如何利用route-map在思科路由器上实现双出口nat h3c nat route policy

如何利用route-map在思科路由器上实现双出口nat
思科路由器一般不用作nat,因为CPU利用率太高。但如果小型企业在内网用户数不多的情况下,防火墙成本较高,如果以现有路由器作上网设备,也是一个经济的选择。在适当的配置下,还能实现灵活的路由策略及nat策略。以下介绍相关的配置命令及实现方法。
一、NAT相关的配置命令工具介绍。
1、ACL
ACL是用来定义内网上网用户的工具,可以是标准ACL,也可以是扩展ACL;当需要使用到route-map时,它是定义地位范围的工具。
2、route-map
route-map是灵活控制路由策略及NAT策略的有力工具。
3、NAT配置策略
4、路由配置策略
二、实现方法
好了,现在我们来看如果实现。



以上是路由器示意图。假定有两个ISP,分别接在两个广域网接口。
规定2.2.2.2只能从ISP1访问,3.3.3.3只能从ISP访问,172.16.1.0网段的用户使用12.0.0.1从ISP1出去,172.17.1.0网段的用户使用13.0.0.1从ISP2出去。
配置命令如下:
R1#sh run
Building configuration...

Current configuration : 3164 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
no logging console
!
no aaa new-model
!
resource policy
!
memory-size iomem 5
!
!
ip cef
no ip domain lookup
no ip dhcp use vrf connected
ip dhcp excluded-address 172.16.1.1
ip dhcp excluded-address 172.17.1.1
!
ip dhcp pool 16
network 172.16.1.0255.255.255.0
default-router172.16.1.1
!
ip dhcp pool 17
network 172.17.1.0255.255.255.0
default-router172.17.1.1
!

interface Serial4/0
description To ISP1
ip address 12.0.0.1 255.255.255.0
ip nat outside
ip virtual-reassembly
serial restart-delay 0
!
interface Serial4/1
description To ISP2
ip address 13.0.0.1 255.255.255.0
ip nat outside
ip virtual-reassembly
serial restart-delay 0
!
interface FastEthernet5/0
!
interface FastEthernet5/1
!
interface FastEthernet5/2
switchport access vlan 2
!
interface FastEthernet5/3
switchport access vlan 3
!
interface FastEthernet5/4
!
interface FastEthernet5/5
!
interface FastEthernet5/6
!
interface FastEthernet5/7
!
interface FastEthernet5/8
!
interface FastEthernet5/9
!
interface FastEthernet5/10
!
interface FastEthernet5/11
!
interface FastEthernet5/12
!
interface FastEthernet5/13
!
interface FastEthernet5/14
!
interface FastEthernet5/15
!
interface Vlan1
no ip address
!
interface Vlan2
ip address 172.16.1.1 255.255.255.0
ip nat inside
ip virtual-reassembly
ip policy route-map 16
!
interface Vlan3
ip address 172.17.1.1 255.255.255.0
ip nat inside
ip virtual-reassembly
ip policy route-map 17
!
no ip http server
no ip http secure-server
ip route 0.0.0.0 0.0.0.0 12.0.0.2
ip route 0.0.0.0 0.0.0.0 13.0.0.3
!
!
ip nat inside source route-map nat16 interface Serial4/0overload
ip nat inside source route-map nat17 interface Serial4/1overload
!
access-list 16 permit 172.16.1.0 0.0.0.255
access-list 17 permit 172.17.1.0 0.0.0.255
access-list 122 permit ip any host 2.2.2.2
access-list 133 permit ip any host 3.3.3.3
!
route-map 17 permit 10
match ip address 122
set ip next-hop 12.0.0.2
!
route-map 17 permit 20
set ip next-hop 13.0.0.3
!
route-map 16 permit 10
match ip address 133
set ip next-hop 13.0.0.3
!
route-map 16 permit 20
set ip next-hop 12.0.0.2
!
route-map nat16 permit 10
match ip address 16
!
route-map nat17 permit 10
match ip address 17
!
!
!
!
control-plane
!
!
!
!
!
!
!
!
!
line con 0
logging synchronous
line aux 0
line vty 0 4
login
!
!
end
-----------------------------------
以下是相关状态信息:
R1#sh ip nat t
Pro InsideglobalInsidelocalOutsidelocalOutside global
icmp12.0.0.1:68172.16.1.2:682.2.2.2:682.2.2.2:68
icmp12.0.0.1:69172.16.1.2:6922.22.22.22:6922.22.22.22:69
icmp12.0.0.1:70172.16.1.2:703.3.3.3:703.3.3.3:70
icmp12.0.0.1:71172.16.1.2:7133.33.33.33:7133.33.33.33:71
icmp13.0.0.1:46172.17.1.2:462.2.2.2:462.2.2.2:46
icmp13.0.0.1:47172.17.1.2:4722.22.22.22:4722.22.22.22:47
icmp13.0.0.1:48172.17.1.2:483.3.3.3:483.3.3.3:48
icmp13.0.0.1:49172.17.1.2:4933.33.33.33:4933.33.33.33:49

traceroute 2.2.2.2

Type escape sequence to abort.
Tracing the route to 2.2.2.2

1 172.16.1.1 708 msec 204 msec 912 msec
2 12.0.0.2 200 msec * 168msec

traceroute 22.22.22.22

Type escape sequence to abort.
Tracing the route to 22.22.22.22

1 172.16.1.1 1024 msec 2016 msec 548 msec
2 12.0.0.2 204 msec * 132msec

traceroute 33.33.33.33

Type escape sequence to abort.
Tracing the route to 33.33.33.33

1 172.16.1.1 1220 msec 624 msec 528 msec
2 12.0.0.2 176 msec 164 msec 92 msec
3 192.168.1.3 160 msec * 128msec

raceroute 3.3.3.3

Type escape sequence to abort.
Tracing the route to 3.3.3.3

1 172.16.1.1 380 msec 552 msec 1524 msec
2 13.0.0.3 256 msec * 140msec-------------------------------------------只有3.3.3.3是以从ISP2出去。

traceroute 3.3.3.3

Type escape sequence to abort.
Tracing the route to 3.3.3.3

1 172.17.1.1 644 msec 128 msec 1628 msec
2 13.0.0.3 256 msec * 196msec

traceroute 22.22.22.22

Type escape sequence to abort.
Tracing the route to 22.22.22.22

1 172.17.1.1 580 msec 448 msec 1704 msec
2 13.0.0.3 212 msec 240 msec 260 msec
3 192.168.1.2 268 msec * 120msec

traceroute 33.33.33.33

Type escape sequence to abort.
Tracing the route to 33.33.33.33

1 172.17.1.1 332 msec 120 msec 2056 msec
如何利用route-map在思科路由器上实现双出口nat h3c nat route policy
2 13.0.0.3 232 msec * 212msec

traceroute 2.2.2.2

Type escape sequence to abort.
Tracing the route to 2.2.2.2

1 172.17.1.1 160 msec 132 msec 1648 msec
2 12.0.0.2 152 msec * 144msec----------------------------------------------只有2.2.2.2是从ISP1出去。


如果我们使用ip inside source list ACL命令,也可以实现NAT的分摊,命令大同小异,不过源地址最好别写成any,那样可能会有网段不能转译。只要不是很特殊的应用,以什么IP出去似乎没有什么关系。不过有一点要注意:就算NAT只在一个出口生效,也并不影响路由及策略路由。读者可以自己检验。

  

爱华网本文地址 » http://www.413yy.cn/a/25101015/250600.html

更多阅读

思科路由器如何配置DHCP实例 思科交换机dhcp配置

思科路由器如何配置DHCP实例?今天给大家分享一下思科路由器配置成DHCP服务器;由于实例很简单,于是精简单讲解;如图示:如图示:路由0:F0/0:59.40.78.185/28;DHCP:192.168.1.0/24 GW:192.168.1.1;配置如下:outer(config)#ip dhcp po

教你路由器端口映射设置方法 思科路由器端口映射

教你路由器端口映射设置方法——简介本文就以TD-W89841N无线路由器为例做一个端口映射80端口号和映射3389端口号为例,希望能帮到局域网内想使用路由器做端口号映射到自己电脑的网友一个帮助。工具/原料教你路由器端口映射设置方法

思科路由器双线接入 一年两重组 思科中国双线管理乱局

“中国市场非常不一样,商业模式也不一样。”这一次,思科集团总裁钱伯斯的备忘录里,终于记下了这一条。然而,这一条备忘录所带来的却是一场“调整中的混乱”。在华为等中国企业的竞争压力面前,钱伯斯是想调整在中国的业务。于是,一年多里,

声明:《如何利用route-map在思科路由器上实现双出口nat h3c nat route policy》为网友格局化寥寂分享!如侵犯到您的合法权益请联系我们删除