NAT网络地址转换
（1）静态NAT
一对一转换
AR1:
interface GigabitEthernet0/0/0
ip address 192.168.1.1 255.255.255.0
interface GigabitEthernet0/0/1
ip address 12.1.1.1 255.255.255.0
作为边界网关，要保证内网用户上网，通常会在边界网关上指一条默认路由来访问互联网
ip route-static 0.0.0.0 0.0.0.0 12.1.1.2
AR2：
interface GigabitEthernet0/0/0
ip address 12.1.1.2 255.255.255.0
ip route-static 0.0.0.0 0.0.0.0 12.1.1.1
在连接外网的端口上配置NAT
[AR1]int g0/0/1
[AR1-GigabitEthernet0/0/1]nat static global 12.1.1.12 inside 192.168.1.2
[AR1-GigabitEthernet0/0/1]nat static global 12.1.1.13 inside 192.168.1.3
查询NAT信息
[AR1]dis nat static
Static Nat Information:
Interface : GigabitEthernet0/0/1
Global IP/Port : 12.1.1.12/----
Inside IP/Port : 192.168.1.2/----
Protocol : ----
VPN instance-name : ----
Acl number : ----
Netmask : 255.255.255.255
Description : ----
Global IP/Port : 12.1.1.13/----
Inside IP/Port : 192.168.1.3/----
Protocol : ----
VPN instance-name : ----
Acl number : ----
Netmask : 255.255.255.255
Description : ----
Total : 2
发出ping包，查看NAT转换情况
[AR1]dis nat session all
NAT Session Table Information:
Protocol : ICMP(1)
SrcAddr Vpn : 192.168.1.2
DestAddr Vpn : 12.1.1.2
Type Code IcmpId : 0 8 55267
NAT-Info
New SrcAddr : 12.1.1.12
New DestAddr : ----
New IcmpId : ----
Protocol : ICMP(1)
SrcAddr Vpn : 192.168.1.3
DestAddr Vpn : 12.1.1.2
Type Code IcmpId : 0 8 55267
NAT-Info
New SrcAddr : 12.1.1.13
New DestAddr : ----
New IcmpId : ----
... ...
（2）动态NAT
N对N转换
本实验沿用静态NAT的基础实验环境
[AR1]nat address-group 1 12.1.1.20 12.1.1.30
[AR1]acl 2000
[AR1-acl-basic-2000]rule permit source 192.168.1.0 0.0.0.255
[AR1-acl-basic-2000]rule deny
[AR1-acl-basic-2000]q
[AR1]int g0/0/1
[AR1-GigabitEthernet0/0/1]nat outbound 2000 address-group 1 no-pat
当nat地址池大于1个公网地址时，需要加上no-pat参数，表示是动态NAT。
当只有1个外网地址，则无需配置，表示NAPT。
该配置动态转换nat，但是仍只能保证内网前11台上网的电脑能访问外网。
[AR1]dis nat address-group 1
NAT Address-Group Information:
--------------------------------------
Index Start-address End-address
--------------------------------------
1 12.1.1.20 12.1.1.30
--------------------------------------
Total : 1
[AR1]dis nat session all
NAT Session Table Information:
Protocol : ICMP(1)
SrcAddr Vpn : 192.168.1.3
DestAddr Vpn : 12.1.1.2
Type Code IcmpId : 0 8 57675
NAT-Info
New SrcAddr : 12.1.1.20
New DestAddr : ----
New IcmpId : ----
... ...
