内网IP映射到外网
- 1关注
- 1收藏，1228浏览
问题描述：
对齐方式
- 靠左
- 居中
- 靠右
你好，我的防火墙型号是H3C SecPath F1000-AI-35，H3C Comware Software, Version 7.1.064, Release 8860P1211。 目前的拓扑接口：最上面是卫生专网，下面依次是防火墙、内网核心。 卫生专网接在防火墙的3口（11.73.0.36/29），防火墙的1口往下接在内网核心，配置见附件。
现要求卫生专网中的11.73.0.19服务器A能访问医院内网中的192.192.192.22的服务器B，现状是B能ping通A，但Aping不通B。 请看下配置再指点，辛苦！
问题1：若要求A能访问B，是不是可以在A的出口设置ip route-static 192.192.192.22 255.255.255.255 11.73.0.36？这样卫生专网可以直接访问到192.192.192.22吗？
问题2：如何把服务器B的IP映射到11.73.0段上？防火墙的域间策略如何设置，请详细说下具体配置。
问题3：卫生局那边给了一个专网地址11.73.0.35 255.255.255.248 11.73.0.38，说是可以启用服务器B的双网卡，拉一根网线插到防火墙上，但防火墙往专网的线已经被3口占用，假如我有一根网线把服务器B的第二个网卡连到防火墙的12口，把服务器B的第二网卡设成11.73.0.35的IP，是不是应该把防火墙的3口和12口都改成二层，然后起个vlan 100，interface vlan 100 ip add 11.73.0.36/29，然后把这两个口划到vlan100下，这样是否可以？如果可以的话，麻烦写下具体配置，原来的配置有nat outbound等等。万分感谢！！！
- 2021-10-25提问
- 举报
-
(0)
最佳答案
你的这个需求是典型的源地址转换和目的地址转换应用，首先把专网的相关信息梳理清楚：
1、11.73.0.35/255.255.255.248 /11.73.0.38为分配给这个单位的IP地址，可以设置在防火墙的外部端口上，其中11.73.0.35为IP地址，255.255.255.248为子网掩码，11.73.0.38为网关
2、11.73.0.36可以规划为卫生专网内部192.192.192.22的外部映射地址；
3、防火墙上至少由以下配置：
# ip route-static 0.0.0.0 0.0.0.0 11.73.0.38 假如没有其他外部链路的话，可以用0.0.0.0缺省路由
#acl basic 2001
rule 0 permit source 192.192.192. 0 0.0.0.255
#interface GigabitEthernet1/0/3
ip address
11.73.0.35 255.255.255.248
nat outbound 2001
nat server protocol tcp global 11.73.0.36 端口 inside 192.192.192.22 端口
#
除了这个基本配置外，需要在防火墙上配置安全策略，可参照以下链接http://www.h3c.com.cn/cn/Service/Document_Software/Document_Center/Home/Security/00-Public/Configure/Web_Configure/H3C_WCG(V7)-6W302/07/?CHID=547855
- 2021-10-25回答
- 评论(1)
- 举报
-
(0)
你好，3接口上已经有IP了，ip address 11.73.0.36 255.255.255.248。以前他这边有个傻瓜交换机，专网线接在傻瓜上，然后傻瓜出一根线接在防火墙的3口，然后另一个线接在服务器上，服务器上的IP设置成11.73.0.35，这样是额可以的。但现在不想再加个傻瓜。就是想服务器直连到防火墙上，如何设置相当于加了一个傻瓜交换机
在3口上配置nat server global 要映射的地址 inside 192.192.192.22
如果要双向访问就在最后边机上reversible
- 2021-10-25回答
- 评论(4)
- 举报
-
(0)
问题二：推荐用安全策略，转目的方向，放通源到转换后的IP，反向转源，放通转换前的源地址； 问题三：二层口不能配置NAT
内网核心： [neiwanghexin]dis cu # version 7.1.070, Release 7557P03 # sysname neiwanghexin # forward-path-detection enable # mirroring-group 1 local # system-working-mode standard xbar load-balance password-recovery enable # vlan 1 # vlan 10 description mgmt # vlan 11 description vmotion # vlan 12 description service # vlan 100 description 1cengwangguan # vlan 200 description 2cengwangguan # vlan 255 description To-shequ # vlan 300 description 3-6cengwangguan # vlan 400 description 7-11cengwangguan # vlan 500 description fuwuqi # vlan 600 description zonghelouneiwang # vlan 700 # vlan 800 description xinxike # vlan 1000 # vlan 1100 description gongweiwang # stp global enable # ftth # interface NULL0 # interface Vlan-interface1 # interface Vlan-interface10 ip address 192.168.10.254 255.255.255.0 # interface Vlan-interface11 ip address 192.168.11.254 255.255.255.0 # interface Vlan-interface12 ip address 192.168.12.254 255.255.255.0 # interface Vlan-interface100 description 1ceng ip address 192.168.1.254 255.255.255.0 # interface Vlan-interface200 description 2ceng ip address 192.168.3.254 255.255.255.0 # interface Vlan-interface255 ip address 192.168.255.1 255.255.255.252 # interface Vlan-interface300 description 3-6ceng ip address 192.168.4.254 255.255.255.0 # interface Vlan-interface400 description 7-10ceng ip address 192.168.5.254 255.255.255.0 # interface Vlan-interface500 description fuwuqi ip address 192.192.192.254 255.255.255.0 # interface Vlan-interface600 ip address 192.168.6.254 255.255.255.0 # interface Vlan-interface700 ip address 192.168.7.254 255.255.255.0 # interface