NAT转换配置

配置环境：华为最新模拟器

1、要求：

现有一台防火墙和两台PC机。要求用这些设备模拟NAT转换，其中一台PC机代表一个局域网，另一台PC机代表广域网，局域网内用的是私有IP地址，广域网用的是公有IP地址，在局域网设备要访问广域网需要用NAT转换。

2、网络拓扑图：

用亿图绘图工具绘制出网络拓扑图为如图1所示：

图1：网络拓扑图

3、设备配置

(1)防火墙的配置：

[R1]sysname firewall

[firewall]

Apr 14 2014 22:24:38-08:00 firewall DS/4/DATASYNC_CFGCHANGE:OID 1.3.6.1.4.1.2011.

5.25.191.3.1 configurations have been changed. The current change number is 2, th

e change loop count is 0, and the maximum number of records is 4095.

[firewall]

[firewall]int et0/0/0

[firewall-Ethernet0/0/0]ip add

[firewall-Ethernet0/0/0]ip address 192.168.2.1 ?

[firewall-Ethernet0/0/0]ip address 192.168.2.1 ?

INTEGER<0-32>  Length of IP address mask

X.X.X.X        IP address mask

[firewall-Ethernet0/0/0]ip address 192.168.2.1 24

[firewall-Ethernet0/0/0]int et0/0/1

[firewall-Ethernet0/0/1]ip add

[firewall-Ethernet0/0/1]ip address 192.168.1.4 24

(2)PC1的配置：

4、未配置NAT转换的测试

(1)在PC1上ping192.168.2.1和192.168.1.1，结果如下：

(2)在PC1上ping192.168.2.1和192.168.1.4，结果如下：

5、NAT转换配置

firewall]acl number 2000

[firewall-acl-basic-2000]

firewall-acl-basic-2000]rule 10 permit sou

[firewall-acl-basic-2000]rule 10 permit source ?

X.X.X.X  Address of source

any      Any source

[firewall-acl-basic-2000]rule 10 permit source 192.168.2.0 ?

0        Wildcard bits : 0.0.0.0 ( a host )

X.X.X.X  Wildcard of source

[firewall-acl-basic-2000]rule 10 permit source 192.168.2.0 0.0.0.255

[firewall-acl-basic-2000]

[firewall-acl-basic-2000]rule20 deny sou

[firewall-acl-basic-2000]rule20 deny source an

[firewall-acl-basic-2000]rule 20 deny source any

[firewall-acl-basic-2000]dis acl all

Total nonempty ACL number is 1

Basic ACL 2000, 2 rules

ACL's step is 5

rule 10 permit source 192.168.2.0 0.0.0.255 (0 times matched)

rule 20 deny (0 times matched)

[firewall-Ethernet0/0/1]nat ou

[firewall-Ethernet0/0/1]nat outbound ?

INTEGER<2000-3999>  Apply basic or advanced ACL

[firewall-Ethernet0/0/1]nat outbound 2000 in

[firewall-Ethernet0/0/1]nat outbound 2000 interface ?

loopback  Interface type

[firewall-Ethernet0/0/1]nat outbound 2000

6、NAT转换配置验证