ASA8.3NAT配置介绍

ASA IOS8.3 NAT配置 ASA5550防火墙

Network Object NAT配置介绍

1.Dynamic NAT（动态NAT，动态一对一）

实例一:

传统配置方法：

nat (Inside) 1 10.1.1.0 255.255.255.0

global (Outside) 1 202.100.1.100-202.100.1.200

新配置方法（Network Object NAT）

object network Outside-Nat-Pool

range 202.100.1.100 202.100.1.200

object network Inside-Network

subnet 10.1.1.0 255.255.255.0

object network Inside-Network

nat (Inside,Outside) dynamic Outside-Nat-Pool

实例二:

object network Outside-Nat-Pool

range 202.100.1.100 202.100.1.200

object network Outside-PAT-Address

host 202.100.1.201

object-group network Outside-Address

network-object object Outside-Nat-Pool

network-object object Outside-PAT-Address

object network Inside-Network

（先100-200动态一对一，然后202.100.1.201动态PAT,最后使用接口地址动态PAT） nat (Inside,Outside) dynamic Outside-Address interface

教主认为这种配置方式的好处是，新的NAT命令绑定了源接口和目的接口，所以不会出现传统配置影响DMZ的问题（当时需要nat0 + acl来旁路）

2.Dynamic PAT (Hide)（动态PAT，动态多对一）

传统配置方式：

ASA IOS8.3 NAT配置 ASA5550防火墙

nat (Inside) 1 10.1.1.0 255.255.255.0

global(outside) 1 202.100.1.101

新配置方法（Network Object NAT）

object network Inside-Network

subnet 10.1.1.0 255.255.255.0

object network Outside-PAT-Address

host 202.100.1.101

object network Inside-Network

nat (Inside,Outside) dynamic Outside-PAT-Address

or

nat (Inside,Outside) dynamic 202.100.1.102

3.Static NAT or Static NAT with Port Translation（静态一对一转换，静态端口转换）

实例一：（静态一对一转换）

传统配置方式：

static (Inside,outside) 202.100.1.101 10.1.1.1

新配置方法（Network Object NAT）

object network Static-Outside-Address

host 202.100.1.101

object network Static-Inside-Address

host 10.1.1.1

object network Static-Inside-Address

nat (Inside,Outside) static Static-Outside-Address

or

nat (Inside,Outside) static 202.100.1.102 <dns>

实例二：（静态端口转换）

传统配置方式：

static (inside,outside) tcp 202.100.1.102 2323 10.1.1.1 23

ASA IOS8.3 NAT配置 ASA5550防火墙

新配置方法（Network Object NAT）

object network Static-Outside-Address

host 202.100.1.101

object network Static-Inside-Address

host 10.1.1.1

object network Static-Inside-Address

nat (Inside,Outside) static Static-Outside-Address service tcp telnet 2323

or

nat (Inside,Outside) static 202.100.1.101 service tcp telnet 2323

4.Identity NAT

传统配置方式：

nat (inside) 0 10.1.1.1 255.255.255.255

新配置方法（Network Object NAT）

object network Inside-Address

host 10.1.1.1

object network Inside-Address

nat (Inside,Outside) static Inside-Address

or

nat (Inside,Outside) static 10.1.1.1

Twice NAT（类似于Policy NAT）

实例一：

传统配置:

access-list inside-to-1 permit ip 10.1.1.0 255.255.255.0 host 1.1.1.1

access-list inside-to-202 permit ip 10.1.1.0 255.255.255.0 host 202.100.1.1

nat (inside) 1 access-list inside-to-1

nat (inside) 2 access-list inside-to-202

global(outside) 1 202.100.1.101

global(outside) 2 202.100.1.102

新配置方法（Twice NAT）:

ASA IOS8.3 NAT配置 ASA5550防火墙

host 1.1.1.1

object network dst-202

host 202.100.1.1

object network pat-1

host 202.100.1.101

object network pat-2

host 202.100.1.102

object network Inside-Network

subnet 10.1.1.0 255.255.255.0

nat (Inside,Outside) source dynamic Inside-Network pat-1 destination static dst-1 dst-1 nat (Inside,Outside) source dynamic Inside-Network pat-2 destination static dst-202 dst-202

实例二：

传统配置:

access-list inside-to-1 permit ip 10.1.1.0 255.255.255.0 host 1.1.1.1

access-list inside-to-202 permit ip 10.1.1.0 255.255.255.0 host 202.100.1.1

nat (inside) 1 access-list inside-to-1

nat (inside) 2 access-list inside-to-202

global(outside) 1 202.100.1.101

global(outside) 2 202.100.1.102

static (outside,inside) 10.1.1.101 1.1.1.1

static (outside,inside) 10.1.1.102 202.100.1.1

新配置方法（Twice NAT）:

object network dst-1

host 1.1.1.1

object network dst-202

host 202.100.1.1

ASA IOS8.3 NAT配置 ASA5550防火墙

host 202.100.1.101

object network pat-2

host 202.100.1.102

object network Inside-Network

subnet 10.1.1.0 255.255.255.0

object network map-dst-1

host 10.1.1.101

object network map-dst-202

host 10.1.1.102

nat (Inside,Outside) source dynamic Inside-Network pat-1 destination static map-dst-1 dst-1 nat (Inside,Outside) source dynamic Inside-Network pat-2 destination static map-dst-202 dst-202

实例三：

传统配置:

access-list inside-to-1 permit tcp 10.1.1.0 255.255.255.0 host 1.1.1.1 eq 23

access-list inside-to-202 permit tcp 10.1.1.0 255.255.255.0 host 202.100.1.1 eq 3032

nat (inside) 1 access-list inside-to-1

nat (inside) 2 access-list inside-to-202

global(outside) 1 202.100.1.101

global(outside) 1 202.100.1.102

新配置方法（Twice NAT）:

object network dst-1

host 1.1.1.1

object network dst-202

host 202.100.1.1

object network pat-1

host 202.100.1.101

object network pat-2

host 202.100.1.102

object network Inside-Network

subnet 10.1.1.0 255.255.255.0

object service telnet23

ASA IOS8.3 NAT配置 ASA5550防火墙

service …… 此处隐藏：6826字，全部文档内容请下载后查看。喜欢就下载吧 ……