Vlan-interface800 description xinxike ip address 192.168.8.254 255.255.255.0 # interface Vlan-interface1000 ip address 1.1.1.1 255.255.255.0 # interface Vlan-interface1100 ip address 192.168.9.253 255.255.255.0 # interface GigabitEthernet0/0/1 port link-mode bridge port link-type trunk undo port trunk permit vlan 1 port trunk permit vlan 10 to 12 500 port trunk pvid vlan 10 mirroring-group 1 mirroring-port both # interface GigabitEthernet0/0/2 port link-mode bridge port link-type trunk undo port trunk permit vlan 1 port trunk permit vlan 10 to 12 500 port trunk pvid vlan 10 mirroring-group 1 mirroring-port both # interface GigabitEthernet0/0/3 port link-mode bridge port link-type trunk undo port trunk permit vlan 1 port trunk permit vlan 10 to 12 500 port trunk pvid vlan 10 mirroring-group 1 mirroring-port both # interface GigabitEthernet0/0/4 port link-mode bridge port link-type trunk undo port trunk permit vlan 1 port trunk permit vlan 10 to 12 500 port trunk pvid vlan 10 mirroring-group 1 mirroring-port both # interface GigabitEthernet0/0/5 port link-mode bridge port link-type trunk undo port trunk permit vlan 1 port trunk permit vlan 10 to 12 500 port trunk pvid vlan 10 mirroring-group 1 mirroring-port both # interface GigabitEthernet0/0/6 port link-mode bridge port link-type trunk undo port trunk permit vlan 1 port trunk permit vlan 10 to 12 500 port trunk pvid vlan 10 mirroring-group 1 mirroring-port both # interface GigabitEthernet0/0/7 port link-mode bridge port link-type trunk undo port trunk permit vlan 1 port trunk permit vlan 10 to 12 500 port trunk pvid vlan 10 mirroring-group 1 mirroring-port both # interface GigabitEthernet0/0/8 port link-mode bridge port link-type trunk undo port trunk permit vlan 1 port trunk permit vlan 10 to 12 500 port trunk pvid vlan 10 mirroring-group 1 mirroring-port both # interface GigabitEthernet0/0/9 port link-mode bridge port link-type trunk undo port trunk permit vlan 1 port trunk permit vlan 10 to 12 500 port trunk pvid vlan 10 mirroring-group 1 mirroring-port both # interface GigabitEthernet0/0/10 port link-mode bridge port link-type trunk undo port trunk permit vlan 1 port trunk permit vlan 10 to 12 500 port trunk pvid vlan 10 mirroring-group 1 mirroring-port both # interface GigabitEthernet0/0/11 port link-mode bridge port link-type trunk undo port trunk permit vlan 1 port trunk permit vlan 10 to 12 500 port trunk pvid vlan 10 mirroring-group 1 mirroring-port both # interface GigabitEthernet0/0/12 port link-mode bridge port link-type trunk undo port trunk permit vlan 1 port trunk permit vlan 10 to 12 500 port trunk pvid vlan 10 mirroring-group 1 mirroring-port both # interface GigabitEthernet0/0/13 port link-mode bridge port link-type trunk undo port trunk permit vlan 1 port trunk permit vlan 10 to 12 500 port trunk pvid vlan 10 mirroring-group 1 mirroring-port both # interface GigabitEthernet0/0/14 port link-mode bridge port link-type trunk undo port trunk permit vlan 1 port trunk permit vlan 10 to 12 500 port trunk pvid vlan 10 mirroring-group 1 mirroring-port both # interface GigabitEthernet0/0/15 port link-mode bridge port link-type trunk undo port trunk permit vlan 1 port trunk permit vlan 10 to 12 500 port trunk pvid vlan 10 mirroring-group 1 mirroring-port both # interface GigabitEthernet0/0/16 port link-mode bridge port link-type trunk undo port trunk permit vlan 1 port trunk permit vlan 10 to 12 500 port trunk pvid vlan 10 mirroring-group 1 mirroring-port both # interface GigabitEthernet0/0/17 port link-mode bridge port link-type trunk undo port trunk permit vlan 1 port trunk permit vlan 10 to 12 500 port trunk pvid vlan 10 mirroring-group 1 mirroring-port both # interface GigabitEthernet0/0/18 port link-mode bridge port link-type trunk undo port trunk permit vlan 1 port trunk permit vlan 10 to 12 500 port trunk pvid vlan 10 mirroring-group 1 mirroring-port both # interface GigabitEthernet0/0/19 port link-mode bridge port link-type trunk undo port trunk permit vlan 1 port trunk permit vlan 10 to 12 500 port trunk pvid vlan 10 mirroring-group 1 mirroring-port both # interface GigabitEthernet0/0/20 port link-mode bridge port link-type trunk undo port trunk permit vlan 1 port trunk permit vlan 10 to 12 500 port trunk pvid vlan 10 mirroring-group 1 mirroring-port both # interface GigabitEthernet0/0/21 port link-mode bridge port access vlan 10 # interface GigabitEthernet0/0/22 port link-mode bridge port access vlan 10 # interface GigabitEthernet0/0/23 port link-mode bridge port access vlan 10 # interface GigabitEthernet0/0/24 port link-mode bridge port access vlan 255 # interface GigabitEthernet2/0/1 port link-mode bridge port access vlan 1100 # interface GigabitEthernet2/0/2 port link-mode bridge port access vlan 500 mirroring-group 1 mirroring-port both # interface GigabitEthernet2/0/3 port link-mode bridge port access vlan 500 mirroring-group 1 mirroring-port both # interface GigabitEthernet2/0/4 port link-mode bridge # interface GigabitEthernet2/0/5 port link-mode bridge # interface GigabitEthernet2/0/6 port link-mode bridge # interface GigabitEthernet2/0/7 port link-mode bridge # interface GigabitEthernet2/0/8 port link-mode bridge # interface GigabitEthernet2/0/9 port link-mode bridge # interface GigabitEthernet2/0/10 port link-mode bridge # interface GigabitEthernet2/0/11 port link-mode bridge # interface GigabitEthernet2/0/12 port link-mode bridge # interface GigabitEthernet2/0/13 port link-mode bridge # interface GigabitEthernet2/0/14 port link-mode bridge # interface GigabitEthernet2/0/15 port link-mode bridge # interface GigabitEthernet2/0/16 port link-mode bridge # interface GigabitEthernet2/0/17 port link-mode bridge # interface GigabitEthernet2/0/18 port link-mode bridge # interface GigabitEthernet2/0/19 port link-mode bridge # interface GigabitEthernet2/0/20 port link-mode bridge # interface GigabitEthernet2/0/21 port link-mode bridge # interface GigabitEthernet2/0/22 port link-mode bridge # interface GigabitEthernet2/0/23 port link-mode bridge # interface GigabitEthernet2/0/24 port link-mode bridge # interface GigabitEthernet2/0/25 port link-mode bridge # interface GigabitEthernet2/0/26 port link-mode bridge # interface GigabitEthernet2/0/27 port link-mode bridge # interface GigabitEthernet2/0/28 port link-mode bridge # interface GigabitEthernet2/0/29 port link-mode bridge # interface GigabitEthernet2/0/30 port link-mode bridge # interface GigabitEthernet2/0/31 port link-mode bridge # interface GigabitEthernet2/0/32 port link-mode bridge # interface GigabitEthernet2/0/33 port link-mode bridge # interface GigabitEthernet2/0/34 port link-mode bridge # interface GigabitEthernet2/0/35 port link-mode bridge # interface GigabitEthernet2/0/36 port link-mode bridge # interface GigabitEthernet2/0/37 port link-mode bridge # interface GigabitEthernet2/0/38 port link-mode bridge # interface GigabitEthernet2/0/39 port link-mode bridge # interface GigabitEthernet2/0/40 port link-mode bridge # interface GigabitEthernet2/0/41 port link-mode bridge port access vlan 500 mirroring-group 1 mirroring-port both # interface GigabitEthernet2/0/42 port link-mode bridge port access vlan 500 mirroring-group 1 mirroring-port both # interface GigabitEthernet2/0/43 port link-mode bridge port access vlan 800 mirroring-group 1 mirroring-port both # interface GigabitEthernet2/0/44 port link-mode bridge port access vlan 500 mirroring-group 1 mirroring-port both # interface GigabitEthernet2/0/45 port link-mode bridge port access vlan 500 mirroring-group 1 mirroring-port both # interface GigabitEthernet2/0/46 port link-mode bridge mirroring-group 1 monitor-port # interface GigabitEthernet2/0/47 port link-mode bridge port access vlan 500 mirroring-group 1 mirroring-port both # interface GigabitEthernet2/0/48 port link-mode bridge port access vlan 500 mirroring-group 1 mirroring-port both # interface M-GigabitEthernet0/0/0 # interface Ten-GigabitEthernet0/0/25 port link-mode bridge port link-type trunk port trunk permit vlan all mirroring-group 1 mirroring-port both # interface Ten-GigabitEthernet0/0/26 port link-mode bridge port link-type trunk port trunk permit vlan all mirroring-group 1 mirroring-port both # interface Ten-GigabitEthernet0/0/27 port link-mode bridge port access vlan 700 # interface Ten-GigabitEthernet0/0/28 port link-mode bridge # scheduler logfile size 16 # line class aux user-role network-admin # line class vty user-role network-operator # line aux 0 authentication-mode scheme user-role network-admin # line vty 0 63 user-role network-operator # ip route-static 0.0.0.0 0 192.192.192.157 ip route-static 10.79.0.0 16 192.168.9.254 ip route-static 11.1.0.0 16 192.168.9.254 ip route-static 11.56.254.0 24 192.192.192.43 ip route-static 11.65.0.0 16 192.168.9.254 ip route-static 11.73.0.0 24 192.168.9.254 ip route-static 131.252.88.0 24 192.192.192.43 ip route-static 172.16.111.0 24 192.192.192.43 ip route-static 192.168.14.0 24 192.168.9.254 ip route-static 192.168.31.0 24 192.168.255.2 ip route-static 192.168.33.0 24 192.168.255.2 # info-center loghost 192.192.192.161 facility local0 info-center source default loghost level debugging # radius scheme system user-name-format without-domain # domain system # domain default enable system # role name level-0 description Predefined level-0 role # role name level-1 description Predefined level-1 role # role name level-2 description Predefined level-2 role # role name level-3 description Predefined level-3 role # role name level-4 description Predefined level-4 role # role name level-5 description Predefined level-5 role # role name level-6 description Predefined level-6 role # role name level-7 description Predefined level-7 role # role name level-8 description Predefined level-8 role # role name level-9 description Predefined level-9 role # role name level-10 description Predefined level-10 role # role name level-11 description Predefined level-11 role # role name level-12 description Predefined level-12 role # role name level-13 description Predefined level-13 role # role name level-14 description Predefined level-14 role # user-group system # user-group systemd # local-user lzfyadmin class manage password hash $h$6$CNiEe2keYOTg78Ix$cd08ryZrtDp8zmBvDG7nz+LCm3b+iPmMlw5iH0izc9iN1VtNUuyxnxx0krN4+bOen57G+G1rktylxl1Q8nygkQ== service-type terminal authorization-attribute user-role network-admin authorization-attribute user-role network-operator # return 防火墙： dis cu # version 