路由器只有一个公网ip地址,同时有配置了nat static映射公网ip地址问题
Server---交换机---RT1`------ISP-----RT2---PC
外网接口配置了nat static映射到内部服务器,此时互联网的PC和RT1之间有业务交互,导致业务失败。原因是PC访问路由器的外网端口的ip地址,直接映射到了内网server。
测试过程:
环境:
硬件:MSR30-20(V5平台)
软件:windows xp,CRT
拓扑:Server---交换机---RT1`------ISP-----RT2---PC
原理:访问ftp服务器,查看debug信息
配置:
RT1:
[H3C]ftp server enable
[H3C]local-user 800
New local user added.
[H3C-luser-800]service-type ftp
[H3C-luser-800]password simple 800800
[H3C-luser-800]authorization-attribute level 3
[H3C]nat static 192.168.1.2 202.0.0.1
<H3C>terminal debugging
Info: Current terminal debugging is on.
<H3C>terminal monitor
Info: Current terminal monitor is on.
<H3C>debugging ip packet
Info: Ip packet debugging is enabled!
<H3C>debugging nat event
Info: NAT event debugging is enabled!
<H3C>debugging nat packet
Info: NAT packet debugging is enabled!
测试:
C:\Documents and Settings\Administrator>ftp 202.0.0.1
结果:
RT1:
1. 没有应用nat outbound static的时候:
C:\Documents and Settings\Administrator>ftp 202.0.0.1
Connected to 202.0.0.1.
220 FTP service ready.
User (202.0.0.1:(none)): 800
331 Password required for 800.
Password:
230 User logged in.
ftp>
ftp>
2. 应用nat outbound static的时候:
[H3C-Ethernet0/1]nat outbound static
<H3C>
*Mar 28 22:04:44:682 2012 H3C NAT/7/debug:
(Ethernet0/1-in :)Pro : TCP
( 202.0.1.2: 3748 - 202.0.0.1: 21) ------>
( 202.0.1.2: 3748 - 192.168.1.2: 21)
*Mar 28 22:04:44:683 2012 H3C NAT/7/debug:
(Ethernet0/1-out :)Pro : TCP
( 192.168.1.2: 21 - 202.0.1.2: 3748) ------>
( 202.0.0.1: 21 - 202.0.1.2: 3748)
*Mar 28 22:04:45:183 2012 H3C NAT/7/debug:
(Ethernet0/1-in :)Pro : TCP
( 202.0.1.2: 3748 - 202.0.0.1: 21) ------>
( 202.0.1.2: 3748 - 192.168.1.2: 21)
*Mar 28 22:04:45:184 2012 H3C NAT/7/debug:
(Ethernet0/1-out :)Pro : TCP
( 192.168.1.2: 21 - 202.0.1.2: 3748) ------>
( 202.0.0.1: 21 - 202.0.1.2: 3748)
*Mar 28 22:04:45:620 2012 H3C NAT/7/debug:
(Ethernet0/1-in :)Pro : TCP
( 202.0.1.2: 3748 - 202.0.0.1: 21) ------>
( 202.0.1.2: 3748 - 192.168.1.2: 21)
*Mar 28 22:04:45:621 2012 H3C NAT/7/debug:
(Ethernet0/1-out :)Pro : TCP
( 192.168.1.2: 21 - 202.0.1.2: 3748) ------>
( 202.0.0.1: 21 - 202.0.1.2: 3748)
PC主机:
Microsoft Windows XP [版本 5.1.2600]
(C) 版权所有 1985-2001 Microsoft Corp.
C:\Documents and Settings\Administrator>ftp 202.0.0.1
> ftp: connect :未知错误号
ftp>
说明:
外网接口配置了nat static映射到内部服务器,此时互联网的PC和RT1之间有业务交互,导致业务失败。原因是PC访问路由器的外网端口的ip地址,直接映射到了内网server。
该案例暂时没有网友评论
✖
案例意见反馈
亲~登录后才可以操作哦!
确定你的邮箱还未认证,请认证邮箱或绑定手机后进行当前操作