对NAT中术语和转换关系的理解和研究(转）
[b][font=宋体][size=9pt]对[/size][/font][font=Tahoma][size=9pt]NAT[/size][/font][font=宋体][size=9pt]中术语和转换关系的理解和研究[/size][/font][/b]
[b]
[/b][font=Tahoma][size=9pt][b][font=宋体][size=9pt]对[/size][/font][font=Tahoma][size=9pt]NAT[/size][/font][font=宋体][size=9pt]中术语和转换关系的理解和研究[/size][/font][font=Tahoma][size=9pt][/size][/font][/b]
[align=left][align=left][size=3][color=black][font=宋体][size=10.5pt]对[/size][/font][/color][color=black][font=Tahoma][size=10.5pt]NAT[/size][/font][/color][color=black][font=宋体][size=10.5pt]中术语和转换关系的理解和研究[/size][/font][/color][/size]
[size=3][color=black][font=宋体][size=10.5pt]在[/size][/font][/color][color=black][font=Tahoma][size=10.5pt]NAT[/size][/font][/color][color=black][font=宋体][size=10.5pt]中有[/size][/font][/color][color=black][font=Tahoma][size=10.5pt]4[/size][/font][/color][color=black][font=宋体][size=10.5pt]个术语[/size][/font][/color][color=black][font=Tahoma][size=10.5pt]:[/size][/font][/color][color=black][font=宋体][size=10.5pt]内部本地[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]内部全局[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]外部本地[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]外部全局[/size][/font][/color][color=black][font=Tahoma][size=10.5pt].[/size][/font][/color][color=black][font=宋体][size=10.5pt]这四个术语如果不细致理解[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]确实让人感到非常的乱[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]但理解后其实并不难[/size][/font][/color][color=black][font=Tahoma][size=10.5pt]. [/size][/font][/color][/size][/align][/align][align=center][table=450][tr][td][align=left][align=left][font=宋体][size=9pt]内部本地[/size][/font][font=Tahoma][size=9pt][/size][/font][/align][/align][/td][td][align=left][align=left][font=宋体][size=9pt]内部全局[/size][/font][font=Tahoma][size=9pt][/size][/font][/align][/align][/td][td][align=left][align=left][font=宋体][size=9pt]外部本地[/size][/font][font=Tahoma][size=9pt][/size][/font][/align][/align][/td][td][align=left][align=left][font=宋体][size=9pt]外部全局[/size][/font][font=Tahoma][size=9pt][/size][/font][/align][/align][/td][/tr][/table][/align][align=left][align=left][size=3][color=black][font=Tahoma][size=10.5pt]([/size][/font][/color][color=black][font=宋体][size=10.5pt]相同颜色处于同一层次平面[/size][/font][/color][/size][size=3][color=black][font=Tahoma][size=10.5pt])
[/size][/font][/color][color=black][font=宋体][size=10.5pt]上面四个术语描述的[/size][/font][/color][color=black][font=Tahoma][size=10.5pt]IP[/size][/font][/color][color=black][font=宋体][size=10.5pt]地址[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]可以这样理解[/size][/font][/color][/size][size=3][color=black][font=Tahoma][size=10.5pt]:
[/size][/font][/color][color=black][font=宋体][size=10.5pt]内部本地和外部全局[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]是通信中正式的真正源[/size][/font][/color][color=black][font=Tahoma][size=10.5pt]/[/size][/font][/color][color=black][font=宋体][size=10.5pt]目的地址[/size][/font][/color][/size]
[size=3][color=black][font=宋体][size=10.5pt]内部全局和外部本地是在[/size][/font][/color][color=black][font=Tahoma][size=10.5pt]NAT[/size][/font][/color][color=black][font=宋体][size=10.5pt]过程中的一个中间量[/size][/font][/color][/size][size=3][color=black][font=Tahoma][size=10.5pt].
