問(wèn)題
隨著接入Internet的計(jì)算機(jī)數(shù)量的不斷猛增尖殃，IP地址資源也就愈加顯得捉襟見(jiàn)肘。事實(shí)上谓传，除了中國(guó)教育和科研計(jì)算機(jī)網(wǎng)（CERNET）外艳狐，一般用戶幾乎申請(qǐng)不到整段的C類(lèi)IP地址。在其他ISP那里瘪菌，即使是擁有幾百臺(tái)計(jì)算機(jī)的大型局域網(wǎng)用戶撒会，當(dāng)他們申請(qǐng)IP地址時(shí)，所分配的地址也不過(guò)只有幾個(gè)或十幾個(gè)IP地址师妙。顯然诵肛，這樣少的IP地址根本無(wú)法滿足網(wǎng)絡(luò)用戶的需求。
方案
借助于NAT默穴，私有（保留）地址的"內(nèi)部"網(wǎng)絡(luò)通過(guò)路由器發(fā)送數(shù)據(jù)包時(shí)怔檩，私有地址被轉(zhuǎn)換成合法的IP地址褪秀，一個(gè)局域網(wǎng)只需使用少量IP地址（甚至是1個(gè)）即可實(shí)現(xiàn)私有地址網(wǎng)絡(luò)內(nèi)所有計(jì)算機(jī)與Internet的通信需求。
在R1上配置靜態(tài)NAT使192.168.1.1轉(zhuǎn)換為61.159.62.131薛训，192.168.1.2轉(zhuǎn)換為61.159.62.132溜歪，實(shí)現(xiàn)外部網(wǎng)絡(luò)訪問(wèn)。
這種通過(guò)使用少量的公有IP 地址代表較多的私有IP 地址的方式许蓖，將有助于減緩可用IP地址空間的枯竭蝴猪。而且還能夠有效地避免來(lái)自網(wǎng)絡(luò)外部的攻擊，隱藏并保護(hù)網(wǎng)絡(luò)內(nèi)部的計(jì)算機(jī)膊爪。
步驟
通用配置
配置R1端口IP地址自阱，以及默認(rèn)路由
tarena-R1(config)#interface f0/0
tarena-R1(config-if)#ip address 192.168.1.254 255.255.255.0
tarena-R1(config-if)#no shutdown
tarena-R1(config-if)#interface f0/1
tarena-R1(config-if)#ip address 61.159.62.129 255.255.255.248
tarena-R1(config-if)#no shutdown
tarena-R1(config-if)#exit
tarena-R1(config)#ip route 0.0.0.0 0.0.0.0 f0/1
配置R2端口IP地址
不需要在R2上配置到企業(yè)內(nèi)網(wǎng)的靜態(tài)路由，因?yàn)镹AT的存在米酬，企業(yè)內(nèi)部的地址都將被轉(zhuǎn)換沛豌、隱藏。
tarena-R2(config)#interface f0/0
tarena-R2(config-if)#ip address 61.159.62.130 255.255.255.248
tarena-R2(config-if)#no shutdown
tarena-R2(config-if)#interface f0/1
tarena-R2(config-if)#ip address 192.168.2.254 255.255.255.0
tarena-R2(config-if)#no shutdown
靜態(tài)NAT配置
在R1上將192.168.1.1映射到61.159.62.131赃额，將192.168.1.2映射到61.159.62.132
靜態(tài)映射有唯一對(duì)應(yīng)的關(guān)系加派。
通過(guò)靜態(tài)NAT，可以把內(nèi)網(wǎng)服務(wù)器發(fā)布到外網(wǎng)跳芳。
tarena-R1(config)#ip nat inside source static 192.168.1.1 61.159.62.131
tarena-R1(config)#ip nat inside source static 192.168.1.2 61.159.62.132
在R1上配置NAT內(nèi)芍锦、外端口
tarena-R1(config)#interface f0/0
tarena-R1(config-if)#ipnat inside /內(nèi)
tarena-R1(config-if)#interface f0/1
tarena-R1(config-if)#ipnat outside /外
分別在兩臺(tái)PC機(jī)上測(cè)試到外網(wǎng)主機(jī)的通信
PC1測(cè)試如下所示:PC>ipconfig
FastEthernet0 Connection:(default port)
Link-local IPv6 Address.........: FE80::2D0:FFFF:FE45:CACC
IP Address......................: 192.168.1.1
Subnet Mask.....................: 255.255.255.0
Default Gateway.................: 192.168.1.254
PC>ping 192.168.2.1
Pinging 192.168.2.1 with 32 bytes of data:
Reply from 192.168.2.1: bytes=32 time=1ms TTL=126
Reply from 192.168.2.1: bytes=32 time=0ms TTL=126
Reply from 192.168.2.1: bytes=32 time=0ms TTL=126
Reply from 192.168.2.1: bytes=32 time=0ms TTL=126
Ping statistics for 192.168.2.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 1ms, Average = 0ms
PC2的測(cè)試如下所示：PC>ipconfig
FastEthernet0 Connection:(default port)
Link-local IPv6 Address.........: FE80::200:CFF:FEEA:DE30
IP Address......................: 192.168.1.2
Subnet Mask.....................: 255.255.255.0
Default Gateway.................: 192.168.1.254
PC>ping 192.168.2.1
Pinging 192.168.2.1 with 32 bytes of data:
Request timed out.
Reply from 192.168.2.1: bytes=32 time=0ms TTL=126
Reply from 192.168.2.1: bytes=32 time=0ms TTL=126
Reply from 192.168.2.1: bytes=32 time=0ms TTL=126
Ping statistics for 192.168.2.1:
Packets: Sent = 4, Received = 3, Lost = 1 (25% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms
在R1上查看NAT轉(zhuǎn)換表
tarena-R1#show ip nat translations
Pro Inside global Inside local Outside local Outside global
icmp 61.159.62.131:10 192.168.1.1:10 192.168.2.1:10 192.168.2.1:10
icmp 61.159.62.131:11 192.168.1.1:11 192.168.2.1:11 192.168.2.1:11
icmp 61.159.62.131:12 192.168.1.1:12 192.168.2.1:12 192.168.2.1:12
icmp 61.159.62.131:9 192.168.1.1:9 192.168.2.1:9 192.168.2.1:9
icmp 61.159.62.132:27 192.168.1.2:27 192.168.2.1:27 192.168.2.1:27
icmp 61.159.62.132:28 192.168.1.2:28 192.168.2.1:28 192.168.2.1:28
icmp 61.159.62.132:29 192.168.1.2:29 192.168.2.1:29 192.168.2.1:29
icmp 61.159.62.132:30 192.168.1.2:30 192.168.2.1:30 192.168.2.1:30
