思科outside口特性

1、

2、匹配規則：

inside:先路由，後NAT

outside:先NAT，後路由

3、四種NAT：

ip nat inside source static 192.168.1.2 202.67.54.3

從inside進入，從outside出去的源IP地址爲192.168.1.2轉換爲202.67.54.3

ip nat inside destination static 192.168.1.2 202.67.54.3

從inside進入，outside出去的目的IP爲192.168.1.2轉換爲202.67.54.3

ip nat outside source static 192.168.1.2 202.67.54.3

從outside進入，inside出去的源IP爲192.168.1.2轉換爲202.67.54.3

ip nat outside destination static 192.168.1.2 202.67.54.3

從outside進入，inside出去的目的IP爲192.168.1.2轉換爲202.67.54.3

第一條等價於第四條，第二條等價於第三條

4、實驗現象

ip nat inside 必定是出outside纔會發生轉換

ip nat outside 必定是出inside纔會發生轉換

http://www.2cto.com/net/201309/244766.html

5、實操

前提條件:保證內網路由可達。

另外在實際操做中，外網是不須要知道內網路由的。下面這是爲了演示outside口的特性纔在兩邊加了默認路由

各設備配置：

R0:

Router#show running-config
Building configuration...

Current configuration : 757 bytes
!
version 12.2
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname Router
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface FastEthernet0/0
 ip address 1.1.1.1 255.255.255.0
 ip nat outside
 duplex auto
 speed auto
!
interface FastEthernet0/1
 no ip address
 duplex auto
 speed auto
 shutdown
!
interface Serial1/0
 ip address 8.8.8.7 255.255.255.0
 ip nat inside
 clock rate 64000
!
interface Serial1/1
 no ip address
 shutdown
!
interface Serial1/2
 no ip address
 shutdown
!
interface Serial1/3
 no ip address
 shutdown
!
ip nat outside source static 1.1.1.2 2.2.2.4
ip classless
ip route 0.0.0.0 0.0.0.0 8.8.8.8
!
!
!
!
!
!
!
line con 0
!
line aux 0
!
line vty 0 4
 login
!
!
!
end

R1:

Router#show running-config
Building configuration...

Current configuration : 662 bytes
!
version 12.2
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname Router
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface FastEthernet0/0
 ip address 2.2.2.2 255.255.255.0
 duplex auto
 speed auto
!
interface FastEthernet0/1
 no ip address
 duplex auto
 speed auto
 shutdown
!
interface Serial1/0
 ip address 8.8.8.8 255.255.255.0
!
interface Serial1/1
 no ip address
 shutdown
!
interface Serial1/2
 no ip address
 shutdown
!
interface Serial1/3
 no ip address
 shutdown
!
ip classless
ip route 0.0.0.0 0.0.0.0 8.8.8.7
!
!
!
!
!
!
!
line con 0
!
line aux 0
!
line vty 0 4
 login
!
!
!
end

PC1:

參考：http://www.2cto.com/net/201309/244766.html

 但仍是不明白回包流程爲何會失敗，也許他解釋的太抽象，有理解的，請舉個小例子給我解釋下回包爲何會失敗，不勝感激

總結：outside口禁ping 和禁telnet，由於包發出去了，可是回包不了。