[/size][/font][/color][color=black][font=宋体][size=10.5pt]内部全局是内部本地在全局平面[/size][/font][/color][color=black][font=Tahoma][size=10.5pt]([/size][/font][/color][color=black][font=宋体][size=10.5pt]外部网络[/size][/font][/color][color=black][font=Tahoma][size=10.5pt])[/size][/font][/color][color=black][font=宋体][size=10.5pt]的表现[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]也就是说[/size][/font][/color]
[color=black][font=宋体][size=10.5pt]内部全局在外部网络[/size][/font][/color][color=black][font=Tahoma][size=10.5pt]([/size][/font][/color][color=black][font=宋体][size=10.5pt]全局平面[/size][/font][/color][color=black][font=Tahoma][size=10.5pt])[/size][/font][/color][color=black][font=宋体][size=10.5pt]中代表了内部本地[/size][/font][/color][/size]
[size=3][color=black][font=宋体][size=10.5pt]外部本地是外部全局在本地平面[/size][/font][/color][color=black][font=Tahoma][size=10.5pt]([/size][/font][/color][color=black][font=宋体][size=10.5pt]内部网络[/size][/font][/color][color=black][font=Tahoma][size=10.5pt])[/size][/font][/color][color=black][font=宋体][size=10.5pt]的表现[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]也就是说[/size][/font][/color]
[color=black][font=宋体][size=10.5pt]外部本地在内部网络[/size][/font][/color][color=black][font=Tahoma][size=10.5pt]([/size][/font][/color][color=black][font=宋体][size=10.5pt]本地平面[/size][/font][/color][color=black][font=Tahoma][size=10.5pt])[/size][/font][/color][color=black][font=宋体][size=10.5pt]中代表了外部全局[/size][/font][/color][/size]
[color=black][font=宋体][size=10.5pt][size=3]如图[/size][/size][/font][/color][color=black][font=Tahoma][size=10.5pt][size=3]:
[/size]
[/size][/font][/color][size=3][color=black][font=宋体][size=10.5pt]看下面的图进一步理解这样的关系[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]这个图是我自己理解关系时候想象出来的[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]通过这个图可以比较直观的理清关系[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]在这个图中我引入了[/size][/font][/color][color=black][font=Tahoma][size=10.5pt]2[/size][/font][/color][color=black][font=宋体][size=10.5pt]个名词本地平面[/size][/font][/color][color=black][font=Tahoma][size=10.5pt]/[/size][/font][/color][color=black][font=宋体][size=10.5pt]全局平面[/size][/font][/color][/size][color=black][font=Tahoma][size=10.5pt][size=3].
[/size]
[/size][/font][/color][color=black][font=宋体][size=10.5pt][size=3]只有处在同一平面的才能进行直接的数据传输[/size][/size][/font][/color]
[size=3][color=black][font=宋体][size=10.5pt]那么内部本地[/size][/font][/color][color=black][font=Tahoma][size=10.5pt](SA)[/size][/font][/color][color=black][font=宋体][size=10.5pt]要想和外部全局[/size][/font][/color][color=black][font=Tahoma][size=10.5pt](DA)[/size][/font][/color][color=black][font=宋体][size=10.5pt]通信[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]该如何进行[/size][/font][/color][/size][size=3][color=black][font=Tahoma][size=10.5pt]?
[/size][/font][/color][color=black][font=宋体][size=10.5pt]首先[/size][/font][/color][color=black][font=Tahoma][size=10.5pt]:[/size][/font][/color][color=black][font=宋体][size=10.5pt]要想能正常传输[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]必须要让数据处于同一个平面[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]现在[/size][/font][/color][color=black][font=Tahoma][size=10.5pt]2[/size][/font][/color][color=black][font=宋体][size=10.5pt]者不在同一平面[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]由于数据方向是内部本地[/size][/font][/color][color=black][font=Tahoma][size=10.5pt]-->[/size][/font][/color][color=black][font=宋体][size=10.5pt]外部全局[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]要统一到全局平面[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]所以需要把内部本地转换成内部全局[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]用内部全局代表了内部本地[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]内部全局与外部全局就处于同一平面[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]就可以正常通信[/size][/font][/color][/size][size=3][color=black][font=Tahoma][size=10.5pt].
