利用两种不同的NAT配置实现两个接口的双向静态NAT测试

一.测试拓扑：

二.测试需求

1.ServerA已经配置静态一对一的地址实现从Interternet的访问

2.RouterA和RouterB为专线

3.需要ServerA访问ServerB的源地址映射为193.170.3.200

三.测试思路

1.利用nat和route-map实现按照需要进行NAT转换

---实际测试，不能满足要求

2.分2组nat，一组传统方式ip nat inside、ip nat outside，另一组为ip nat enable

四.基本配置

1.服务器ServerA：

interface Ethernet0/0

ip address 172.16.10.200 255.255.255.0

no shut

ip route 0.0.0.0 0.0.0.0 172.16.10.254

2.路由器RouterC：

interface Ethernet0/0

ip address 172.16.10.254 255.255.255.0

no shut 
interface Ethernet0/1
     ip address 10.1.1.2 255.255.255.0
     no shut

ip route 0.0.0.0 0.0.0.0 10.1.1.1

3.路由器RouterA：

interface Ethernet0/0
     ip address 202.100.1.1 255.255.255.0
     no shut  
interface Ethernet0/1
     ip address 192.169.2.105 255.255.255.0
     no shut  
interface Ethernet0/2
     ip address 10.1.1.1 255.255.255.0
     no shut

ip route 0.0.0.0 0.0.0.0 202.100.1.2

ip route 172.16.10.0 255.255.255.0 10.1.1.2
ip route 192.168.92.0 255.255.255.0 192.169.2.106

interface Ethernet0/0

ip nat outside

interface Ethernet0/2

ip nat inside

ip access-list extended PAT

deny   ip host 172.16.10.200 192.168.92.0 0.0.0.255
     permit ip 172.16.10.0 0.0.0.255 any

ip nat inside source list PAT interface Ethernet0/0 overload

ip nat inside source static 172.16.10.200 202.100.1.200

---验证：

ServerA#ping 202.100.1.2

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 202.100.1.2, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 60/75/108 ms

Internet#debug ip icmp 
ICMP packet debugging is on
Internet#
*Mar  1 06:28:08.946: ICMP: echo reply sent, src 202.100.1.2, dst 202.100.1.200
Internet#
*Mar  1 06:28:10.942: ICMP: echo reply sent, src 202.100.1.2, dst 202.100.1.200
*Mar  1 06:28:11.038: ICMP: echo reply sent, src 202.100.1.2, dst 202.100.1.200
*Mar  1 06:28:11.138: ICMP: echo reply sent, src 202.100.1.2, dst 202.100.1.200
*Mar  1 06:28:11.198: ICMP: echo reply sent, src 202.100.1.2, dst 202.100.1.200

4.路由器Internet：

interface Ethernet0/0
     ip address 202.100.1.2 255.255.255.0

no shut

5.路由器RouterB：

interface Ethernet0/0
     ip address 192.169.2.106 255.255.255.0
     no shut

interface Ethernet0/1
     ip address 192.168.92.254 255.255.255.0
     no shut

ip route 172.16.10.0 255.255.255.0 192.169.2.105

五.NAT加route-map测试

A.路由器RouterA

1.定义ACL

ip access-list extended Inside
     permit ip host 172.16.10.200 host 192.168.92.64
ip access-list extended Outside
     permit ip host 172.16.10.200 any

2.配置route-map

route-map Inside permit 10
     match ip address Inside
route-map Outside permit 10
     match ip address Outside

3.删除原有的静态NAT

no ip nat inside source static 172.16.10.200 202.100.1.200

no ip nat inside source list PAT interface Ethernet0/0 overload

4.配置带 route-map的静态NAT

ip nat inside source static 172.16.10.200 202.100.1.200 route-map Outside

ip nat inside source static 172.16.10.200 193.170.3.200 route-map Inside

interface Ethernet0/1

ip nat outside

B.路由器RouterB

ip route 193.170.3.0 255.255.255.0 192.169.2.105

C.测试：

ServerA#ping 202.100.1.2

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 202.100.1.2, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
ServerA#

Internet#
*Mar  1 06:59:10.862: ICMP: echo reply sent, src 202.100.1.2, dst 172.16.10.200
Internet#
*Mar  1 06:59:12.870: ICMP: echo reply sent, src 202.100.1.2, dst 172.16.10.200
Internet#
*Mar  1 06:59:14.890: ICMP: echo reply sent, src 202.100.1.2, dst 172.16.10.200
Internet#
*Mar  1 06:59:16.846: ICMP: echo reply sent, src 202.100.1.2, dst 172.16.10.200
Internet#
*Mar  1 06:59:18.846: ICMP: echo reply sent, src 202.100.1.2, dst 172.16.10.200
Internet#

ServerA#ping 192.168.92.64

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.92.64, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 84/121/160 ms
ServerA#