7.1.064, Release 8860P1211 # sysname FW # clock protocol none # context Admin id 1 # irf mac-address persistent timer irf auto-update enable undo irf link-delay irf member 1 priority 1 # ip pool l2tp1 192.168.14.2 192.168.14.100 # dhcp enable # dns proxy enable dns server 8.8.8.8 dns server 114.114.114.114 # password-recovery enable # vlan 1 # object-group ip address 0 network subnet 192.168.0.0 255.255.0.0 10 network subnet 192.192.192.0 255.255.255.0 # object-group ip address ?? security-zone Untrust 0 network subnet 10.79.0.0 255.255.0.0 10 network subnet 11.1.0.0 255.255.0.0 20 network subnet 11.65.0.0 255.255.0.0 30 network subnet 11.73.0.0 255.255.255.0 # dhcp server ip-pool 2 # interface Virtual-Template1 ppp authentication-mode chap remote address pool l2tp1 ip address 192.168.14.254 255.255.255.0 # interface NULL0 # interface Vlan-interface1 # interface GigabitEthernet1/0/0 port link-mode route # interface GigabitEthernet1/0/1 port link-mode route description To-NeiWangHeXin ip address 192.168.9.254 255.255.255.0 # interface GigabitEthernet1/0/2 port link-mode route # interface GigabitEthernet1/0/3 port link-mode route description To-ZhuanWang ip address 11.73.0.36 255.255.255.248 nat outbound nat static enable # interface GigabitEthernet1/0/4 port link-mode route speed 100 ip address 20.8.19.253 255.255.255.0 nat outbound # interface GigabitEthernet1/0/5 port link-mode route # interface GigabitEthernet1/0/6 port link-mode route # interface GigabitEthernet1/0/7 port link-mode route # interface GigabitEthernet1/0/8 port link-mode route # interface GigabitEthernet1/0/9 port link-mode route # interface GigabitEthernet1/0/10 port link-mode route # interface GigabitEthernet1/0/11 port link-mode route # interface GigabitEthernet1/0/12 port link-mode route # interface GigabitEthernet1/0/13 port link-mode route # interface GigabitEthernet1/0/14 port link-mode route # interface GigabitEthernet1/0/15 port link-mode route # interface GigabitEthernet1/0/16 port link-mode route combo enable fiber # interface GigabitEthernet1/0/17 port link-mode route combo enable fiber # interface GigabitEthernet1/0/18 port link-mode route combo enable fiber # interface GigabitEthernet1/0/19 port link-mode route combo enable fiber # interface GigabitEthernet1/0/20 port link-mode route # interface GigabitEthernet1/0/21 port link-mode route # interface GigabitEthernet1/0/22 port link-mode route # interface GigabitEthernet1/0/23 port link-mode route # interface GigabitEthernet1/0/24 port link-mode route # interface GigabitEthernet1/0/25 port link-mode route # interface M-GigabitEthernet1/0/0 ip address 192.168.0.1 255.255.255.0 # interface Ten-GigabitEthernet1/0/26 port link-mode route # interface Ten-GigabitEthernet1/0/27 port link-mode route # security-zone name Local # security-zone name Trust import interface GigabitEthernet1/0/1 import interface Virtual-Template1 # security-zone name DMZ # security-zone name Untrust import interface GigabitEthernet1/0/3 import interface GigabitEthernet1/0/4 # security-zone name Management import interface M-GigabitEthernet1/0/0 # scheduler logfile size 16 # line class console authentication-mode scheme user-role network-admin # line class vty user-role network-operator # line con 0 authentication-mode scheme user-role network-admin set authentication password hash $h$6$UPDp9ddVA1S1EwTP$Stlri4KvxZz2l7qIQA54tRW8ab/voJ5CKijK2yTMr5VM7L8D69jobmYIxHdxO0l1DVBG5hS7Aehz8LncQDvl9g== # line vty 0 63 authentication-mode scheme