2022年2022年华为NAT配置 .pdf

《2022年2022年华为NAT配置 .pdf》由会员分享，可在线阅读，更多相关《2022年2022年华为NAT配置 .pdf（9页珍藏版）》请在淘文阁 - 分享文档赚钱的网站上搜索。

1、华为 NAT配置NAT【Router】当前路由器提示视图依次输入的配置命令，重要的命令红色突出显示简单说明Quidway acl number 2000Quidway-acl-basic-2000 rule permit source 10.124.187.0 0.0.0.255配置允许进行 NAT转换的内网地址段Quidway-acl-basic-2000 rule denyQuidway interface Ethernet0/1 Quidway-Ethernet0/1 ip address 10.124.187.1 255.0.0.0 内网网关Quidway interface Ethe

2、rnet0/0 Quidway-Ethernet0/1 ip address 10.124.1.1 255.255.255.248 Quidway-Ethernet0/1 nat outbound 2000在出接口上进行 NAT转换Quidway ip route-static 0.0.0.0 0.0.0.0 101.1.1.1 preference 60 配置默认路由名师资料总结-精品资料欢迎下载-名师精心整理-第 1 页，共 9 页 -华为路由器单臂路由配置实例组网描述:PC-3050C-AR28-31-INTERNET 组网实现:3050C上划分多个 VLAN,在 AR28-31上终结

3、VLAN信息,下面的所有 VLAN中的 PC都可以上公网,所有的 PC机都通过 AR28-31分配 IP 地址和 DNS AR28-31dis cu#sysname Quidway#FTP server enable#nat address-group 0 222.222.222.2 222.222.222.10 用于上公网的地址池#radius scheme system#domain system#local-user admin password cipher.USE=B,53Q=QMAF41!service-type telnet terminal level 3 service-ty

4、pe ftp local-user huawei telnet用户,用于远程管理password simple huawei service-type telnet level 3#dhcp server ip-pool 10 为 VLAN10 分配 IP地址network 192.168.10.0 mask 255.255.255.0 gateway-list 192.168.10.1 dns-list 100.100.100.100#dhcp server ip-pool 20 为 VLAN20 分配 IP地址network 192.168.20.0 mask 255.255.255.0

5、gateway-list 192.168.20.1 名师资料总结-精品资料欢迎下载-名师精心整理-第 2 页，共 9 页 -dns-list 100.100.100.100#dhcp server ip-pool 30 为 VLAN30 分配 IP地址network 192.168.30.0 mask 255.255.255.0 gateway-list 192.168.30.1 dns-list 100.100.100.100#dhcp server ip-pool 40 为 VLAN40 分配 IP地址network 192.168.40.0 mask 255.255.255.0 gate

6、way-list 192.168.40.1 dns-list 100.100.100.100#interface Aux0 async mode flow#interface Ethernet1/0 用于与 交换机 的管理 IP 互通ip address 192.168.100.1 255.255.255.0 firewall packet-filter 3000 inbound#interface Ethernet1/0.1 终结交换机上的 VLAN10 tcp mss 1024 ip address 192.168.10.1 255.255.255.0 firewall packet-fi

7、lter 3000 inbound vlan-type dot1q vid 10#interface Ethernet1/0.2 终结交换机上的 VLAN20 tcp mss 1024 ip address 192.168.20.1 255.255.255.0 firewall packet-filter 3000 inbound vlan-type dot1q vid 20#interface Ethernet1/0.3 终结交换机上的 VLAN30 tcp mss 1024 ip address 192.168.30.1 255.255.255.0 firewall packet-filt

8、er 3000 inbound vlan-type dot1q vid 30#interface Ethernet1/0.4 终结交换机上的 VLAN名师资料总结-精品资料欢迎下载-名师精心整理-第 3 页，共 9 页 -40 tcp mss 1024 ip address 192.168.40.1 255.255.255.0 firewall packet-filter 3000 inbound vlan-type dot1q vid 40#interface Ethernet2/0 ip address 222.222.222.1 255.255.255.0 nat outbound 20

9、00 address-group 0 进行私网到公网的地址转换#interface NULL0#acl number 2000 允许 192.168.0.0 这个网段的地址进行地址转换rule 0 permit source 192.168.0.0 0.0.255.255 rule 1 deny#acl number 3000 rule 0 deny udp destination-port eq tftp rule 1 deny tcp destination-port eq 135 rule 2 deny udp destination-port eq 135 rule 3 deny ud

10、p destination-port eq netbios-ns rule 4 deny udp destination-port eq netbios-dgm rule 5 deny tcp destination-port eq 139 rule 6 deny udp destination-port eq netbios-ssn rule 7 deny tcp destination-port eq 445 rule 8 deny udp destination-port eq 445 rule 9 deny tcp destination-port eq 539 rule 10 den

