HM-Router configuration for TP
目标: 让外网可以访问FTP server [10.1.1.2] /Telnet(这里为了方便测试,使用telnet)，中间跨了2个 Router
++++CNSO-TP01 configuration +++++
conf t
service timestamps debug datetime localtime show-timezone msec
service timestamps log datetime localtime show-timezone msec
service password-encryption
service sequence-numbers
service tcp-keepalives-in
service tcp-keepalives-out
no ip http server
no ip http secure-server
no service config
no logging console
no logging monitor
password encryption aes
key config-key password-encrypt xxxxx
ip domain name hm.com
ip name-server 8.8.8.8 8.8.8.4
hostname CNSO-TP01
ip cef
ip multicast-routing
!
!
crypto key generate rsa
1024
!
!
!
ip ssh version 2
ip ssh authentication-retries 3
!
!
!
username xxxx priv 15 password 0 xxxx
enable secret 0 xxxxx
line vty 0 4
transport input all
exec-timeout 15 0
logging synchronous
login local
exit
banner exec #
*****************************************************************
*UNAUTHORIZED ACCESS TO THIS DEVICE IS PROHIBITED *
*You must have explicit, authorized permission to access or *
*configure this device. Unauthorized attempts and actions to *
*access or use this system may result in civil and/or criminal *
*penalties.All activities performed on this device are logged *
*and monitored. *
*****************************************************************#
!
!
!
interface f0/0
description *** TP WAN INTERFACE ***
ip address 12.1.1.2 255.255.255.0
no shut
exit
interface Vlan 1
description *** LAN INTERFACE ***
ip address 192.168.1.1 255.255.255.0
no shut
exit
!
!
Service DHCP
ip dhcp pool HM-CN
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1
netbios-node-type h-node
dns-server 8.8.8.8 8.8.4.4
domain-name hm.com
lease 3
exit
ip dhcp excluded-address 192.168.1.1 192.168.1.10
!
!
ip route 0.0.0.0 0.0.0.0 f0/0 12.1.1.1
access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 interface f0/0 overload
ip nat inside source static tcp 192.168.1.11 23 int f0/0 23
!
!
interface f0/0
ip nat outside
no cdp enable
no shut
exit
interface Vlan 1
ip nat inside
cdp ena
no shut
exit
!
试验结果:
在外面可以telnet R4
CNSO-TP01#sh ip nat translations
Pro Inside global Inside local Outside local Outside global
tcp 12.1.1.2:23 192.168.1.11:23 15.1.1.5:24113 15.1.1.5:24113
tcp 12.1.1.2:23 192.168.1.11:23 15.1.1.5:40245 15.1.1.5:40245
tcp 12.1.1.2:23 192.168.1.11:23 --- ---
=======以上模拟测试是否能进CNSO-TP01 router=================
CNSO-TP01(config)#ip route 10.1.1.0 255.255.255.0 vlan 1
CNSO-TP01(config)#no ip nat inside source static tcp 192.168.1.11 23 int f0/0 23
CNSO-TP01(config)#ip nat inside source static tcp 192.168.1.10 23 int f0/0 23
CT(config)#int f0/1
CT(config-if)#ip nat outside
CT(config-if)#int f0/0
CT(config-if)#ip nat inside
CT(config-if)#exit
CT(config)#access-list 1 permit 10.1.1.0 0.0.0.255
CT(config)#ip nat inside source list 1 interface f0/1 overload
CT(config)#ip nat inside source static tcp 10.1.1.2 23 int f0/1 23
测试成功如下:
CNSO-TP01#sh ip nat translations
Pro Inside global Inside local Outside local Outside global
tcp 12.1.1.2:23 192.168.1.10:23 15.1.1.5:26987 15.1.1.5:26987
tcp 12.1.1.2:23 192.168.1.10:23 --- ---
CT#sh ip nat translations
Pro Inside global Inside local Outside local Outside global
icmp 192.168.1.10:3 10.1.1.2:3 192.168.1.1:3 192.168.1.1:3
tcp 192.168.1.10:23 10.1.1.2:23 15.1.1.5:26987 15.1.1.5:26987
tcp 192.168.1.10:23 10.1.1.2:23 --- ---
总结:学要致用!