（3）NAPT
网络地址端口转换NAPT允许多个内部地址映射到同一个公有地址的不同端口。
[AR1]nat address-group 1 12.1.1.40 12.1.1.40
[AR1]acl 2000
[AR1-acl-basic-2000]rule permit source 192.168.1.0 0.0.0.255
[AR1-acl-basic-2000]rule deny
[AR1-acl-basic-2000]q
[AR1]int g0/0/1
[AR1-GigabitEthernet0/0/1]nat outbound 2000 address-group 1
[AR1]dis nat address-group 1
NAT Address-Group Information:
--------------------------------------
Index Start-address End-address
--------------------------------------
1 12.1.1.40 12.1.1.40
--------------------------------------
Total : 1
可以看到192.168.1.2，192.168.1.3均转换成12.1.1.40
[AR1]dis nat session all
NAT Session Table Information:
Protocol : ICMP(1)
SrcAddr Vpn : 192.168.1.2
DestAddr Vpn : 12.1.1.2
Type Code IcmpId : 0 8 58623
NAT-Info
New SrcAddr : 12.1.1.40
New DestAddr : ----
New IcmpId : 10250
Protocol : ICMP(1)
SrcAddr Vpn : 192.168.1.3
DestAddr Vpn : 12.1.1.2
Type Code IcmpId : 0 8 58628
NAT-Info
New SrcAddr : 12.1.1.40
New DestAddr : ----
New IcmpId : 10258
... ...
（4）Easy IP
Easy IP允许将多个内部地址映射到网关出接口地址上的不同端口。
Easy IP在下图实验中就是AR1的G0/0/1上的ip：12.1.1.1
[AR1]acl 2000
[AR1-acl-basic-2000]rule permit source 192.168.1.0 0.0.0.255
[AR1-acl-basic-2000]rule deny
[AR1-acl-basic-2000]q
[AR1]int g0/0/1
[AR1-GigabitEthernet0/0/1]nat outbound 2000
可以看到192.168.1.2，192.168.1.3均转换成12.1.1.1
[AR1]dis nat session all
NAT Session Table Information:
Protocol : ICMP(1)
SrcAddr Vpn : 192.168.1.2
DestAddr Vpn : 12.1.1.2
Type Code IcmpId : 0 8 6494
NAT-Info
New SrcAddr : 12.1.1.1
New DestAddr : ----
New IcmpId : 10240
Protocol : ICMP(1)
SrcAddr Vpn : 192.168.1.3
DestAddr Vpn : 12.1.1.2
Type Code IcmpId : 0 8 6651
NAT-Info
New SrcAddr : 12.1.1.1
New DestAddr : ----
New IcmpId : 10334
[AR1]dis nat outbound
NAT Outbound Information:
-----------------------------------------------------------------
Interface Acl Address-group/IP/Interface Type
-----------------------------------------------------------------
GigabitEthernet0/0/1 2000 12.1.1.1 easyip
-----------------------------------------------------------------
Total : 1
（5）NAT Server作用及配置
通过配置NAT服务器,可以使外网用户访问内网服务器。
AR1：
interface GigabitEthernet0/0/1
ip address 12.1.1.1 255.255.255.0
nat server protocol icmp global 12.1.1.10 inside 192.168.1.2
nat server protocol tcp global 12.1.1.11 www inside 192.168.1.3 www
[AR1]dis nat server
Nat Server Information:
Interface : GigabitEthernet0/0/1
Global IP/Port : 12.1.1.10/----
Inside IP/Port : 192.168.1.2/----
Protocol : 1(icmp)
VPN instance-name : ----
Acl number : ----
Description : ----
Global IP/Port : 12.1.1.11/80(www)
Inside IP/Port : 192.168.1.3/80(www)
Protocol : 6(tcp)
VPN instance-name : ----
Acl number : ----
Description : ----
Total : 2
<AR2>ping 12.1.1.10
PING 12.1.1.10: 56 data bytes, press CTRL_C to break
Reply from 12.1.1.10: bytes=56 Sequence=1 ttl=127 time=90 ms
Reply from 12.1.1.10: bytes=56 Sequence=2 ttl=127 time=150 ms
Reply from 12.1.1.10: bytes=56 Sequence=3 ttl=127 time=80 ms
Reply from 12.1.1.10: bytes=56 Sequence=4 ttl=127 time=130 ms
Reply from 12.1.1.10: bytes=56 Sequence=5 ttl=127 time=90 ms
--- 12.1.1.10 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 80/108/150 ms
