单接口NAT配置实例.doc

单接口NAT配置实例 拓扑示意： 说明:一台路由器只有一个接口时，如何实现NAT/PAT的操作。如图所示： R5相关配置： 方法一(较复杂，影响速度)： r5: en conf t host r5 no ip domain-lookup defa int e0/0 defa int s0/0 defa int s0/1 defa int s0/2 defa int s0/3 no int loop0 line con 0 exec-time 0 0 logg sy exit int loop0 ip add 55 ip nat inside ip policy route-map kxy-nat int e0/0 ip add 54 secondary ip add 0 92 ip nat outside no shutdown ip policy route-map no-route exit ip nat inside source list 10 int e0/0 overload ip route access-list 10 permit 55 access-list 110 permit ip 55 any route-map kxy-nat permit 10 match ip add 110 set ip next-hop route-map no-route permit 10 match ip add 110 set int loop0 end 主要语句相关解释 (注意顺序)： int loop0 ip add 55 ip nat inside -----------------------------------------------------------------------5、inside接口收到包 ip policy route-map kxy-nat ----------------------------------------------------6、匹配策略路由 int e0/0 ip add 54 secondary ------------------------------1、内网数据包到达该网关接口 ip add 0 92 --------------------------------------9、包到达该接口 ip nat outside ---------------------------------------------------------------------10、匹配NAT并转换 ip policy route-map no-route ---------------------------------------------------2、匹配策略路由 exit ip nat inside source list 10 pool pool1 overload ip nat pool pool1 0 0 netmask 92 ip route (ip route loop0 ?)------12、查路由表 access-list 10 permit 55 -------------------------------11、匹配NAT流量 access-list 110 permit ip 55 any -------------------3、匹配流量 route-map kxy-nat permit 10 match ip add 110 ------------------------------------------------------------------7、匹配流量 set ip next-hop -------------------------------------------------------8、基于策略，包送到e0/0口 route-map no-route permit 10 match ip add 110 set int loop0 -------------------------------------------------------------------4、基于策略，包转交到loop0口 end 注：如果此时no 掉ip route loop0，则能够转换，可以拼通ISP地址，但拼不通外网其它地址，且此时不能进行地址转换。 方法二(较简单，推荐)： r5: en