NAT Cisco

360: NAT

15

NAT (Network Address Translation) Cisco.


NAT (Static NAT)

, NAT . .

, - , .

Static NAT

, - IPv4. NAT, -. - IPv4-. NAT IPv4- .

NAT :

  1. (inside local) (inside global) . , 192.168.1.5 208.165.100.5 NAT .
  2. , , (inside) (outside) NAT. Serial 0/0/0 , Serial 0/1/0 .

, Serial 0/0/0 IPv4 (192.168.1.5), . , Serial 0/1/0, IPv4 (208.165.100.5), (192.168.1.5) .

:

  1. . ip nat inside source static [ _IP _IP]. no ip nat inside source static. , , ip nat inside source static [ _IP _ _].
  2. . , interface[ ] ip nat inside
  3. , ip nat outside

:

Router(config)# ip nat inside source static 192.168.1.5 208.165.100.5
Router(config)# interface serial0/0/0
Router(config-if)#ip nat inside
Router(config-if)#exit
Router(config)# interface serial0/1/0
Router(config-if)#ip nat outside

:

  1. -. -, IPv4- 208.165.100.5. -.
  2. , NAT, NAT. IPv4 NAT .
  3. 208.165.100.5 192.168.1.5 -.
  4. - , 192.168.1.5.
  5. - NAT -, 192.168.1.5. NAT , 192.168.1.5 208.165.100.5 Serial 0/1/0
  6. , . .

NAT

NAT show ip nat translations. NAT. , , NAT.

Router#show ip nat translations 
Pro 	Inside global 	Inside local 	Outside local 	  Outside global
--- 	208.165.100.5	192.168.1.5	208.165.100.70  208.165.100.70

show ip nat statistics. , NAT, , .

Router#show ip nat statistics
Total active translations: 1 (1 static, 0 dynamic; 0 extended)
Peak translations: 2, occurred 00:00:21 ago
Outside interfaces:
	Serial0/1/0
Inside interfaces:
	Serial0/0/0
Hits:7 Misses:0

, NAT , , clear ip nat statistics .


NAT (Dynamic NAT)

NAT , NAT ( IP-). NAT IPv4 . NAT, NAT, , NAT.

Dynamic NAT

. 192.168.1.0/24 192.168.2.0/24 , NAT 208.165.100.5 - 208.165.100.15.

(inside global address pool) . NAT . , . , , .

:

  1. , ip nat pool [ _ip _ip]. . IP- IP- . netmask prefix-length .
  2. access-list (ACL), , . access-list [_ACL] permit source [wildcard_]. access-list ( ). ACL , deny all.
  3. ACL , ip nat inside source list [_ACL] number pool [_]. , () ().
  4. , , NAT, , .
  5. , , NAT, , .

:

Router(config)# ip nat pool MerionNetworksPool 208.165.100.5 208.165.100.15 netmask 255.255.255.0
Router(config)# access-list 1 permit 192.168.0.0 0.0.255.255
Router(config)#ip nat inside source list 1 pool MerionNetworksPool
Router(config)# interface serial0/0/0
Router(config-if)#ip nat inside
Router(config-if)#exit
Router(config)# interface serial0/1/0
Router(config-if)#ip nat outside

:

  1. 192.168.1.10 192.168.2.10 208.165.100.70
  2. 192.168.1.10. , NAT, NAT, , . ACL , NAT. IP- , , 192.168.1.10 . R2 , 208.165.200.5. IPv4- (192.168.1.10) , (208.165.200.5) NAT. 192.168.2.10 , , - 208.165.200.6.
  3. .
  4. , 208.165.200.5. , 208.165.200.6.
  5. 208.165.200.5, NAT 192.168.1.10 . , .
  6. , . .

NAT

show ip nat , , , . verbose , , . 24 , ip nat translation timeout [__] .

, clear ip nat translation. NAT. , , . , . . .

show ip nat statistics , NAT, .

ACL, show access-lists.


Port Address Translation (PAT)

PAT ( NAT overload) , . , IPv4- IPv4-. , TCP UDP .

, , 65 536 IP-. , IP-, 4000.

PAT, , IPv4-. - IPv4- , IPv4-, -.


PAT IP-

IPv4-, , PAT. NAT, , . .