ServerB#debug ip icmp 
ICMP packet debugging is on
ServerB#
*Mar  1 00:55:06.027: ICMP: echo reply sent, src 192.168.92.64, dst 172.16.10.200
*Mar  1 00:55:06.187: ICMP: echo reply sent, src 192.168.92.64, dst 172.16.10.200
*Mar  1 00:55:06.339: ICMP: echo reply sent, src 192.168.92.64, dst 172.16.10.200
*Mar  1 00:55:06.427: ICMP: echo reply sent, src 192.168.92.64, dst 172.16.10.200
*Mar  1 00:55:06.495: ICMP: echo reply sent, src 192.168.92.64, dst 172.16.10.200
ServerB#

-----出去的时候没有做源地址转换

Internet#telnet 202.100.1.200
Trying 202.100.1.200 ... Open

User Access Verification

Password: 
ServerA>show users
    Line       User       Host(s)              Idle       Location
   0 con 0                idle                 00:00:49   
*130 vty 0                idle                 00:00:00 202.100.1.2

Interface    User               Mode         Idle     Peer Address

ServerA>quit

ServerB#telnet 193.170.3.200
Trying 193.170.3.200 ... Open

User Access Verification

Password: 
ServerA>show users
    Line       User       Host(s)              Idle       Location
   0 con 0                idle                 00:01:52   
*130 vty 0                idle                 00:00:00 192.168.92.64

Interface    User               Mode         Idle     Peer Address

ServerA>quit

-----从外面进来时做聊目标地址转换

六.两种NAT配合使用测试

A.RouterA删除前面配置的nat并恢复原始配置中的NAT配置

no ip nat inside source static 172.16.10.200 202.100.1.200 route-map Outside

no ip nat inside source static 172.16.10.200 193.170.3.200 route-map Inside

interface Ethernet0/1

no ip nat outside

no route-map Inside permit 10
no route-map Outside permit 10

no ip access-list extended Inside
no ip access-list extended Outside

ip nat inside source static 172.16.10.200 202.100.1.200

ip nat inside source list PAT interface Ethernet0/0 overload

B.RouterA配置ip nat enable

interface Ethernet0/2
     ip nat enable

interface Ethernet0/1
     ip nat enable

C.配置静态NAT:

ip nat source static 172.16.10.200 193.170.3.200

D.测试：

ServerA#ping 192.168.92.64

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.92.64, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
ServerA#

ServerB#
*Mar  1 01:18:22.823: ICMP: echo reply sent, src 192.168.92.64, dst 193.170.3.200
ServerB#
*Mar  1 01:18:24.807: ICMP: echo reply sent, src 192.168.92.64, dst 193.170.3.200
ServerB#
*Mar  1 01:18:26.819: ICMP: echo reply sent, src 192.168.92.64, dst 193.170.3.200
ServerB#
*Mar  1 01:18:28.779: ICMP: echo reply sent, src 192.168.92.64, dst 193.170.3.200
ServerB#
*Mar  1 01:18:30.779: ICMP: echo reply sent, src 192.168.92.64, dst 193.170.3.200
ServerB#

Internet#
*Mar  1 07:24:07.350: ICMP: dst (193.170.3.200) host unreachable sent to 192.168.92.64
Internet#
*Mar  1 07:24:09.342: ICMP: dst (193.170.3.200) host unreachable sent to 192.168.92.64
Internet#
*Mar  1 07:24:11.334: ICMP: dst (193.170.3.200) host unreachable sent to 192.168.92.64
Internet#
*Mar  1 07:24:13.286: ICMP: dst (193.170.3.200) host unreachable sent to 192.168.92.64
Internet#
*Mar  1 07:24:15.314: ICMP: dst (193.170.3.200) host unreachable sent to 192.168.92.64
Internet#

----发现此时RouterA对回包没有做目标地址转换，把包丢给了Internet路由器

D.路由器RouterA增加secondary地址并测试:

interface Ethernet0/1
ip address 193.170.3.1 255.255.255.0 secondary

ServerA#ping 192.168.92.64

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.92.64, timeout is 2 seconds:
!.!.!
Success rate is 60 percent (3/5), round-trip min/avg/max = 128/153/168 ms

ServerB#
*Mar  1 01:31:28.219: ICMP: echo reply sent, src 192.168.92.64, dst 193.170.3.200
*Mar  1 01:31:28.399: ICMP: echo reply sent, src 192.168.92.64, dst 193.170.3.200
ServerB#
*Mar  1 01:31:30.379: ICMP: echo reply sent, src 192.168.92.64, dst 193.170.3.200
*Mar  1 01:31:30.531: ICMP: echo reply sent, src 192.168.92.64, dst 193.170.3.200
ServerB#
*Mar  1 01:31:32.515: ICMP: echo reply sent, src 192.168.92.64, dst 193.170.3.200
ServerB#

----通了，但是很有规律的丢包，并且比较严重

ServerA#ping 192.168.92.64 repeat 100

Type escape sequence to abort.
Sending 100, 100-byte ICMP Echos to 192.168.92.64, timeout is 2 seconds:
!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.
!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.
Success rate is 50 percent (50/100), round-trip min/avg/max = 56/128/204 ms

