nat和password control问题

nat和password control问题

1、

#

nat static outbound 10.20.5.5 9.4.10.88

#

nat address-group 22        

address 9.4.10.84 9.4.10.84

#

interface GigabitEthernet1/0/0

port link-mode route description shiyong

combo enable copper

ip address 9.4.26.82 255.255.255.252   

nat outbound 3201 address-group 22

nat static enable

nat server global 9.4.10.88 inside 10.20.5.5

nat server global 9.4.110.85 inside 10.20.103.100

#

acl advanced 3201 description sthji

rule 0 permit ip source 10.20.0.0 0.0.255.255 destination 9.4.11.0 0.0.0.255

rule 5 permit ip source 10.20.0.0 0.0.255.255 destination 9.4.11.0 0.0.0.255

rule 1000 deny ip

#

ip route-static 0.0.0.0 0 10.20.250.21

#

nat server global 9.4.10.88 inside 10.20.5.5这条是把这个公网ip映射给这台主机嘛？和这条有什么区别：nat static outbound 10.20.5.5 9.4.10.88？看配置中两条同时存在。配置两个是做什么用？

2、路由器没有配置本地账号，配置了radius，但是又配置了密码控制，这种情况下是不是用户登录设备要通过radius认证？密码控制策略中的长度控制是做什么用的？密码控制策略是控制radius认证是的密码？有什么效果？

#

ssh server enable

#

password-control enable

undo password-control aging enable

undo password-control history enable

password-control length 6

password-control login-attempt 3 exceed lock-time 10

password-control update-interval 0

password-control login idle-time 0

#

radius session-control enable

#

radius scheme ls primary authentication 22.10.10.125

primary accounting  22.10.10.125 key authentication cipher EMZk0oje/uXosQZHeqFOa3QnGEDYWmmaiA=

key accounting cipher ck0+f3VWhIRLQqw/0TbLa3P2ObuHyHME3U=

user-name-format without-domain

nas-ip 10.20.254.4

#

domain ls authentication default radius-scheme ls none

#

domain default enable ls