NAT, , overload, PAT.

PAT :

  1. , PAT , ip nat pool [ _ip _ip] netmask [] | prefix-length [_].
  2. access-list, , . access-list [_ACL] permit source [wildcard_].
  3. PAT, Overload. ip nat inside source list [_ACL] number pool [_] overload.
  4. , , NAT, . ip nat inside ip nat outside

, , PAT:

Router(config)# ip nat pool MerionNetworksPool2 208.165.100.5 208.165.100.15 netmask 255.255.255.0
Router(config)# access-list 1 permit 192.168.0.0 0.0.255.255
Router(config)#ip nat inside source list 1 pool MerionNetworksPool2 overload
Router(config)# interface serial0/0/0
Router(config-if)#ip nat inside
Router(config-if)#exit
Router(config)# interface serial0/1/0
Router(config-if)#ip nat outside

PAT IPv4-
 Port Address Translation (PAT)

PAT IP . 192.168.0.0/16 ( ACL), , IPv4 208.165.99.225 ( IPv4 S0 /1/0). NAT.

:

  1. access-list , access-list [_ACL] permit source [wildcard_].
  2. , ip nat inside source list [_ACL] interface [ ] overload
  3. ip nat inside ip nat outside.

NAT, , IP . NAT .

:
Router(config)# access-list 1 permit 192.168.0.0 0.0.255.255
Router(config)# ip nat source list 1 interface serial0/1/0 overload
Router(config)# interface serial0/0/0
Router(config-if)#ip nat inside
Router(config-if)#exit
Router(config)# interface serial0/1/0
Router(config-if)#ip nat outside

PAT , .

PAT :

  1. -. 192.168.1.10 TCP 1444, 192.168.2.10 TCP 1444
  2. , PAT, IPv4- 208.165.99.225 (inside global address). NAT 1444, PAT 208.165.101.20.
  3. , PAT IPv4- - 208.165.99.225. , PAT 208.165.99.225. , PAT , PAT , . NAT 1445 . 208.165.99.225 1444, (1445) NAT . .
  4. , . , 208.165.99.225, , .
  5. , NAT . 208.165.99.255 , 1444. , IPv4 192.168.1.10, .
  6. , . IPv4 208.165.99.225 , 1445, . IPv4 192.168.2.10 1444, NAT.

Port Address Translation (PAT)

PAT , NAT. show ip nat translations IP show ip nat statistics , NAT, .

Router#show ip nat statistics
Total active translations: 2 (0 static, 2 dynamic; 2 extended)
Peak translations: 2, occurred 00:00:07 ago
Outside interfaces:
	Serial0/1/0
Inside interfaces:
	Serial0/0/0
Hits:4 Misses:0
CEF Translated packets: 4, CEF Punted packets:0
Expired translations: 0
Dynamic mappings:
-- Inside Source
[Id: 3] access-list 1 pool MerionNetworksPool2 refcount 2
pool MerionNetworksPool2: netmask 255.255.255.0
	start 208.165.100.5 end 208.165.100.15
	type generic, total addressers 10, allocated 1(10%),
misses 0
Total doors: 0
Appl doors: 0
Normal doors: 0
Queued Packets: 0

, debug ip nat, , . debug ip nat detailed, . , , . .

Router#debug ip nat
IP NAT debugging is on
Router#
*Aug 24 16:20:331:670: NAT*: s=192.168.1.10->208.165.99.225 d=208.165.101.20 [3730]
*Aug 24 16:20:331:682: NAT*: s=208.165.101.20 d=208.165.99.225 ->192.168.1.10 [4156]
*Aug 24 16:20:331:698: NAT*: s=192.168.1.10->208.165.99.225 d=208.165.101.20 [3731]
*Aug 24 16:20:331:702: NAT*: s=192.168.1.10->208.165.99.225 d=208.165.101.20 [3732]
*Aug 24 16:20:331:710: NAT*: s=208.165.101.20 d=208.165.99.225 ->192.168.1.10 [4157]

:

  • * () NAT , (fast-switched path). , .
  • s= - IP
  • a.b.c.d ? w.x.y.z - , a.b.c.d w.x.y.z.
  • d= - IP
  • [xxxx] - - IP.

50% Merion Academy