[/size][/font][/color][color=black][font=宋体][size=10.5pt]同理[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]外部全局[/size][/font][/color][color=black][font=Tahoma][size=10.5pt](SA)[/size][/font][/color][color=black][font=宋体][size=10.5pt]要和内部本地[/size][/font][/color][color=black][font=Tahoma][size=10.5pt](DA)[/size][/font][/color][color=black][font=宋体][size=10.5pt]通信[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]由于数据方向是外部全局[/size][/font][/color][color=black][font=Tahoma][size=10.5pt]--->[/size][/font][/color][color=black][font=宋体][size=10.5pt]内部本地[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]要统一到本地平面[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]外部全局就需要被转换到外部本地[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]用然后外部本地与内部本地通信[/size][/font][/color][/size][size=3][color=black][font=Tahoma][size=10.5pt].
[/size][/font][/color][color=black][font=宋体][size=10.5pt]事实上[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]我们可以这样理解路由器的行为[/size][/font][/color][/size][size=3][color=black][font=Tahoma][size=10.5pt]:
[/size][/font][/color][color=black][font=宋体][size=10.5pt]从内部本地发向外部全局的数据[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]数据包的源地址是内部本地[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]目的地址是外部本地[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]在经过路由器的[/size][/font][/color][color=black][font=Tahoma][size=10.5pt]inside[/size][/font][/color][color=black][font=宋体][size=10.5pt]接口后[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]源地址被替换为内部全局[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]而目的地址被替换为外部全局[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]也就是说实现了从本地平面向全局平面的迁移[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]在这里[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]如果转换前后的目标地址相同[/size][/font][/color][color=black][font=Tahoma][size=10.5pt]([/size][/font][/color][color=black][font=宋体][size=10.5pt]外部本地和外部全局[/size][/font][/color][color=black][font=Tahoma][size=10.5pt]),[/size][/font][/color][color=black][font=宋体][size=10.5pt]就可以认为是普通的由内到外的[/size][/font][/color][color=black][font=Tahoma][size=10.5pt]NAT,[/size][/font][/color][color=black][font=宋体][size=10.5pt]如果转换前后的目标地址不同[/size][/font][/color][color=black][font=Tahoma][size=10.5pt]([/size][/font][/color][color=black][font=宋体][size=10.5pt]外部本地和外部全局[/size][/font][/color][color=black][font=Tahoma][size=10.5pt]),[/size][/font][/color][color=black][font=宋体][size=10.5pt]就可以将这种方式用来处理路由器两边网络存在地址重叠的情况[/size][/font][/color][/size][size=3][color=black][font=Tahoma][size=10.5pt].
[/size][/font][/color][color=black][font=宋体][size=10.5pt]从外部全局发向内部本地的数据[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]数据保的源地址是外部全局[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]目的地址是内部全局[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]在经过路由器的[/size][/font][/color][color=black][font=Tahoma][size=10.5pt]outside[/size][/font][/color][color=black][font=宋体][size=10.5pt]接口后[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]源地址被替换为外部本地[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]而目的地址被替换为内部本地[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]也就是说实现了从全局平面向本地平面的迁移[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]在这里[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]如果转换前后的目标地址相同[/size][/font][/color][color=black][font=Tahoma][size=10.5pt]([/size][/font][/color][color=black][font=宋体][size=10.5pt]内部全局和内部本地[/size][/font][/color][color=black][font=Tahoma][size=10.5pt])[/size][/font][/color][color=black][font=宋体][size=10.5pt]相同[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]就可以认为是普通的由外向内的[/size][/font][/color][color=black][font=Tahoma][size=10.5pt]NAT,[/size][/font][/color][color=black][font=宋体][size=10.5pt]如果转换前后的目标地址不同[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]就可以将这种方式用来处理路由器两边网络存在地址重叠的情况[/size][/font][/color][/size][size=3][color=black][font=Tahoma][size=10.5pt].
