一、配置靜態NAT
目標：
隨着接入Internet的計算機數量的不斷猛增，IP地址資源也就愈加顯得捉襟見肘。事實上，除了中國教育和科研計算機網（CERNET）外，一般用戶幾乎申請不到整段的C類IP地址。在其他ISP那里，即使是擁有幾百台計算機的大型局域網用戶，當他們申請IP地址時，所分配的地址也不過只有幾個或十幾個IP地址。顯然，這樣少的IP地址根本無法滿足網絡用戶的需求。
- 在R1上配置靜態NAT使192.168.1.1轉換為61.159.62.131，192.168.1.2轉換為61.159.62.132，實現外部網絡訪問。
方案：
借助於NAT，私有（保留）地址的"內部"網絡通過路由器發送數據包時，私有地址被轉換成合法的IP地址，一個局域網只需使用少量IP地址（甚至是1個）即可實現私有地址網絡內所有計算機與Internet的通信需求。
這種通過使用少量的公有IP 地址代表較多的私有IP 地址的方式，將有助於減緩可用IP地址空間的枯竭。而且還能夠有效地避免來自網絡外部的攻擊，隱藏並保護網絡內部的計算機。
網絡拓撲如下圖所示：
步驟：
步驟一：通用配置
1）配置R1端口IP地址，以及默認路由
tarena-R1(config)#interface f0/0
tarena-R1(config-if)#ip address 192.168.1.254 255.255.255.0
tarena-R1(config-if)#no shutdown
tarena-R1(config-if)#interface f0/1
tarena-R1(config-if)#ip address 61.159.62.129 255.255.255.248
tarena-R1(config-if)#no shutdown
tarena-R1(config-if)#exit
tarena-R1(config)#ip route 0.0.0.0 0.0.0.0 f0/1
2）配置R2端口IP地址
不需要在R2上配置到企業內網的靜態路由，因為NAT的存在，企業內部的地址都將被轉換、隱藏。
tarena-R2(config)#interface f0/0
tarena-R2(config-if)#ip address 61.159.62.130 255.255.255.248
tarena-R2(config-if)#no shutdown
tarena-R2(config-if)#interface f0/1
tarena-R2(config-if)#ip address 192.168.2.254 255.255.255.0
tarena-R2(config-if)#no shutdown
步驟二：靜態NAT配置
1）在R1上將192.168.1.1映射到61.159.62.131，將192.168.1.2映射到61.159.62.132
靜態映射有唯一對應的關系。
通過靜態NAT，可以把內網服務器發布到外網。
tarena-R1(config)#ip nat inside source static 192.168.1.1 61.159.62.131
tarena-R1(config)#ip nat inside source static 192.168.1.2 61.159.62.132
2）在R1上配置NAT內、外端口
tarena-R1(config)#interface f0/0
tarena-R1(config-if)#ip nat inside
tarena-R1(config-if)#interface f0/1
tarena-R1(config-if)#ip nat outside
3）分別在兩台PC機上測試到外網主機的通信
PC1測試如下所示：
PC>ipconfig
FastEthernet0 Connection:(default port)
Link-local IPv6 Address.........: FE80::2D0:FFFF:FE45:CACC
IP Address......................: 192.168.1.1
Subnet Mask.....................: 255.255.255.0
Default Gateway.................: 192.168.1.254
PC>ping 192.168.2.1
Pinging 192.168.2.1 with 32 bytes of data:
Reply from 192.168.2.1: bytes=32 time=1ms TTL=126
Reply from 192.168.2.1: bytes=32 time=0ms TTL=126
Reply from 192.168.2.1: bytes=32 time=0ms TTL=126
Reply from 192.168.2.1: bytes=32 time=0ms TTL=126
Ping statistics for 192.168.2.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 1ms, Average = 0ms
PC>
PC2的測試如下所示：
PC>ipconfig
FastEthernet0 Connection:(default port)
Link-local IPv6 Address.........: FE80::200:CFF:FEEA:DE30
IP Address......................: 192.168.1.2
Subnet Mask.....................: 255.255.255.0
Default Gateway.................: 192.168.1.254
PC>ping 192.168.2.1
Pinging 192.168.2.1 with 32 bytes of data:
Request timed out.
