配置NAT-Outbound示例.docx

配置NAT Outbound示例
组网需求
如图1所示，某公司A区的网络通过AR200-S的地址转换功能访问广域网。使用公网地址池中的地址（202.169.10.100～202.169.10.200）采用一对一的方式替换A区内部的主机地址（网段为192.168.20.0/24），访问广域网。
B区的网络通过AR200-S的地址转换功能访问广域网。结合B区的公网IP地址比较少的情况，使用公网地址池（202.169.10.80～202.169.10.83）采用IP地址和端口的替换方式替换B区内部的主机地址（网段为10.0.0.0/24），访问广域网。
其中AR200-S上接口Ethernet2/0/0的公网地址为202.169.10.1/24,对端运营商侧地址为202.169.10.2/24。
图1 配置NAT Outbound组网图

配置思路
采用如下思路配置NAT Outbound：
1. 配置接口IP地址。
2. 配置缺省路由。
3. 在WAN侧接口下配置NAT Outbound，实现内部主机访问外网服务功能。
操作步骤
1. 在AR200-S上配置接口IP地址。
2. <Huawei> system-view
3. [Huawei] vlan 100
4. [Huawei-vlan100] quit
5. [Huawei] interface vlanif 100
6. [Huawei-Vlanif100] ip address 192.168.20.1 24
7. [Huawei-Vlanif100] quit
8. [Huawei] interface Ethernet 0/0/0
9. [Huawei-Ethernet0/0/0] port link-type access
10. [Huawei-Ethernet0/0/0] port default vlan 100
11. [Huawei-Ethernet0/0/0] quit
12. [Huawei] vlan 200
13. [Huawei-vlan200] quit
14. [Huawei] interface vlanif 200
15. [Huawei-Vlanif200] ip address 10.0.0.1 24
16. [Huawei-Vlanif200] quit
17. [Huawei] interface Ethernet 0/0/1
18. [Huawei-Ethernet0/0/1] port link-type access
19. [Huawei-Ethernet0/0/1] port default vlan 200
20. [Huawei-Ethernet0/0/1] quit
21. [Huawei] interface Ethernet 2/0/0
22. [Huawei-Ethernet2/0/0] ip address 202.169.10.1 24
23. [Huawei-Ethernet2/0/0] quit

24. 在AR200-S上配置缺省路由，指定下一跳地址为202.169.10.2。
25. [Huawei] ip route-static 0.0.0.0 0.0.0.0 202.169.10.2
26. 在AR200-S上配置NAT Outbound。
27. [Huawei] nat address-group 1 202.169.10.100 202.169.10.200
28. [Huawei] nat address-group 2 202.169.10.80 202.169.10.83
29. [Huawei] acl 2000
30. [Huawei-acl-basic-2000] rule 5 permit source 192.168.20.0 0.0.0.255
31. [Huawei-acl-basic-2000] quit
32. [Huawei] acl 2001
33. [Huawei-acl-basic-2001] rule 5 permit source 10.0.0.0 0.0.0.255
34. [Huawei-acl-basic-2001] quit
35. [Huawei] interface Ethernet 2/0/0
36. [Huawei-Ethernet2/0/0] nat outbound 2000 address-group 1 no-pat
37. [Huawei-Ethernet2/0/0] nat outbound 2001 address-group 2
38. [Huawei-Ethernet2/0/0] quit
39. 检查配置结果。
在AR200-S上执行display nat outbound操作，结果如下。
[Huawei] display nat outbound
NAT Outbound Information:
-----------------------------------------------------------------
Interface Acl Address-group/IP/Interface Type
-----------------------------------------------------------------
Ethernet2/0/0 2000 1 no-pat
Ethernet2/0/0 2001 2 pat
-----------------------------------------------------------------
Total : 2
在AR200-S上执行如下操作：
<Huawei> ping -a 192.168.20.1 202.169.10.2
PING 202.169.10.2: 56 data bytes, press CTRL_C to break
Reply from 202.169.10.2: bytes=56 Sequence=1 ttl=255 time=1 ms
Reply from 202.169.10.2: bytes=56 Sequence=2 ttl=255 time=1 ms
Reply from 202.169.10.2: bytes=56 Sequence=3 ttl=255 time=1 ms
Reply from 202.169.10.2: bytes=56 Sequence=4 ttl=255 time=1 ms
Reply from 202.169.10.2: bytes=56 Sequence=5 ttl=255 time=1 ms
<Huawei> ping -a 10.0.0.1 202.169.10.2
PING 202.169.10.2: 56 data bytes, press CTRL_C to break
Reply from 202.169.10.2: bytes=56 Sequence=1 ttl=255 time=1 ms
Reply from 202.169.10.2: bytes=56 Sequence=2 ttl=255 time=1 ms
Reply from 202.169.10.2: bytes=56 Sequence=3 ttl=255 time=1 ms
Reply from 202.169.10.2: bytes=56 Sequence=4 ttl=255 time=1 ms
Reply from 202.169.10.2: bytes=56 Sequence=5 ttl=255 time=1 ms
配置文件
#
vlan batch 100 200
#
acl number 2000
rule 5 permit source 192.168.20.0 0.0.0.255
#
acl number 2001
rule 5 permit source 10.0.0.0 0.0.0.255
#
interface Vlanif100
ip address 192.168.20.1 255.255.255.0
#
interface Vlanif200
ip address 10.0.0.1 255.255.255.0
#
interface Ethernet0/0/0
port link-type access
port default vlan 100
#
interface Ethernet0/0/1
port link-type access
port default vlan 200
#
interface Ethernet2/0/0
ip address 202.169.10.1 255.255.255.0
nat outbound 2000 address-group 1 no-pat
nat outbound 2001 address-group 2
#
nat address-group 1 202.169.10.100 202.169.10.200
nat address-group 2 202.169.10.80 202.169.10.83
#
ip route-static 0.0.0.0 0.0.0.0 Ethernet 2/0/0
#
return