NAT [/size][/font][/color][color=black][font=宋体][size=10.5pt]具体命令理解[/size][/font][/color][/size][color=black][font=Tahoma][size=10.5pt]
[size=3]1,[/size][/size][/font][/color][size=3][color=black][font=宋体][size=10.5pt]由内向外的转换[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]在路由器的[/size][/font][/color][color=black][font=Tahoma][size=10.5pt]inside[/size][/font][/color][color=black][font=宋体][size=10.5pt]口处发生了[/size][/font][/color][color=black][font=Tahoma][size=10.5pt]NAT[/size][/font][/color][color=black][font=宋体][size=10.5pt]转换行为[/size][/font][/color][/size][color=black][font=Tahoma][size=10.5pt]
[size=3]r1-2514(config)#ip nat inside ?
destination Destination address translation
source Source address translation
[/size][/size][/font][/color][size=3][color=black][font=宋体][size=10.5pt]从上面可以看出[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]在[/size][/font][/color][color=black][font=Tahoma][size=10.5pt]inside[/size][/font][/color][color=black][font=宋体][size=10.5pt]边可以对数据包中的源地址或者目标地址进行转换[/size][/font][/color][/size][size=3][color=black][font=Tahoma][size=10.5pt].
r1-2514(config)#ip nat inside source ?
list Specify access list describing local addresses
route-map Specify route-map
static Specify static local->global mapping
[/size][/font][/color][color=black][font=宋体][size=10.5pt]从上面可以看出[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]针对源地址进行转换可以使用[/size][/font][/color][color=black][font=Tahoma][size=10.5pt]acl [/size][/font][/color][color=black][font=宋体][size=10.5pt]或者[/size][/font][/color][color=black][font=Tahoma][size=10.5pt] route-map[/size][/font][/color][color=black][font=宋体][size=10.5pt]来表述一个本地地址[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]意思是数据包中源地址符合这些的都要被转换[/size][/font][/color][color=black][font=Tahoma][size=10.5pt]. [/size][/font][/color][color=black][font=宋体][size=10.5pt]也可以使用[/size][/font][/color][color=black][font=Tahoma][size=10.5pt]static[/size][/font][/color][color=black][font=宋体][size=10.5pt]进行静态映射[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]指定一个静态的从本地到全局的映射[/size][/font][/color][/size][size=3][color=black][font=Tahoma][size=10.5pt].
r1-2514(config)#ip nat inside source list 1 ?
interface Specify interface for global address
pool Name pool of global addresses
[/size][/font][/color][color=black][font=宋体][size=10.5pt]从上面输出可以看出接下来要给一个全局地址[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]数据包中的源地址将被这个全局地址替代[/size][/font][/color][/size][size=3][color=black][font=Tahoma][size=10.5pt].
[/size][/font][/color][color=black][font=宋体][size=10.5pt]对于静态映射[/size][/font][/color][color=black][font=Tahoma][size=10.5pt],[/size][/font][/color][color=black][font=宋体][size=10.5pt]还可以指定协议[/size][/font][/color]
[color=black][font=宋体][size=10.5pt]端口号[/size][/font][/color][/size][color=black][font=Tahoma][size=10.5pt][size=3]:
When translating addresses to an interface's address, outside-initiatedconnections to services on the inside network (like mail) will requireadditional configuration to send the connection to the correct insidehost. This command allows the user to map certain services to certaininside hosts.
[/size][/size][/font][/color][size=9pt]ip nat inside source static { tcp | udp } <localaddr> <localport> <globaladdr> <globalport>[/size]
[font=Arial][size=9pt]Example:[/size][/font]
[size=9pt]ip nat inside source static tcp 192.168.10.1 25 171.69.232.209 25[/size]
[font=Arial][size=9pt]In this example, outside-initiated connections to the SMTP port (25) will be sent to the inside host 192.168.10.1.[/size][/font]
[font=宋体][size=9pt]在[/size][/font][font=Arial][size=9pt]inside[/size][/font][font=宋体][size=9pt]边对目标进行转换[/size][/font][font=Arial][size=9pt]:[/size][/font]
[font=Arial][size=9pt]r1-2514(config)#ip nat inside destination ?
list Specify access list describing global addresses[/size][/font]
[font=宋体][size=9pt]从上面输出可以看出[/size][/font][font=Arial][size=9pt],[/size][/font][font=宋体][size=9pt]路由器要求输入一个表示全局地址的[/size][/font][font=Arial][size=9pt]ACL[/size][/font]
[font=Arial][size=9pt]r1-2514(config)#ip nat inside destination list 1 ?