Reply from 192.168.2.1: bytes=32 time=0ms TTL=126
Reply from 192.168.2.1: bytes=32 time=0ms TTL=126
Reply from 192.168.2.1: bytes=32 time=0ms TTL=126
Ping statistics for 192.168.2.1:
Packets: Sent = 4, Received = 3, Lost = 1 (25% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms
PC>
4）在R1上查看NAT轉換表
tarena-R1#show ip nat translations
Pro Inside global Inside local Outside local Outside global
icmp 61.159.62.131:10 192.168.1.1:10 192.168.2.1:10 192.168.2.1:10
icmp 61.159.62.131:11 192.168.1.1:11 192.168.2.1:11 192.168.2.1:11
icmp 61.159.62.131:12 192.168.1.1:12 192.168.2.1:12 192.168.2.1:12
icmp 61.159.62.131:9 192.168.1.1:9 192.168.2.1:9 192.168.2.1:9
icmp 61.159.62.132:27 192.168.1.2:27 192.168.2.1:27 192.168.2.1:27
icmp 61.159.62.132:28 192.168.1.2:28 192.168.2.1:28 192.168.2.1:28
icmp 61.159.62.132:29 192.168.1.2:29 192.168.2.1:29 192.168.2.1:29
icmp 61.159.62.132:30 192.168.1.2:30 192.168.2.1:30 192.168.2.1:30
二、配置端口映射
目標：
通過端口映射技術將內部服務器發布向Internet。
方案：
在R1上配置端口映射將192.168.1.3的80端口映射為61.159.62.133的80端口，將web服務器發布到Internet。網絡拓撲如下圖所示：
步驟：
步驟一：通用配置
1）在案例一基礎上取消靜態轉換條目，在192.168.1.0網絡新增一台web服務器IP為192.168.1.3。將192.168.1.3的80端口映射為61.159.62.133的80端口
tarena-R1(config)#no ip nat inside source static 192.168.1.1 61.159.62.131
tarena-R1(config)#no ip nat inside source static 192.168.1.2 61.159.62.132
tarena-R1 (config)#ip nat inside source static tcp 192.168.1.3 80 61.159.62.133 80
步驟二：PC3上訪問web服務器進行驗證
1）外部主機PC4上訪問61.159.62.133進行驗證，如下圖所示
三、配置動態NAT
目標：
在R1通過動態NAT實現企業內網192.168.1.0/24轉換為公網地址61.159.62.131-61.159.62.134，訪問192.168.2.1
方案：
網絡拓撲如下圖所示：
步驟：
步驟一：動態NAT配置
1）刪除案例2中的端口映射
tarena-R1 (config)#no ip nat inside source static tcp 192.168.1.3 80 61.159.62.133 80
2）在R1上配置ACL
tarena-R1(config)#access-list 1 permit 192.168.1.0 0.0.0.255
3）在R1上配置可轉換的公網IP地址池
地址池是向ISP（Internet服務提供商，如電信、聯通）申請得到的，內網主機（上一步ACL中所包含的IP地址）到外網的訪問，內網地址將被動態的、隨機的轉換為這些合法地址。
tarena-R1(config)#ip nat pool natpool 61.159.62.131 61.159.62.134 netmask 255.255.255.248
4）關聯ACL和公網的IP地址池
tarena-R1(config)#ip nat inside source list 1 pool natpool
5）在R1上配置NAT內、外端口
tarena-R1(config)#interface f0/0
tarena-R1(config-if)#ip nat inside
tarena-R1(config-if)#interface f0/1
tarena-R1(config-if)#ip nat outside
6）分別在兩台PC機上測試到外網主機的通信
PC1測試如下所示：
PC>ipconfig
FastEthernet0 Connection:(default port)
Link-local IPv6 Address.........: FE80::2D0:FFFF:FE45:CACC
IP Address......................: 192.168.1.1
Subnet Mask.....................: 255.255.255.0
Default Gateway.................: 192.168.1.254
PC>ping 192.168.2.1
Pinging 192.168.2.1 with 32 bytes of data:
Reply from 192.168.2.1: bytes=32 time=1ms TTL=126
Reply from 192.168.2.1: bytes=32 time=0ms TTL=126
Reply from 192.168.2.1: bytes=32 time=0ms TTL=126
Reply from 192.168.2.1: bytes=32 time=0ms TTL=126
Ping statistics for 192.168.2.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 1ms, Average = 0ms
PC>
PC2測試如下所示：
PC>ipconfig
FastEthernet0 Connection:(default port)
Link-local IPv6 Address.........: FE80::2D0:FFFF:FE45:CACC
IP Address......................: 192.168.1.2
Subnet Mask.....................: 255.255.255.0
Default Gateway.................: 192.168.1.254