七.使用loopback口和两种NAT配合使用测试

---经过上面配置后，有50%的丢包，测试可能是e0/2同时配置了两种NAT,所以增加loopback口，取消原先e0/2的ip nat enable

A.路由器RouterA增加loopback0，配置ip nat enable

interface Loopback0
     ip address 1.1.1.1 255.255.255.252
     ip nat enable

B.路由器RouterA配置route-map并在e0/2接口应用

ip access-list extended ToServerB
     permit ip host 172.16.10.200 host 192.168.92.64

route-map ToServerB permit 10
     match ip address ToServerB
     set interface Loopback0

interface Ethernet0/2

no  ip nat enable

ip policy route-map ToServerB

C.经过上述配置后仍然还有50%的丢包，于是保存配置，重启RouterA，此时没有丢包

-----这时采用第六步的配置也是正常的，说明可能是模拟器的缘故导致

时间： 2025-02-01 08:03:15

利用两种不同的NAT配置实现两个接口的双向静态NAT测试的相关文章

struts2中两种validation.xml的配置方式_百度文库

在struts中,根据配置的validation.xml文件进行页面输入项目的验证已经众所周知,本文介绍在struts2中两种validation.xml的配置方式.可以根据不同的需要进行不同的配置. 以下以login页面输入firstname,lastname,和age为例进行说明.struts.xml中,成功的话转向成功页面.不成功的话转回到原页面. 首先建立userbean文件.文件名:UserBean.java包:struts2.login.bean文件内容:package struts

mysql 执行 cannot found mac安装mysql的两种方法（含配置）

mac安装mysql的两种方法(含配置 此时我们在命令行输入mysql -uroot -p命令会提示没有commod not found,我们还需要将mysql加入系统环境变量. (1).进入/usr/local/mysql/bin,查看此目录下是否有mysql,见pic6. (2).执行vim ~/.bash_profile 在该文件中添加mysql/bin的目录,见pic7: PATH=$PATH:/usr/local/mysql/bin 添加完成后,按esc,然后输入wq保存. 最后在命令

常用的两种spring、mybatis 配置方式

在之前的文章中总结了三种方式,但是有两种是注解sql的,这种方式比较混乱所以大家不怎么使用,下面总结一下常用的两种总结方式: 一. 动态代理实现 不用写dao的实现类 这种方式比较简单,不用实现dao层,只需要定义接口就可以了,这里只是为了记录配置文件所以程序写的很简单: 1.整体结构图: 2.三个配置文件以及一个映射文件 (1).程序入口以及前端控制器配置 web.xml <?xml version="1.0" encoding="UTF-8"?> &

spring 注入java.util.Properties 属性两种xml中的配置练习

<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:p="http://www.springframework.org/schema/p" xmlns:util="http://www.springframework.org/schema/util

DUI-分层窗口两种模式（SetLayeredWindowAttributes和UpdateLayeredWindow两种方法各有利弊）

LayeredWindow提供两种模式: 1.使用SetLayeredWindowAttributes去设置透明度, 完成窗口的统一透明,此时窗口仍然收到PAINT消息, 其他应用跟普通窗口一样. 2.使用UpdateLayeredWindow方法, 向系统提交包含bitmap的DC, 交由系统统一管理,此时再也收不到paint消息, 任何对窗口的改变,只能通过UpdateLayeredWindow来修改. 如果你不需要针对像素级别的不同透明,只需要使用SetLayeredWindowAttri

Java中有两种实现多线程的方式以及两种方式之间的区别

网上流传很广的是一个网上售票系统讲解.转发过来.已经不知道原文到底是出自哪里了. Java中有两种实现多线程的方式.一是直接继承Thread类,二是实现Runnable接口.那么这两种实现多线程的方式在应用上有什么区别呢? 为了回答这个问题,我们可以通过编写一段代码来进行分析.我们用代码来模拟铁路售票系统,实现通过四个售票点发售某日某次列车的100张车票,一个售票点用一个线程表示. 我们首先这样编写这个程序: Java代码    class ThreadTest extends Thread{

在Linux上实现一个可用的stateless双向静态NAT模块

关于Linux上如何配置NAT的资料已经不少,可谓铺天盖地!本文与此无关.本文提供一种iptables之外的方式.iptables?不!why?因为iptables配置的NAT是stateful的,它的实现依赖一个叫做conntrack的模块,什么是conntrack?Oh,NO!这可是我的专长,但我不想在本文中说它,认识我的人都知道,我扯这个话题我能扯上12个小时...都还扯不完.也许你不知道什么是stateful NAT,但是如果你是一个有心人,或者说是一个技术还算精湛的Linux网络管理员

两种流行Spring定时器配置：Java的Timer类和OpenSymphony的Quartz

1.Java Timer定时 首先继承java.util.TimerTask类实现run方法 import java.util.TimerTask; public class EmailReportTask extends TimerTask{ @Override public void run() { ... } } 在Spring定义 ... 配置Spring定时器 <bean id="scheduleReportTask" class="org.springfra

Mybatis-plus的两种分页插件的配置方式

第一种: package com.paic.ocss.gateway.admin.config; import com.baomidou.mybatisplus.plugins.PaginationInterceptor; import org.mybatis.spring.annotation.MapperScan; import org.springframework.context.annotation.Bean; import org.springframework.context.an