pool Name pool of local addresses
pool Name pool of local addresses[/size][/font]
[font=宋体][size=9pt]接着要求输入一个本地地址池[/size][/font]
[font=宋体][size=9pt]所以这是一个针对从[/size][/font][font=Arial][size=9pt]outside[/size][/font][font=宋体][size=9pt]向[/size][/font][font=Arial][size=9pt]inside[/size][/font][font=宋体][size=9pt]方向数据的[/size][/font][font=Arial][size=9pt]NAT,[/size][/font][font=宋体][size=9pt]凡是在这个方向数据包中目标地址符合[/size][/font][font=Arial][size=9pt]ACL[/size][/font][font=宋体][size=9pt]描述的全部被转换成[/size][/font][font=Arial][size=9pt]POOL[/size][/font][font=宋体][size=9pt]中的本地地址[/size][/font][font=Arial][size=9pt].[/size][/font][font=宋体][size=9pt]这可以被用来进行[/size][/font][font=Arial][size=9pt]TCP[/size][/font][font=宋体][size=9pt]的负载均衡[/size][/font][font=Arial][size=9pt],[/size][/font][font=宋体][size=9pt]即外部都请求同一个全局地址[/size][/font][font=Arial][size=9pt],[/size][/font][font=宋体][size=9pt]而在路由器的[/size][/font][font=Arial][size=9pt]inside[/size][/font][font=宋体][size=9pt]边[/size][/font][font=Arial][size=9pt],[/size][/font][font=宋体][size=9pt]这些请求的目标地址全部被转换成地址池中的地址[/size][/font][font=Arial][size=9pt],[/size][/font][font=宋体][size=9pt]而且是循环使用地址池中的地址[/size][/font][font=Arial][size=9pt],[/size][/font][font=宋体][size=9pt]从而达到负载均衡[/size][/font][font=Arial][size=9pt],[/size][/font][font=宋体][size=9pt]但是这种方法只适合[/size][/font][font=Arial][size=9pt]TCP[/size][/font][font=宋体][size=9pt]流[/size][/font][font=Arial][size=9pt],[/size][/font][font=宋体][size=9pt]同时不适宜用在[/size][/font][font=Arial][size=9pt]WEB[/size][/font][font=宋体][size=9pt]服务的负载均担上[/size][/font][font=Arial][size=9pt].[/size][/font][font=宋体][size=9pt]详细解释看这里[/size][/font][font=Arial][size=9pt]:
[b]Destination Address Rotary Translation[/b]
Adynamic form of destination translation can be configured for someoutside-to-inside traffic. Once a mapping is set up, a destinationaddress matching one of those on an access list will be replaced withan address from a rotary pool. Allocation is done in a round-robinbasis, performed only when a new connection is opened from the outsideto the inside. All non-TCP traffic is passed untranslated (unless othertranslations are in effect).
Thisfeature was designed to provide protocol translation load distribution.It is not designed nor intended to be used as a substitute technologyfor Cisco's LocalDirector product. Destination address rotarytranslation should not be used to provide web service load balancingbecause, like vanilla DNS, it knows nothing about service availability.As a result, if a web server were to become offline, the destinationaddress rotary translation feature would continue to send requests tothe downed server.
[url=http://www.cisco.com/warp/public/732/Tech/ipservices/natalgs.pdf][color=#009999][size=12.0pt]http://www.cisco.com/warp/public/732/Tech/ipservices/natalgs.pdf[/size][/color][/url]
2.[/size][/font][font=宋体][size=9pt]由外向内[/size][/font][font=Arial][size=9pt],[/size][/font][font=宋体][size=9pt]在[/size][/font][font=Arial][size=9pt]OUTSIDE[/size][/font][font=宋体][size=9pt]边发生的行为[/size][/font][font=Arial][size=9pt]:
r1-2514(config)#ip nat outside ?
source Source address translation
[/size][/font][font=宋体][size=9pt]从上面可以看出在[/size][/font][font=Arial][size=9pt]OUTSIDE[/size][/font][font=宋体][size=9pt]边[/size][/font][font=Arial][size=9pt],[/size][/font][font=宋体][size=9pt]只能对数据包中的源地址转换[/size][/font][font=Arial][size=9pt]
r1-2514(config)#ip nat outside source ?