PC>ping 192.168.2.1
Pinging 192.168.2.1 with 32 bytes of data:
Reply from 192.168.2.1: bytes=32 time=1ms TTL=126
Reply from 192.168.2.1: bytes=32 time=0ms TTL=126
Reply from 192.168.2.1: bytes=32 time=0ms TTL=126
Reply from 192.168.2.1: bytes=32 time=0ms TTL=126
Ping statistics for 192.168.2.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 1ms, Average = 0ms
7）在R1上查看NAT轉換表
轉換表中的對應關系是動態的，如192.168.1.1被轉換為61.159.62.131，但是下一次對外網的訪問很有可能被轉換為其他地址。
tarena-R1#show ip nat translations
Pro Inside global Inside local Outside local Outside global
icmp 61.159.62.131:1362192.168.1.1:1362 192.168.2.1:1362 192.168.2.1:1362
icmp 61.159.62.131:1392192.168.1.1:1392 192.168.2.1:1392 192.168.2.1:1392
icmp 61.159.62.131:1393192.168.1.1:1393 192.168.2.1:1393 192.168.2.1:1393
icmp 61.159.62.131:1394192.168.1.1:1394 192.168.2.1:1394 192.168.2.1:1394
icmp 61.159.62.132:13 192.168.1.2:13 192.168.2.1:13 192.168.2.1:13
icmp 61.159.62.132:14 192.168.1.2:14 192.168.2.1:14 192.168.2.1:14
icmp 61.159.62.132:15 192.168.1.2:15 192.168.2.1:15 192.168.2.1:15
icmp 61.159.62.132:16 192.168.1.2:16 192.168.2.1:16 192.168.2.1:16
四、PAT配置
目標：
在R1配置PAT端口多路復用使企業內網192.168.1.0/24復用f0/1端口的IP，實現外部網絡的訪問。
方案：
網絡拓撲如下圖所示：
步驟：
步驟一：基於端口的PAT配置限制
1）刪除案例3中動態NAT配置
tarena-R1(config)#no ip nat inside source list 1
tarena-R1(config)#no ip nat pool natpool
tarena-R1(config)#no access-list 1
2）在R1上配置ACL
tarena-R1(config)#access-list 1 permit 192.168.1.0 0.0.0.255
3）關聯ACL和路由器連接互聯網的端口
該命令最后加上的overload表示復用。
tarena-R1(config)#ip nat inside source list 1 interface f0/1 overload
4）在R1上配置NAT內、外端口
tarena-R1(config)#interface f0/0
tarena-R1(config-if)#ip nat inside
tarena-R1(config-if)#interface f0/1
tarena-R1(config-if)#ip nat outside
5）分別在兩台PC機上測試到外網主機的通信
PC1測試如下所示：
PC>ipconfig
FastEthernet0 Connection:(default port)
Link-local IPv6 Address.........: FE80::2D0:FFFF:FE45:CACC
IP Address......................: 192.168.1.1
Subnet Mask.....................: 255.255.255.0
Default Gateway.................: 192.168.1.254
PC>ping 192.168.2.1
Pinging 192.168.2.1 with 32 bytes of data:
Reply from 192.168.2.1: bytes=32 time=1ms TTL=126
Reply from 192.168.2.1: bytes=32 time=0ms TTL=126
Reply from 192.168.2.1: bytes=32 time=0ms TTL=126
Reply from 192.168.2.1: bytes=32 time=0ms TTL=126
Ping statistics for 192.168.2.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 1ms, Average = 0ms
PC>
PC2測試如下所示：
PC>ipconfig
FastEthernet0 Connection:(default port)
Link-local IPv6 Address.........: FE80::2D0:FFFF:FE45:CACC
IP Address......................: 192.168.1.2
Subnet Mask.....................: 255.255.255.0
Default Gateway.................: 192.168.1.254
PC>ping 192.168.2.1
Pinging 192.168.2.1 with 32 bytes of data:
Reply from 192.168.2.1: bytes=32 time=1ms TTL=126
Reply from 192.168.2.1: bytes=32 time=0ms TTL=126
Reply from 192.168.2.1: bytes=32 time=0ms TTL=126
Reply from 192.168.2.1: bytes=32 time=0ms TTL=126
Ping statistics for 192.168.2.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 1ms, Average = 0ms
PC>
6）在R1上查看NAT轉換表
tarena-R1#show ip nat translations
Pro Inside global Inside local Outside local Outside global
