CISCO路由器NAT-T与IPSec ×××配置实验
1.实验拓扑：
A．R1上配加密图时，address为12.1.1 .2 IP；【不是内网的23.1.1.3哦！】
B．R3上配加密图时，address为12.1.1 .1 IP；
C．内网到远程时，因路由器自动开启NAT-T功能，所有可以ping通；
D．远程到内网时，要做UDP端口映射，即R2上静态映射端口500和4500；
3.基本配置：
R1：
R1#sh run
hostname R1
!
crypto isakmp policy 10
authentication pre-share
crypto isakmp key cisco address 12.1.1 .2
!
crypto ipsec transform-set myset esp-3des esp-md5-hmac
!
crypto map cisco 10 ipsec-isakmp
set peer 12.1.1 .2
set transform-set myset
match address 100
!
interface Loopback0
ip address 1.1.1 .1 255.255.255.0
!
interface FastEthernet0/0
ip address 12.1.1 .1 255.255.255.0
duplex half
crypto map cisco
ip route 0.0.0 .0 0.0.0.0 FastEthernet0/0
access-list 100 permit ip 1.1.1 .0 0.0.0.255 3.3.3.0 0.0.0.255
!
!
R2：
R2#sh run
hostname R2
!
interface FastEthernet0/0
ip address 12.1.1 .2 255.255.255.0
ip nat outside
duplex half
!
interface FastEthernet3/0
ip address 23.1.1 .2 255.255.255.0
ip nat inside
duplex half
!
ip nat inside source list 101 interface FastEthernet0/0 overload
ip nat inside source static esp 23.1.1 .3 interface FastEthernet0/0
ip nat inside source static udp 23.1.1 .3 4500 interface FastEthernet0/0 4500
ip nat inside source static udp 23.1.1 .3 500 interface FastEthernet0/0 500
ip route 0.0.0 .0 0.0.0.0 FastEthernet0/0
ip route 3.3.3 .0 255.255.255.0 FastEthernet3/0
access-list 101 permit ip 3.3.0 .0 0.0.255.255 any
!
R3：
R3#sh run
hostname R3
!
crypto isakmp policy 10
authentication pre-share
crypto isakmp key cisco address 12.1.1 .1
!
crypto ipsec transform-set myset esp-3des esp-md5-hmac
!
crypto map cisco 10 ipsec-isakmp
set peer 12.1.1 .1
set transform-set myset
match address 100
!
interface Loopback0
ip address 3.3.3 .3 255.255.255.0
!
interface FastEthernet3/0
ip address 23.1.1 .3 255.255.255.0
duplex half
crypto map cisco
ip route 0.0.0 .0 0.0.0.0 FastEthernet3/0
access-list 100 permit ip 3.3.3 .0 0.0.0.255 1.1.1.0 0.0.0.255
!
4．实验测试结果
R3#ping 1.1.1 .1 sou 3.3.3.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1 .1, timeout is 2 seconds:
Packet sent with a source address of 3.3.3 .3
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 120/212/452 ms
R3#
R2#
*Mar 18 17:00:51.415: NAT: s=23.1.1 .3->12.1.1.2, d=12.1.1.1 [160]
*Mar 18 17:00:51.763: NAT*: s=12.1.1 .1, d=12.1.1.2->23.1.1.3 [167]
*Mar 18 17:00:51.903: NAT*: s=23.1.1 .3->12.1.1.2, d=12.1.1.1 [163]
*Mar 18 17:00:51.975: NAT*: s=12.1.1 .1, d=12.1.1.2->23.1.1.3 [170]
*Mar 18 17:00:52.111: NAT*: s=23.1.1 .3->12.1.1.2, d=12.1.1.1 [166]
*Mar 18 17:00:52.159: NAT*: s=12.1.1 .1, d=12.1.1.2->23.1.1.3 [173]
*Mar 18 17:00:52.231: NAT*: s=23.1.1 .3->12.1.1.2, d=12.1.1.1 [169]
*Mar 18 17:00:52.319: NAT*: s=12.1.1 .1, d=12.1.1.2->23.1.1.3 [176]
*Mar 18 17:00:52.343: NAT*: s=23.1.1 .3->12.1.1.2, d=12.1.1.1 [172]
*Mar 18 17:00:52.407: NAT*: s=12.1.1 .1, d=12.1.1.2->23.1.1.3 [179]
R1#ping 3.3.3 .3 sou 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 3.3.3 .3, timeout is 2 seconds:
Packet sent with a source address of 1.1.1 .1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 60/144/220 ms
R1#
R2#
*Mar 18 17:01:37.355: NAT*: s=12.1.1 .1, d=12.1.1.2->23.1.1.3 [182]
*Mar 18 17:01:37.547: NAT*: s=23.1.1 .3->12.1.1.2, d=12.1.1.1 [175]
*Mar 18 17:01:37.667: NAT*: s=12.1.1 .1, d=12.1.1.2->23.1.1.3 [185]
*Mar 18 17:01:37.787: NAT*: s=23.1.1 .3->12.1.1.2, d=12.1.1.1 [178]
*Mar 18 17:01:37.835: NAT*: s=12.1.1 .1, d=12.1.1.2->23.1.1.3 [188]
*Mar 18 17:01:37.875: NAT*: s=23.1.1 .3->12.1.1.2, d=12.1.1.1 [181]
*Mar 18 17:01:37.947: NAT*: s=12.1.1 .1, d=12.1.1.2->23.1.1.3 [191]
*Mar 18 17:01:37.955: NAT*: s=23.1.1 .3->12.1.1.2, d=12.1.1.1 [184]
*Mar 18 17:01:37.999: NAT*: s=12.1.1 .1, d=12.1.1.2->23.1.1.3 [194]
*Mar 18 17:01:38.015: NAT*: s=23.1.1 .3->12.1.1.2, d=12.1.1.1 [187]
R2#sh ip nat translations
Pro Inside global Inside local Outside local Outside global
esp 12.1.1 .2:0 23.1.1 .3:0 --- ---
udp 12.1.1 .2:500 23.1.1 .3:500 --- ---
udp 12.1.1 .2:4500 23.1.1 .3:4500 --- ---
udp 12.1.1 .2:4500 23.1.1 .3:4500 12.1.1 .1:4500 12.1.1 .1:4500
R2#
5.实验总结：
A：NAT-T实施：
1.是否支持NAT-T；
2.是否有NAT/PAT；
3.是否应该实施NAT-T；
B：防火墙默认不开启 NAT-T穿透功能的哦！【配置时要注意咯！】