list Specify access list describing global addresses
route-map Specify route-map
static Specify static global->local mapping
[/size][/font][font=宋体][size=9pt]从上面可以看出接下来路由器要求给定一个全局地址的描述[/size][/font][font=Arial][size=9pt],[/size][/font][font=宋体][size=9pt]可以是[/size][/font][font=Arial][size=9pt]ACL route-map [/size][/font][font=宋体][size=9pt]或者[/size][/font]
[font=宋体][size=9pt]静态的[/size][/font][font=Arial][size=9pt].
r1-2514(config)#ip nat outside source list 1 ?
pool Name pool of local addresses
[/size][/font][font=宋体][size=9pt]从上面可以看出[/size][/font][font=Arial][size=9pt],[/size][/font][font=宋体][size=9pt]路由器接着又要求给定一个本地地址[/size][/font][font=Arial][size=9pt],[/size][/font][font=宋体][size=9pt]这说明[/size][/font]
[font=宋体][size=9pt]这个命令是对从外到内的数据包[/size][/font][font=Arial][size=9pt],[/size][/font][font=宋体][size=9pt]进行源地址字段的替换[/size][/font][font=Arial][size=9pt],[/size][/font][font=宋体][size=9pt]它将外部全局地址转换成内部地址[/size][/font][font=Arial][size=9pt]([/size][/font][font=宋体][size=9pt]内部本地或者内部全局[/size][/font][font=Arial][size=9pt],[/size][/font][font=宋体][size=9pt]内部本地和内部全局可以相同也可以不同[/size][/font][font=Arial][size=9pt])
[/size][/font][size=9pt]ip nat outside source { list <acl> pool <name> | static <global-ip> <local-ip> }
[/size][font=Arial][size=9pt]Thefirst form (list..pool..) enables dynamic translation. Packets fromaddresses that match those on the simple access list are translatedusing local addresses allocated from the named pool.
The second form (static) of the command sets up a single static translation.
[/size][/font][font=宋体][size=9pt]一个例子：[/size][/font][font=Arial][size=9pt]
CONFIGURATION EXAMPLES
Thefollowing sample configuration translates between inside hostsaddressed from either the 192.168.1.0 or 192.168.2.0 nets to theglobally-unique 171.69.233.208/28 network.
ip nat pool net-20 171.69.233.208 171.69.233.223 netmask <netmask> 255.255.255.240
ip nat inside source list 1 pool net-20
!
interface Ethernet0
ip address 171.69.232.182 255.255.255.240
[b]ip nat outside[/b]
!
interface Ethernet1
ip address 192.168.1.94 255.255.255.0
[b]ip nat inside
[/b]!
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 1 permit 192.168.2.0 0.0.0.255
[b]The next sample configuration translates between inside hostsaddressed from the 9.114.11.0 net to the globally unique171.69.233.208/28 network. Packets from outside hosts addressed from9.114.11.0 net (the "true" 9.114.11.0 net) are translated to appear tobe from net 10.0.1.0/24.
