内网pc通过公网ip访问映射的内网

[FW]security-zone name trust

[FW-security-zone-Trust]import interface GigabitEthernet 1/0/1

[FW]security-zone name untrust

[FW-security-zone-Untrust]import interface GigabitEthernet 1/0/2

[FW]security-policy ip

[FW-security-policy-ip]rule 0 name PC-server

[FW-security-policy-ip-0-PC-server]source-zone trust

[FW-security-policy-ip-0-PC-server]source-zone untrust

[FW-security-policy-ip-0-PC-server]destination-zone trust

[FW-security-policy-ip-0-PC-server]destination-zone untrust

[FW-security-policy-ip-0-PC-server]action pass

实验结果验证

C:\Users\Administrator.SFW0177YM>ping 10.10.10.2

正在 Ping 10.10.10.2 具有 32 字节的数据:

来自 10.10.10.2 的回复: 字节=32 时间<1ms TTL=127

来自 10.10.10.2 的回复: 字节=32 时间<1ms TTL=127

来自 10.10.10.2 的回复: 字节=32 时间<1ms TTL=127

来自 10.10.10.2 的回复: 字节=32 时间<1ms TTL=127

10.10.10.2 的 Ping 统计信息:

    数据包: 已发送 = 4，已接收 = 4，丢失 = 0 (0% 丢失)，

往返行程的估计时间(以毫秒为单位):

    最短 = 0ms，最长 = 0ms，平均 = 0ms

防火墙上收到的内网用户访问公网地址的首包源地址为192.168.1.1访问的目的地址为公网地址10.10.10.2，由回包信息可知，报文的源目地址均发生了变化，源地址由nat outbound转换为公网出接口的地址10.10.10.1，目的地址由nat server的配置转换成了内网服务器的地址192.168.1.2。

查看防火墙上的会话，结果如下所示：

[FW]display session table ipv4 verbose

Slot 1:

Initiator:

  Source      IP/port: 192.168.1.1/1

  Destination IP/port: 10.10.10.2/2048

  DS-Lite tunnel peer: -

  VPN instance/VLAN ID/Inline ID: -/-/-

  Protocol: ICMP(1)

  Inbound interface: GigabitEthernet1/0/1

  Source security zone: Trust

Responder:

  Source      IP/port: 192.168.1.2/66

  Destination IP/port: 10.10.10.1/0

  DS-Lite tunnel peer: -

  VPN instance/VLAN ID/Inline ID: -/-/-

  Protocol: ICMP(1)

  Inbound interface: GigabitEthernet1/0/1

  Source security zone: Trust

State: ICMP_REPLY

Application: ICMP

Rule ID: 20

Rule name: trust-trust

Start time: 2018-09-03 15:31:35  TTL: 29s

Initiator->Responder:            2 packets        120 bytes

Responder->Initiator:            2 packets        120 bytes

 Total sessions found: 1

 查看NAT的转换过程，结果如下：

terminal debugging

The current terminal is enabled to display debugging logs.

terminal monitor

The current terminal is enabled to display logs.

debug nat packet

This command is CPU intensive and might affect ongoing services. Are you sure you want to continue? [Y/N]:y

*Sep  3 15:32:52:005 2018 FW NAT/7/COMMON: -COntext=1;

 PACKET: (GigabitEthernet1/0/2-out-config) Protocol: ICMP

     192.168.1.1:    1 -      10.10.10.2: 2048(VPN:    0) ------>

      10.10.10.1:   67 -      10.10.10.2: 2048(VPN:    0)

*Sep  3 15:32:52:005 2018 FW NAT/7/COMMON: -COntext=1;

 PACKET: (GigabitEthernet1/0/1-in-config) Protocol: ICMP

      10.10.10.1:   67 -      10.10.10.2: 2048(VPN:    0) ------>

      10.10.10.1:   67 -     192.168.1.2: 2048(VPN:    0)

*Sep  3 15:32:52:006 2018 FW NAT/7/COMMON: -COntext=1;

 PACKET: (GigabitEthernet1/0/1-in-session) Protocol: ICMP

     192.168.1.2:   67 -      10.10.10.1:    0(VPN:    0) ------>

      10.10.10.2:    1 -      10.10.10.1:    0(VPN:    0)

*Sep  3 15:32:52:006 2018 FW NAT/7/COMMON: -COntext=1;

 PACKET: (GigabitEthernet1/0/1-out-session) Protocol: ICMP

      10.10.10.2:    1 -      10.10.10.1:    0(VPN:    0) ------>

      10.10.10.2:    1 -     192.168.1.1:    0(VPN:    0)