ASA8.4(2)-NAT配置

来源：互联网发布：windows snmp v2c 编辑：程序博客网时间：2024/05/21 16:23

如下是实验拓扑：

1. R2远程telnet访问R1的外网口10.10.10.3，配置nat：

ASA：

objetnetwork outside_static //映射的外网地址对象名称

host10.10.10.4 //映射的外网地址是10.10.10.4

objectnetwork inside_static //定义内网地址对象名称

host172.16.1.3 //需要映射的内网地址是172.16.1.3

nat(inside,outside) static outside_static //将内网地址对象转换成外网地址

通过如下命令查看nat的状态：

showxlate

ASA842(config-if)#show xlate

1 in use, 1 mostused

Flags: D - DNS,i - dynamic, r - portmap, s - static, I - identity, T - twice

NAT frominside:172.16.1.3 to outside:10.10.10.4

flags s idle0:14:10 timeout 0:00:00

show nat detail

ASA842(config-if)#show nat detail

Auto NATPolicies (Section 2)

1 (inside) to(outside) source static inside_static outside_static

translate_hits = 15, untranslate_hits = 33

Source - Origin: 172.16.1.3/32, Translated:10.10.10.4/32

在R2上telnet10.10.10.3：

R2#telnet10.10.10.3

Trying10.10.10.3 ... Open

User AccessVerification

Username: ccie

Password:

R1>en

Password:

R1#show users

Line User Host(s) Idle Location

0 con 0 idle 00:13:58

* 98 vty 0 ccie idle 00:00:00 10.10.10.4

2. R2上的loopback0访问外网时，转换成10.10.10.100这个地址：

ASA：

object network outside_internet //定义公网对象名称

host 10.10.10.200 //定义映射后的公网地址

object network inside_client //定义内网段名称

subnet 2.2.2.0255.255.255.0 //定义需要被转换的内网段

nat (inside,outside) dynamic outside_internet //从inside到outside这个方向的地址访问时按照动态地址转换成outside_internet地址

在R2上telnetR110.10.10.3：

R2#telnet10.10.10.3 /source-interface loo0

Trying10.10.10.3 ... Open

UserAccess Verification

Username:ccie

Password:

R1>en

Password:

R1#showusers

Line User Host(s) Idle Location

0 con 0 idle 00:05:24

* 98 vty 0 ccie idle 00:00:00 10.10.10.200

Interface User Mode Idle Peer Address

3. R2的loo0地址段访问外网时，转换成10.10.10.50-10.10.10.60地址池中的一个地址

ASA：

object network pat-pool //定义地址池名称

range 10.10.10.50 10.10.10.60 //定义映射后的地址池范围

object network inside_client //定义内网子网段名称

sunet 2.2.2.0 255.255.255.0 //定义内网子网段

nat (inside,outside) dynamic pat_pool pat-pool round-robin//按照地址池转换成地址池对象中的地址

在R2上telnetR1的地址10.10.10.3：

R2#telnet10.10.10.3 /source-interface loo0

Trying10.10.10.3 ... Open

UserAccess Verification

Username:ccie

Password:

R1>en

Password:

R1#showusers

Line User Host(s) Idle Location

0 con 0 idle 00:34:38

* 98 vty0 ccie idle 00:00:00 10.10.10.60

Interface User Mode Idle Peer Address

在ASA上查看：

ASA842(config)#show xlate

1 in use,6 most used

Flags: D- DNS, i - dynamic, r - portmap, s - static, I - identity, T - twice

TCP PAT from inside:2.2.2.2/11038 tooutside:10.10.10.60/11038 flags ri idle 0:04:40 timeout 0:00:30

ASA842(config)#show nat detail

Auto NATPolicies (Section 2)

1 (inside) to (outside) source dynamic inside_subnet pat-poolpat-pool round-robin

translate_hits =26, untranslate_hits = 1

Source - Origin: 2.2.2.0/24, Translated (PAT):10.10.10.50-10.10.10.60

在ASA上开启logging功能，查看有这么一条记录：

%ASA-6-302013: Built outbound TCP connection 236for outside:10.10.10.3/23 (10.10.10.3/23) to inside:2.2.2.2/11041(10.10.10.52/11041)//这条记录说明pat转换时，轮询功能起了作用

4. R2上的172.16.1.3地址访问外网时，转换成ASA的出接口地址：

ASA：

object network inside_client

host 172.16.1.3

nat (inside,outside) dynamic interface

在R2上telnetR1的10.10.10.3：

R2#telnet10.10.10.3

Trying10.10.10.3 ... Open

User AccessVerification

Username:ccie

Password:

R1>en

Password:

R1#showuse

R1#showusers

Line User Host(s) Idle Location

0 con 0 idle 00:00:38

* 98 vty0 ccie idle 00:00:00 10.10.10.2

Interface User Mode Idle Peer Address

在ASA上查看NAT状态:

ASA842(config-network-object)#show nat detail

Auto NATPolicies (Section 2)

1(inside) to (outside) source dynamic inside_client interface

translate_hits = 1, untranslate_hits = 0

Source - Origin: 172.16.1.3/32, Translated: 10.10.10.2/24

ASA842(config-network-object)#show xlate

1 in use,6 most used

Flags: D- DNS, i - dynamic, r - portmap, s - static, I - identity, T - twice

TCP PAT from inside:172.16.1.3/11043 to outside:10.10.10.2/53962flags ri idle 0:08:26 timeout 0:00:30

0 0