[/b][/size][/font][font=Arial][size=9pt]ip nat pool net-20 171.69.233.208 171.69.233.223 netmask <netmask> 255.255.255.240[/size][/font]
[font=宋体][size=9pt]定义一个名称为[/size][/font][font=Arial][size=9pt] net-20[/size][/font][font=宋体][size=9pt]的内部全局地址池[/size][/font]
[font=Arial][size=9pt]ip nat pool net-10 10.0.1.0 10.0.1.255 netmask <netmask> 255.255.255.0[/size][/font]
[font=宋体][size=9pt]定义一个名称为[/size][/font][font=Arial][size=9pt]net-10[/size][/font][font=宋体][size=9pt]的外部本地地址池[/size][/font][font=Arial][size=9pt]
ip nat [b]inside [/b]source list 1 pool net-20
ip nat [b]outside[/b] source list 1 pool net-10
[/size][/font][b][font=宋体][size=9pt]注意[/size][/font][/b][b][font=Arial][size=9pt]inside /outside[/size][/font][/b][b][font=宋体][size=9pt]全部调用了[/size][/font][/b][b][font=Arial][size=9pt]list 1 [/size][/font][/b][b][font=宋体][size=9pt]这说明[/size][/font][/b][b]
[/b][b][font=宋体][size=9pt]内外两边的源地址是重叠地址，通过将内部的源地址转换成[/size][/font][/b][b][font=Arial][size=9pt]net-20[/size][/font][/b][b][font=宋体][size=9pt]中地址和外部的[/size][/font][/b][b][font=Arial][size=9pt]9.114.11.0[/size][/font][/b][b][font=宋体][size=9pt]网络通信。将外部的源地址转换成[/size][/font][/b][b][font=Arial][size=9pt]net-10[/size][/font][/b][b][font=宋体][size=9pt]中的地址来与内部这边的[/size][/font][/b][b][font=Arial][size=9pt]9.114.11.0[/size][/font][/b][b][font=宋体][size=9pt]网络通信[/size][/font][/b][b]
[/b][font=Arial][size=9pt]!
interface Ethernet0
ip address 171.69.232.182 255.255.255.240
ip nat outside
!
interface Ethernet1
ip address 9.114.11.39 255.255.255.0
ip nat inside
!
[/size][/font][b][font=Arial][size=9pt]access-list 1 permit 9.114.11.0 0.0.0.255[/size][/font][/b][font=Arial][size=9pt]
NAT[/size][/font][font=宋体][size=9pt]的一些扩展特性：[/size][/font][font=Arial][size=9pt]
1[/size][/font][font=宋体][size=9pt]。更灵活的地址池分配方法[/size][/font][font=Arial][size=9pt]
More flexible pool configuration:
The pool configuration syntax has been extended to allow discontiguous ranges of addresses. The following syntax is now allowed:
ip nat pool <name> { netmask <mask> | prefix-length <length> } [ type { rotary } ]
This command will put the user into IP NAT Pool configuration mode,where a sequence of address ranges can be configured. There is only onecommand in this mode:
address <start> <end>
Example:
Router(config)#ip nat pool fred prefix-length 24
Router(config-ipnat-pool)#address 171.69.233.225 171.69.233.226
Router(config-ipnat-pool)#address 171.69.233.228 171.69.233.238
This configuration creates a pool containing addresses171.69.233.225-226 and 171.69.233.228-238 (171.69.233.227 has beenomitted).
2[/size][/font][font=宋体][size=9pt]。使用接口作地址，满足那些没有固定[/size][/font][font=Arial][size=9pt]IP[/size][/font][font=宋体][size=9pt]情况的需要[/size][/font][font=Arial][size=9pt]
Translating to interface's address:
Asa convenience for users wishing to translate all inside addresses tothe address assigned to an interface on the router, the NAT code allowsone to simply name the interface when configuring the dynamictranslation rule:
ip nat inside source list <number> interface <interface> overload
If there is no address on the interface, or it the interface is not up, no translation will occur.
Example:
ip nat inside source list 1 interface Serial0 overload
3[/size][/font][font=宋体][size=9pt]。利用端口的静态转换[/size][/font][font=Arial][size=9pt]
Static translations with ports:
Whentranslating addresses to an interface's address, outside-initiatedconnections to services on the inside network (like mail) will requireadditional configuration to send the connection to the correct insidehost. This command allows the user to map certain services to certaininside hosts.
ip nat inside source static { tcp | udp } <localaddr> <localport> <globaladdr> <globalport>
Example:
ip nat inside source static tcp 192.168.10.1 25 171.69.232.209 25
In this example, outside-initiated connections to the SMTP port (25) will be sent to the inside host 192.168.10.1.