icmp 61.159.62.129:2029192.168.1.1:2029 192.168.2.1:2029 192.168.2.1:2029
icmp 61.159.62.129:2030192.168.1.1:2030 192.168.2.1:2030 192.168.2.1:2030
icmp 61.159.62.129:2031192.168.1.1:2031 192.168.2.1:2031 192.168.2.1:2031
icmp 61.159.62.129:2032192.168.1.1:2032 192.168.2.1:2032 192.168.2.1:2032
icmp 61.159.62.129:2033192.168.1.1:2033 192.168.2.1:2033 192.168.2.1:2033
icmp 61.159.62.129:2034192.168.1.1:2034 192.168.2.1:2034 192.168.2.1:2034
icmp 61.159.62.129:2035192.168.1.1:2035 192.168.2.1:2035 192.168.2.1:2035
輸出結果顯示，所有的內網IP地址在訪問外網前均被轉換成了路由器端口的IP地址。
五、辦公區Internet的訪問
目標：
在R1配置PAT端口多路復用使企業內網192.168.1.0/24復用f0/1端口的IP，實現外部網絡的訪問。
方案：
網絡拓撲如下圖所示：
步驟：
步驟一：在SM1划分vlan2、vlan3、vlan4 並給SM1配置虛端口IP並開啟路由功能，1-4接口開啟trunk
1）創建vlan並設置管理IP，開啟路由功能，並把相應的接口划分到vlan下
SM1 (config)ip routing
SM1 (config)#vlan 2
SM1 (config-vlan)#vlan 3
SM1 (config-vlan)#vlan 4
SM1 (config-vlan)#
SM1 (config-vlan)#exit
SM1 (config)#interface vlan 1
SM1 (config-if)#ip address 192.168.1.254 255.255.255.0
SM1 (config-if)#eixt
SM1 (config-if)#no shutdown
SM1 (config-if)#exit
SM1 (config)#interface vlan 2
SM1 (config-if)#ip address 192.168.2.254 255.255.255.0
SM1 (config-if)#no shutdown
SM1 (config-if)#exit
SM1 (config)#interface vlan 3
SM1 (config-if)#ip address 192.168.3.254 255.255.255.0
SM1 (config-if)#no shutdown
SM1 (config-if)#exit
SM1 (config)#interface vlan 4
SM1 (config-if)#ip address 192.168.4.254 255.255.255.0
SM1 (config-if)#no shutdown
sw2(config)#vlan 2
sw2(config-vlan)#exit
sw2(config)#interface fastEthernet 0/1
sw2(config-if)#switchport access vlan 2
sw3(config)#vlan 3
sw3(config-vlan)#exit
sw3(config)#interface fastEthernet 0/1
sw3(config-if)#switchport access vlan 3
sw4(config)#vlan 4
sw4(config-vlan)#exit
sw4(config)#interface fastEthernet 0/1
sw4(config-if)#switchport access vlan 4
2）交換機之間所連接的接口開啟trunk
SM1(config)#interface range f0/1 - 4
SM1 (config-if-range)#switchport trunk encapsulation dot1q
SM1 (config-if-range)#switchport mode trunk
sw1(config)#interface fastEthernet 0/3
sw1(config-if)#switchport mode trunk
sw2(config)#interface fastEthernet 0/3
sw2(config-if)#switchport mode trunk
sw3(config)#interface fastEthernet 0/3
sw3(config-if)#switchport mode trunk
sw4(config)#interface fastEthernet 0/3
sw4(config-if)#switchport mode trunk
3）測試vlan之間的連通性
PC>ipconfig
FastEthernet0 Connection:(default port)
Link-local IPv6 Address.........: FE80::290:21FF:FEC2:1A50
IP Address......................: 192.168.1.1
Subnet Mask.....................: 255.255.255.0
Default Gateway.................: 192.168.1.254
PC>ping 192.168.2.1
Pinging 192.168.2.1 with 32 bytes of data:
Reply from 192.168.2.1: bytes=32 time=0ms TTL=127
Reply from 192.168.2.1: bytes=32 time=0ms TTL=127
Reply from 192.168.2.1: bytes=32 time=0ms TTL=127
Reply from 192.168.2.1: bytes=32 time=1ms TTL=12
Ping statistics for 192.168.2.1:
Packets: Sent = 4, Received = 3, Lost = 1 (25% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 1ms, Average = 0ms
PC>ping 192.168.3.1
Pinging 192.168.3.1 with 32 bytes of data:
Reply from 192.168.2.1: bytes=32 time=0ms TTL=127
Reply from 192.168.3.1: bytes=32 time=0ms TTL=127
Reply from 192.168.3.1: bytes=32 time=0ms TTL=127
