Secpath1800F NAT功能的配置

 

Secpath1800F NAT功能的配置

 

 

一、  组网需求：

使用Secpath1800F 的用户，可以通过NAT 功能使内部使用私网地址的用户连接到Internet。

 

二、  组网图：

 

 

            

 

 

三、  配置步骤：

     适用版本：Secpath1800F Version 3.30 Release 0348(08) 及以前版本

 

acl number 2001                     // 定义匹配 NAT 转换的内网地址

rule 0 permit source 10.1.1.0 0.0.0.255

acl number 2002                     // 定义匹配 NAT 转换的内网地址

rule 0 permit source 10.1.2.0 0.0.0.255

#

acl number 3002                     // 定义匹配 NAT 转换的内网地址

rule 0 permit ip source 10.1.2.0 0.0.0.255

#

sysname Eudemon

#

firewall packet-filter default permit interzone local trust direction inbound

firewall packet-filter default permit interzone local trust direction outbound

firewall packet-filter default permit interzone local untrust direction inbound

firewall packet-filter default permit interzone local untrust direction outboun

firewall packet-filter default permit interzone local dmz direction inbound

firewall packet-filter default permit interzone local dmz direction outbound

firewall packet-filter default permit interzone trust untrust direction inbound

firewall packet-filter default permit interzone trust untrust direction outbound

firewall packet-filter default permit interzone trust dmz direction inbound

firewall packet-filter default permit interzone trust dmz direction outbound

firewall packet-filter default permit interzone dmz untrction inbound

firewall packet-filter default permit interzone dmz untrust direction outbound

#

nat address-group 10 202.96.199.10 202.96.199.10   //定义用来转换的公网地址（段）

nat address-group 20 202.96.199.20 202.96.199.20

nat address-group 30 202.96.199.30 202.96.199.30

#

firewall mode route

#

firewall statistic system enable

#

interface Aux0

 async mode flow

 link-protocol ppp

#

interface Ethernet0/0/0

#

interface Ethernet0/0/1

#

interface Ethernet1/0/0

#

interface Ethernet1/0/1                     // 设置端口地址

 ip address 192.168.1.254 255.255.255.0

#

interface Ethernet1/0/2                     

 ip address 202.96.199.254 255.255.255.0

#

interface Ethernet1/0/3

#

interface Ethernet1/0/4

#

interface Ethernet1/0/5

#

interface Ethernet1/0/6

#

interface Ethernet1/0/7

#

interface NULL0

#

firewall zone local

 set priority 100

#

firewall zone trust                        // 端口加入域

 set priority 85

 add interface Ethernet1/0/1

#

firewall zone untrust

 set priority 5

 add interface Ethernet1/0/2

#

firewall zone dmz

 set priority 50

#

firewall interzone local trust

#

firewall interzone local untrust

#

firewall interzone local dmz

#

firewall interzone trust untrust

 nat outbound 2001 address-group 10      // 在做转换的域间绑定相应规则

 nat outbound 3002 address-group 20      // 在做转换的域间绑定相应规则

#

firewall interzone trust dmz

#

firewall interzone dmz untrust

#

aaa

authentication-scheme default

#

authorization-scheme default

#

accounting-scheme default

#

domain default

#

#

ip route-static 10.1.0.0 255.255.0.0 192.168.1.133

#

user-interface con 0

user-interface aux 0

user-interface vty 0 4

#

return

 

四、  配置关键点：

 无