11、y udp destination-port eq 539 rule 11 deny udp destination-port eq 593 rule 12 deny tcp destination-port eq 593 rule 13 deny udp destination-port eq 1434 rule 14 deny tcp destination-port eq 4444 rule 15 deny tcp destination-port eq 9996 rule 16 deny tcp destination-port eq 5554 rule 17 deny udp des

12、tination-port eq 9996 rule 18 deny udp destination-port eq 5554 rule 19 deny tcp destination-port eq 137 rule 20 deny tcp destination-port eq 138 rule 21 deny tcp destination-port eq 1025 rule 22 deny udp destination-port eq 1025 rule 23 deny tcp destination-port eq 9995 rule 24 deny udp destination

13、-port eq 9995 名师资料总结-精品资料欢迎下载-名师精心整理-第 4 页，共 9 页 -rule 25 deny tcp destination-port eq 1068 rule 26 deny udp destination-port eq 1068 rule 27 deny tcp destination-port eq 1023 rule 28 deny udp destination-port eq 1023#ip route-static 0.0.0.0 0.0.0.0 222.222.222.254 preference 60 到电信网关的缺省路由#user-inte

14、rface con 0 user-interface aux 0 user-interface vty 0 4 authentication-mode scheme#return=dis cu#sysname Quidway#radius scheme system server-type huawei primary authentication 127.0.0.1 1645 primary accounting 127.0.0.1 1646 user-name-format without-domain domain system radius-scheme system access-l

15、imit disable state active vlan-assignment-mode integer idle-cut disable self-service-url disable messenger time disable domain default enable system#local-server nas-ip 127.0.0.1 key huawei local-user huawei 用于 WEB 网管和 TELNET password simple huawei service-type telnet level 3#vlan 1#名师资料总结-精品资料欢迎下载-

16、名师精心整理-第 5 页，共 9 页 -vlan 10#vlan 20#vlan 30#vlan 40#interface Vlan-interface1 管理 IP ip address 192.168.100.2 255.255.255.0#interface Aux0/0#interface Ethernet0/1 port access vlan 10#interface Ethernet0/2 port access vlan 10#interface Ethernet0/3 port access vlan 10#interface Ethernet0/4 port access

17、vlan 10#interface Ethernet0/5 port access vlan 10#interface Ethernet0/6 port access vlan 10#interface Ethernet0/7 port access vlan 10#interface Ethernet0/8 port access vlan 10#interface Ethernet0/9 port access vlan 10#interface Ethernet0/10 port access vlan 10#interface Ethernet0/11 名师资料总结-精品资料欢迎下载-

18、名师精心整理-第 6 页，共 9 页 -port access vlan 20#interface Ethernet0/12 port access vlan 20#interface Ethernet0/13 port access vlan 20#interface Ethernet0/14 port access vlan 20#interface Ethernet0/15 port access vlan 20#interface Ethernet0/16 port access vlan 20#interface Ethernet0/17 port access vlan 20#in

19、terface Ethernet0/18 port access vlan 20#interface Ethernet0/19 port access vlan 20#interface Ethernet0/20 port access vlan 20#interface Ethernet0/21 port access vlan 30#interface Ethernet0/22 port access vlan 30#interface Ethernet0/23 port access vlan 30#interface Ethernet0/24 port access vlan 30#i

20、nterface Ethernet0/25 port access vlan 30#名师资料总结-精品资料欢迎下载-名师精心整理-第 7 页，共 9 页 -interface Ethernet0/26 port access vlan 30#interface Ethernet0/27 port access vlan 30#interface Ethernet0/28 port access vlan 30#interface Ethernet0/29 port access vlan 30#interface Ethernet0/30 port access vlan 30#interfa

21、ce Ethernet0/31 port access vlan 40#interface Ethernet0/32 port access vlan 40#interface Ethernet0/33 port access vlan 40#interface Ethernet0/34 port access vlan 40#interface Ethernet0/35 port access vlan 40#interface Ethernet0/36 port access vlan 40#interface Ethernet0/37 port access vlan 40#interf

22、ace Ethernet0/38 port access vlan 40#interface Ethernet0/39 port access vlan 40#interface Ethernet0/40 port access vlan 40 名师资料总结-精品资料欢迎下载-名师精心整理-第 8 页，共 9 页 -#interface Ethernet0/41 port access vlan 40#interface Ethernet0/42 port access vlan 40#interface Ethernet0/43 port access vlan 40#interface E

23、thernet0/44 port access vlan 40#interface Ethernet0/45 port access vlan 40#interface Ethernet0/46 port access vlan 40#interface Ethernet0/47 port access vlan 40#interface Ethernet0/48 上行口port link-type trunk port trunk permit vlan 1 10 20 30 40 只允许这几个 VLAN标签透传#interface NULL0#user-interface aux 0 user-interface vty 0 4#return 名师资料总结-精品资料欢迎下载-名师精心整理-第 9 页，共 9 页 -