Reply from 192.168.3.1: bytes=32 time=1ms TTL=127
Ping statistics for 192.168.3.1:
Packets: Sent = 4, Received = 3, Lost = 1 (25% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 1ms, Average = 0ms
PC>ping 192.168.4.1
Pinging 192.168.4.1 with 32 bytes of data:
Reply from 192.168.2.1: bytes=32 time=0ms TTL=127
Reply from 192.168.2.1: bytes=32 time=0ms TTL=127
Reply from 192.168.2.1: bytes=32 time=0ms TTL=127
Reply from 192.168.4.1: bytes=32 time=0ms TTL=127
Ping statistics for 192.168.4.1:
Packets: Sent = 4, Received = 1, Lost = 3 (75% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms
4）為SM1與路由器連接的接口和路由器配置IP並啟用動態路由RIP協議.
SM1(config)#interface fastEthernet 0/5
SM1(config-if)#no switchport
SM1(config-if)#ip add 192.168.5.1 255.255.255.0
SM1(config-if)#no shutdown
SM1(config-if)#exit
SM1(config)#router rip
SM1(config-router)#version 2
SM1(config-router)#no auto-summary
SM1(config-router)#network 192.168.1.0
SM1(config-router)#network 192.168.2.0
SM1(config-router)#network 192.168.3.0
SM1(config-router)#network 192.168.4.0
SM1(config-router)#network 192.168.5.0
Router(config)#interface fastEthernet 0/0
Router(config-if)#ip address 192.168.5.2 255.255.255.0
Router(config-if)#no shutdown
Router(config-if)#exit
Router(config)#interface fastEthernet 0/1
Router(config-if)#ip address 61.159.62.129 255.255.255.248
Router(config-if)#exit
Router(config)#router rip
Router(config-router)#version 2
Router(config-router)#no auto-summary
Router(config-router)#network 192.168.5.0
5）在路由器上配置默認路由並發布到RIP協議里並在三成交換機SM1上查看路由表
Router(config)#ip route 0.0.0.0 0.0.0.0 f0/1
Router(config)#router rip
Router(config-router)#default-information originate
SM路由表如下所示：
SM1# show ip route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default, U - per-user static route, o - ODR
P - periodic downloaded static route
Gateway of last resort is 192.168.5.2 to network 0.0.0.0
C 192.168.1.0/24 is directly connected, Vlan1
C 192.168.2.0/24 is directly connected, Vlan2
C 192.168.3.0/24 is directly connected, Vlan3
C 192.168.4.0/24 is directly connected, Vlan4
C 192.168.5.0/24 is directly connected, FastEthernet0/5
R* 0.0.0.0/0 [120/1] via 192.168.5.2, 00:00:18, FastEthernet0/5
6）在路由器上配置PAT
Router(config)#access-list 1 permit 192.168.4.0 0.0.0.255
Router(config)#ip nat inside source list 1 interface f0/1
Router(config)#interface fastEthernet 0/0
Router(config-if)#ip nat inside
Router(config-if)#exit
Router(config)#interface fastEthernet 0/1
Router(config-if)#ip nat outside
7）用192.168.4.0和192.168.1.0測試網絡連通性
PC1
PC>ping 61.159.62.130
Pinging 61.159.62.130 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Ping statistics for 61.159.62.130:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
PC4
PC>ping 61.159.62.130
Pinging 61.159.62.130 with 32 bytes of data:
Reply from 61.159.62.130: bytes=32 time=0ms TTL=126
Reply from 61.159.62.130: bytes=32 time=0ms TTL=126
Reply from 61.159.62.130: bytes=32 time=0ms TTL=126
Reply from 61.159.62.130: bytes=32 time=0ms TTL=126
Ping statistics for 61.159.62.130:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms
結果顯示只有辦公網可以訪問Internet