user-role network-admin # ip route-static 0.0.0.0 0 GigabitEthernet1/0/3 11.73.0.38 ip route-static 10.79.0.0 16 20.8.19.254 ip route-static 192.168.1.0 24 192.168.9.253 ip route-static 192.168.3.0 24 192.168.9.253 ip route-static 192.168.4.0 24 192.168.9.253 ip route-static 192.168.5.0 24 192.168.9.253 ip route-static 192.168.6.0 24 192.168.9.253 ip route-static 192.168.7.0 24 192.168.9.253 ip route-static 192.168.8.0 24 192.168.9.253 ip route-static 192.192.192.0 24 192.168.9.253 # info-center loghost 127.0.0.1 port 3301 format default info-center loghost 192.192.192.161 facility local0 info-center source default loghost level debugging info-center source CFGLOG loghost level informational # password-control enable # domain system # domain default enable system # role name level-0 description Predefined level-0 role # role name level-1 description Predefined level-1 role # role name level-2 description Predefined level-2 role # role name level-3 description Predefined level-3 role # role name level-4 description Predefined level-4 role # role name level-5 description Predefined level-5 role # role name level-6 description Predefined level-6 role # role name level-7 description Predefined level-7 role # role name level-8 description Predefined level-8 role # role name level-9 description Predefined level-9 role # role name level-10 description Predefined level-10 role # role name level-11 description Predefined level-11 role # role name level-12 description Predefined level-12 role # role name level-13 description Predefined level-13 role # role name level-14 description Predefined level-14 role # user-group system # local-user admin class manage service-type ssh telnet terminal http https authorization-attribute user-role level-3 authorization-attribute user-role network-admin authorization-attribute user-role network-operator # local-user lzfyvpn class network password cipher $h$6$UPDp9ddVA1S1EwTP$Stlri4K service-type ppp authorization-attribute user-role network-operator # session statistics enable # l2tp-group 1 mode lns allow l2tp virtual-template 1 undo tunnel authentication tunnel name lns # l2tp enable # ip http enable # inspect email parameter-profile mailsetting_default_parameter undo authentication enable # loadbalance isp file flash:/lbispinfo_v1.5.tp # security-policy ip rule 0 name Trust action pass source-zone Trust destination-zone Untrust destination-zone Trust destination-zone Local rule 2 name Local action pass source-zone Local rule 3 name l2tp action pass source-zone Untrust destination-zone Local service l2tp rule 4 name Untrust_Any_4_IPv4 action pass source-zone Untrust rule 5 name pass action pass source-zone Trust destination-zone Untrust destination-zone Local source-ip # cloud-management server domain opstunnel-seccloud.h3c.com # return
我去，这没法看，算了，别看了。。。。
我本来想上传个附件，结果上传了总是不显示，真无语。
问题二：推荐用安全策略，转目的方向，放通源到转换后的IP，反向转源，放通转换前的源地址； 问题三：二层口不能配置NAT
编辑答案
亲~登录后才可以操作哦!
确定你的邮箱还未认证，请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
- 1. 您举报的内容是什么？（请在邮件中列出您举报的内容和链接地址）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
- 3. 是哪家企业？（营业执照，单位登记证明等证件）
- 4. 您与该企业的关系是？（您是企业法人或被授权人，需提供企业委托授权书）
抄袭了我的内容
×
原文链接或出处
诽谤我
×
- 1. 您举报的内容以及侵犯了您什么权益？（请在邮件中列出您举报的内容、链接地址，并给出简短的说明）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
对根叔社区有害的内容
×
不规范转载
×
举报说明
你好，3接口上已经有IP了，ip address 11.73.0.36 255.255.255.248。以前他这边有个傻瓜交换机，专网线接在傻瓜上，然后傻瓜出一根线接在防火墙的3口，然后另一个线接在服务器上，服务器上的IP设置成11.73.0.35，这样是额可以的。但现在不想再加个傻瓜。就是想服务器直连到防火墙上，如何设置相当于加了一个傻瓜交换机