4[/size][/font][font=宋体][size=9pt]。利用[/size][/font][font=Arial][size=9pt]route-map[/size][/font][font=宋体][size=9pt]实现多[/size][/font][font=Arial][size=9pt]ISP[/size][/font][font=宋体][size=9pt]策略[/size][/font][font=Arial][size=9pt]
Support for route maps:
Thedynamic translation command can now specify a route-map to be processedinstead of an access-list. A route-map allows the user to match anycombination of access-list, next-hop IP address, and output interfaceto determine which pool to use:
ip nat inside source route-map <name> pool <name>
Example:
ip nat pool provider1-space 171.69.232.1 171.69.232.254 prefix-length 24
ip nat pool provider2-space 131.108.43.1 131.108.43.254 prefix-length 24
ip nat inside source route-map provider1-map pool provider1-space
ip nat inside source route-map provider2-map pool provider2-space
!
interface Serial0/0
ip nat outside
!
interface Serial0/1
ip nat outside
!
interface Fddi1/0
ip nat inside
!
route-map provider1-map permit 10
match ip address 1
match interface Serial0/0
!
route-map provider2-map permit 10
match ip address 1
match interface Serial0/1
[/size][/font][font=宋体][size=9pt]关于在[/size][/font][font=Arial][size=9pt]NAT[/size][/font][font=宋体][size=9pt]中[/size][/font][font=Arial][size=9pt]route-map [/size][/font][font=宋体][size=9pt]与[/size][/font][font=Arial][size=9pt]ACL[/size][/font][font=宋体][size=9pt]逻辑先后关系的研究请看这里：[/size][/font][font=Arial][size=9pt]
[url=http://www.mycisco.cn/post/70.html][color=#009999][size=12.0pt]http://www.mycisco.cn/post/70.html[/size][/color][/url]
5[/size][/font][font=宋体][size=9pt]。利用[/size][/font][font=Arial][size=9pt]add-route[/size][/font][font=宋体][size=9pt]参数自动增加一个路由，[/size][/font][font=Arial][size=9pt][url=http://www.cisco.com/en/US/tech/tk648/tk361/technologies_configuration_example09186a0080093f8e.shtml][color=#009999][font=宋体][size=12.0pt]详细例子请看这里[/size][/font][/color][/url]
PAT[/size][/font][font=宋体][size=9pt]相关：[/size][/font]
[font=Arial][size=7pt]Basic Concepts of PAT[/size][/font][font=Arial][size=9pt][/size][/font][/align][/align][align=left][align=left][font=Arial][size=9pt][/size][/font][/align][/align][align=left][align=left][b][font=Arial][size=7pt]Figure 5[/size][/font][/b][font=Arial][size=7pt]
Unique Source Port per Translation Entry[/size][/font][/align][/align][align=left][align=left][font=Arial][size=7pt][/size][/font][/align][/align][align=left][align=left][font=Arial][size=9pt]Severalinternal addresses can be NATed to only one or a few external addresse**y using a feature called Port Address Translation (PAT) which is alsoreferred to as "overload", a subset of NAT functionality.[/size][/font]
[font=Arial][size=9pt]PATuses unique source port numbers on the Inside Global IP address todistinguish between translations. Because the port number is encoded in16 bits, the total number could theoretically be as high as 65,536 perIP address. PAT will attempt to preserve the original source port, ifthis source port is already allocated PAT will attempt to find thefirst available port number starting from the beginning of theappropriate port group 0-5111, 512-1023 or 1024-65535. If there isstill no port available from the appropriate group and more than one IPaddress is configured, PAT will move to the next IP address and try toallocate the original source port again. This continues until it runsout of available ports and IP addresses.[/size][/font]
[font=宋体][size=9pt]本文参考了[/size][/font][font=Arial][size=9pt]CISCO[/size][/font][font=宋体][size=9pt]文档：[/size][/font]
[font=Arial][size=9pt][url=http://www.cisco.com/en/US/tech/tk648/tk361/technologies_white_paper09186a0080091cb9.shtml][color=#009999][size=12.0pt]http://www.cisco.com/en/US/tech/tk648/tk361/technologies_white_paper09186a0080091cb9.shtml[/size][/color][/url][/size][/font][font=Arial][size=7pt][/size][/font][/align][/align][align=left][align=left][font=Arial][size=9pt][url=http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080094837.shtml][color=#009999][size=12.0pt]http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080094837.shtml[/size][/color][/url][/size][/font][font=Arial][size=7pt][/size][/font][/align][/align][font=Times New Roman][size=3] [/size][/font]
[/size][/font]
