实验需求：实现全网互通，分别使用动态NAT、PAT、静态NAT
拓扑图如下：
地址规划
IOU1 | e0/0 200.1.1.2 /24 | loo0 218.85.152.99 /32 |
IOU2 | e0/0 192.168.0.11 /24 | loo0 192.168.1.11 /32 |
IOU3 | e0/0 172.16.1.1 /24 | loo0 172.16.88.11 /32 |
ASA | g0 200.1.1.1 /24 | g1 172.16.1.254 /24 |
g2 192.168.0.254 |
配置IP地址
IOU1
IOU1(config)#interface ethernet 0/0
IOU1(config-if)#duplex full
IOU1(config-if)#ip address 200.1.1.2 255.255.255.0
IOU1(config-if)#no shutdown
IOU1(config-if)#exit
IOU1(config)#interface loopback 0
IOU1(config-if)#ip address 218.85.152.99 255.255.255.255
IOU1(config-if)#exit
IOU2
IOU2(config)#interface ethernet 0/0
IOU2(config-if)#duplex full
IOU2(config-if)#ip address 192.168.0.11 255.255.255.0
IOU2(config-if)#no shutdown
IOU2(config-if)#exit
IOU2(config)#interface loopback 0
IOU2(config-if)#ip address 192.168.1.11 255.255.255.255
IOU2(config-if)#exit
IOU3
IOU3(config)#interface ethernet 0/0
IOU3(config-if)#duplex full
IOU3(config-if)#ip address 172.16.1.1 255.255.255.0
IOU3(config-if)#no shutdown
IOU3(config-if)#exit
IOU3(config)#interface loopback 0
IOU3(config-if)#ip address 172.16.88.11 255.255.255.255
IOU3(config-if)#exit
IOU2和IOU3配置默认路由
IOU2
IOU2(config)#ip route 0.0.0.0 0.0.0.0 192.168.0.254
IOU3
IOU3(config)#ip route 0.0.0.0 0.0.0.0 172.16.1.254
ASA配置IP地址和路由
ciscoasa(config)# interface gigabitEthernet 0
ciscoasa(config-if)# ip address 200.1.1.1 255.255.255.0
ciscoasa(config-if)# nameif outside
ciscoasa(config-if)# security-level 0
ciscoasa(config-if)# no shu
ciscoasa(config-if)# exit
ciscoasa(config)# interface gigabitEthernet 1
ciscoasa(config-if)# ip address 172.16.1.254 255.255.255.0
ciscoasa(config-if)# nameif inside
ciscoasa(config-if)# security-level 100
ciscoasa(config-if)# no shu
ciscoasa(config-if)# exit
ciscoasa(config)# interface gigabitEthernet 2
ciscoasa(config-if)# ip address 192.168.0.254 255.255.255.0
ciscoasa(config-if)# nameif dmz
ciscoasa(config-if)# security-level 50
ciscoasa(config-if)# no shu
ciscoasa(config-if)# exit
ciscoasa(config)# rou outside 0 0 200.1.1.2
ciscoasa(config)# route dmz 192.168.1.0 255.255.255.0 192.168.0.11
ciscoasa(config)# route inside 172.16.88.0 255.255.255.0 172.16.1.1
ciscoasa(config)# exit
使用show route查看路由表
1.在ASA上配置动态NAT
ciscoasa(config)# object network out-pool
ciscoasa(config-network-object)# range 200.1.1.10 200.1.1.20
ciscoasa(config-network-object)# exit
ciscoasa(config)# object network in-ld
ciscoasa(config-network-object)# subnet 172.16.88.0 255.255.255.0
ciscoasa(config-network-object)# exit
ciscoasa(config)# object network in-xd
ciscoasa(config-network-object)# subnet 172.16.1.0 255.255.255.0
ciscoasa(config-network-object)# exit
ciscoasa(config)# object network dmz-1
ciscoasa(config-network-object)# subnet 192.168.0.0 255.255.255.0
ciscoasa(config-network-object)# exit
ciscoasa(config)# object network dmz-2
ciscoasa(config-network-object)# subnet 192.168.1.0 255.255.255.0
ciscoasa(config-network-object)# exit
ciscoasa(config)# object-group network in-lan
ciscoasa(config-network-object-group)# network-object object in-ld
ciscoasa(config-network-object-group)# network-object object in-xd
ciscoasa(config-network-object-group)# exit
ciscoasa(config)# object-group network dmz-lan
ciscoasa(config-network-object-group)# network-object object dmz-1
ciscoasa(config-network-object-group)# network-object object dmz-2
ciscoasa(config-network-object-group)# exit
ciscoasa(config)# nat (inside,outside) source dynamic in-lan out-pool
ciscoasa(config)# nat (dmz,outside) source dynamic dmz-lan out-pool
在IOU1上创建用户开启远程telnet
IOU1(config)#username qwe privilege 15 password benet
IOU1(config)#line vty 0 4
IOU1(config-line)#login local
IOU1(config-line)#transport input telnet
IOU1(config-line)#exit
用IOU3测试telnet
配置PAT，把前面动态nat的两条命令no掉
ciscoasa(config)# no nat (inside,outside) source dynamic in-lan out-pool
ciscoasa(config)# nat (dmz,outside) source dynamic dmz-lan out-pool
PAT，多内网架构，多个网段，多个zone，直接使用外网接口
ciscoasa(config)# nat (inside,outside) source dynamic in-lan interface
ciscoasa(config)# nat (dmz,outside) source dynamic dmz-lan interface
在IOU3telnet测试
继续把前面两条命令no掉
ciscoasa(config)# no nat (inside,outside) source dynamic in-lan interface
ciscoasa(config)# no nat (dmz,outside) source dynamic dmz-lan interface
PAT，多内网架构使用一个指定外网IP
ciscoasa(config)# object network out-pat3
ciscoasa(config-network-object)# host 200.1.1.3
ciscoasa(config-network-object)# exit
ciscoasa(config)# nat (inside,outside) source dynamic in-ld pat-pool out-pat3
ciscoasa(config)# object network out-pool4
ciscoasa(config-network-object)# host 200.1.1.4
ciscoasa(config-network-object)# exit
ciscoasa(config)# nat (inside,outside) source dynamic in-xd pat-pool out-pool4
IOU3测试telnet
继续no掉前面的
ciscoasa(config)# no nat (inside,outside) source dynamic in-ld pat-pool out-pat3
ciscoasa(config)# no nat (inside,outside) source dynamic in-xd pat-pool out-pool4
先动态NAT。最后用指定IP做PAT
ciscoasa(config)# object network out-pool
ciscoasa(config-network-object)# range 200.1.1.10 200.1.1.20
ciscoasa(config-network-object)# exit
ciscoasa(config)# object network out-pat3
ciscoasa(config-network-object)# host 200.1.1.3
ciscoasa(config-network-object)# exit
ciscoasa(config)# object-group network out-nat
ciscoasa(config-network-object-group)# network-object object out-pat3
ciscoasa(config-network-object-group)# network-object object out-pool
ciscoasa(config-network-object-group)# exit
ciscoasa(config)# nat (inside,outside) source dynamic in-lan out-nat
IOU3测试telnet
使用show xlata查看防火墙流量
