.3:1026 192.168.1.2:1026 200.1.2.2:80 200.1.2.2:80 R1#show ip nat translations //來自1.2和1.3的主機訪問 Pro Inside global Inside local Outside local Outside global tcp 200.1.1.3:1026 192.168.1.2:1026 200.1.2.2:80 200.1.2.2:80 tcp 200.1.1.3:1025 192.168.1.3:1025 200.1.2.2:80 200.1.2.2:80 R1#show ip nat translations Pro Inside global Inside local Outside local Outside global tcp 200.1.1.3:1026 192.168.1.2:1026 200.1.2.2:80 200.1.2.2:80 tcp 200.1.1.3:1027 192.168.1.2:1027 200.1.2.2:80 200.1.2.2:80 tcp 200.1.1.3:1025 192.168.1.3:1025 200.1.2.2:80 200.1.2.2:80 tcp 200.1.1.3:1024 192.168.1.3:1026 200.1.2.2:80 200.1.2.2:80 R1#
R2:
Router>en
Router#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#hostname R2
R2(config)#int fa0/0
R2(config-if)#ip add 200.1.2.1 255.255.255.0
R2(config-if)#no shut
%LINK-5-CHANGED: Interface FastEthernet0/0, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up
R2(config-if)#exit
R2(config)#int s2/0
R2(config-if)#ip add 200.1.1.2 255.255.255.0
R2(config-if)#no shut
%LINK-5-CHANGED: Interface Serial2/0, changed state to up
R2(config-if)#
%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial2/0, changed state to up
R2(config-if)#
R2(config-if)#
R2(config-if)#exit
R2(config)#ip route 192.168.1.0 255.255.255.0 200.1.1.1
R2(config)#end
R2#
%SYS-5-CONFIG_I: Configured from console by console
R2#show ip route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default, U - per-user static route, o - ODR
P - periodic downloaded static route
Gateway of last resort is not set
S 192.168.1.0/24 [1/0] via 200.1.1.1
C 200.1.1.0/24 is directly connected, Serial2/0
C 200.1.2.0/24 is directly connected, FastEthernet0/0
R2#
R2#
R2#
R2#
PC1:
Packet Tracer PC Command Line 1.0
PC>ipconfig
IP Address......................: 192.168.1.2
Subnet Mask.....................: 255.255.255.0
Default Gateway.................: 192.168.1.1
PC>ping 200.1.2.2
Pinging 200.1.2.2 with 32 bytes of data:
Reply from 200.1.2.2: bytes=32 time=15ms TTL=126
Reply from 200.1.2.2: bytes=32 time=16ms TTL=126
Reply from 200.1.2.2: bytes=32 time=16ms TTL=126
Reply from 200.1.2.2: bytes=32 time=15ms TTL=126
Ping statistics for 200.1.2.2:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 15ms, Maximum = 16ms, Average = 15ms
PC>
PC-WEB:
