爱华网思科路由器一般不用作nat，因为CPU利用率太高。但如果小型企业在内网用户数不多的情况下，防火墙成本较高，如果以现有路由器作上网设备，也是一个经济的选择。在适当的配置下，还能实现灵活的路由策略及nat策略。以下介绍相关的配置命令及实现方法。
一、NAT相关的配置命令工具介绍。
1、ACL
ACL是用来定义内网上网用户的工具，可以是标准ACL，也可以是扩展ACL；当需要使用到route-map时，它是定义地位范围的工具。
2、route-map
route-map是灵活控制路由策略及NAT策略的有力工具。
3、NAT配置策略
4、路由配置策略
二、实现方法
好了，现在我们来看如果实现。
以上是路由器示意图。假定有两个ISP，分别接在两个广域网接口。
规定2.2.2.2只能从ISP1访问，3.3.3.3只能从ISP访问，172.16.1.0网段的用户使用12.0.0.1从ISP1出去，172.17.1.0网段的用户使用13.0.0.1从ISP2出去。
配置命令如下：
R1#sh run
Building configuration...
Current configuration : 3164 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
no logging console
!
no aaa new-model
!
resource policy
!
memory-size iomem 5
!
!
ip cef
no ip domain lookup
no ip dhcp use vrf connected
ip dhcp excluded-address 172.16.1.1
ip dhcp excluded-address 172.17.1.1
!
ip dhcp pool 16
network 172.16.1.0255.255.255.0
default-router172.16.1.1
!
ip dhcp pool 17
network 172.17.1.0255.255.255.0
default-router172.17.1.1
!
interface Serial4/0
description To ISP1
ip address 12.0.0.1 255.255.255.0
ip nat outside
ip virtual-reassembly
serial restart-delay 0
!
interface Serial4/1
description To ISP2
ip address 13.0.0.1 255.255.255.0
ip nat outside
ip virtual-reassembly
serial restart-delay 0
!
interface FastEthernet5/0
!
interface FastEthernet5/1
!
interface FastEthernet5/2
switchport access vlan 2
!
interface FastEthernet5/3
switchport access vlan 3
!
interface FastEthernet5/4
!
interface FastEthernet5/5
!
interface FastEthernet5/6
!
interface FastEthernet5/7
!
interface FastEthernet5/8
!
interface FastEthernet5/9
!
interface FastEthernet5/10
!
interface FastEthernet5/11
!
interface FastEthernet5/12
!
interface FastEthernet5/13
!
interface FastEthernet5/14
!
interface FastEthernet5/15
!
interface Vlan1
no ip address
!
interface Vlan2
ip address 172.16.1.1 255.255.255.0
ip nat inside
ip virtual-reassembly
ip policy route-map 16
!
interface Vlan3
ip address 172.17.1.1 255.255.255.0
ip nat inside
ip virtual-reassembly
ip policy route-map 17
!
no ip http server
no ip http secure-server
ip route 0.0.0.0 0.0.0.0 12.0.0.2
ip route 0.0.0.0 0.0.0.0 13.0.0.3
!
!
ip nat inside source route-map nat16 interface Serial4/0overload
ip nat inside source route-map nat17 interface Serial4/1overload
!
access-list 16 permit 172.16.1.0 0.0.0.255
access-list 17 permit 172.17.1.0 0.0.0.255
access-list 122 permit ip any host 2.2.2.2
access-list 133 permit ip any host 3.3.3.3
!
route-map 17 permit 10
match ip address 122
set ip next-hop 12.0.0.2
!
route-map 17 permit 20
set ip next-hop 13.0.0.3
!
route-map 16 permit 10
match ip address 133
set ip next-hop 13.0.0.3
!
route-map 16 permit 20
set ip next-hop 12.0.0.2
!
route-map nat16 permit 10
match ip address 16
!
route-map nat17 permit 10
match ip address 17
!
!
!
!
control-plane
!
!
!
!
!
!
!
!
!
line con 0
logging synchronous
line aux 0
line vty 0 4
login
!
!
end
-----------------------------------
以下是相关状态信息：
R1#sh ip nat t
Pro InsideglobalInsidelocalOutsidelocalOutside global
icmp12.0.0.1:68172.16.1.2:682.2.2.2:682.2.2.2:68
icmp12.0.0.1:69172.16.1.2:6922.22.22.22:6922.22.22.22:69
icmp12.0.0.1:70172.16.1.2:703.3.3.3:703.3.3.3:70
icmp12.0.0.1:71172.16.1.2:7133.33.33.33:7133.33.33.33:71
icmp13.0.0.1:46172.17.1.2:462.2.2.2:462.2.2.2:46
icmp13.0.0.1:47172.17.1.2:4722.22.22.22:4722.22.22.22:47
icmp13.0.0.1:48172.17.1.2:483.3.3.3:483.3.3.3:48
icmp13.0.0.1:49172.17.1.2:4933.33.33.33:4933.33.33.33:49
traceroute 2.2.2.2
Type escape sequence to abort.
Tracing the route to 2.2.2.2
1 172.16.1.1 708 msec 204 msec 912 msec
2 12.0.0.2 200 msec * 168msec
traceroute 22.22.22.22
Type escape sequence to abort.
Tracing the route to 22.22.22.22
1 172.16.1.1 1024 msec 2016 msec 548 msec
2 12.0.0.2 204 msec * 132msec
traceroute 33.33.33.33
Type escape sequence to abort.
Tracing the route to 33.33.33.33
1 172.16.1.1 1220 msec 624 msec 528 msec
2 12.0.0.2 176 msec 164 msec 92 msec
3 192.168.1.3 160 msec * 128msec
raceroute 3.3.3.3
Type escape sequence to abort.
Tracing the route to 3.3.3.3
1 172.16.1.1 380 msec 552 msec 1524 msec
2 13.0.0.3 256 msec * 140msec-------------------------------------------只有3.3.3.3是以从ISP2出去。
traceroute 3.3.3.3
Type escape sequence to abort.
Tracing the route to 3.3.3.3
1 172.17.1.1 644 msec 128 msec 1628 msec
2 13.0.0.3 256 msec * 196msec
traceroute 22.22.22.22
Type escape sequence to abort.
Tracing the route to 22.22.22.22
1 172.17.1.1 580 msec 448 msec 1704 msec
2 13.0.0.3 212 msec 240 msec 260 msec
3 192.168.1.2 268 msec * 120msec
traceroute 33.33.33.33
Type escape sequence to abort.
Tracing the route to 33.33.33.33
1 172.17.1.1 332 msec 120 msec 2056 msec
2 13.0.0.3 232 msec * 212msec
traceroute 2.2.2.2
Type escape sequence to abort.
Tracing the route to 2.2.2.2
1 172.17.1.1 160 msec 132 msec 1648 msec
2 12.0.0.2 152 msec * 144msec----------------------------------------------只有2.2.2.2是从ISP1出去。
如果我们使用ip inside source list ACL命令，也可以实现NAT的分摊，命令大同小异，不过源地址最好别写成any，那样可能会有网段不能转译。只要不是很特殊的应用，以什么IP出去似乎没有什么关系。不过有一点要注意：就算NAT只在一个出口生效，也并不影响路由及策略路由。读者可以自己检验。
