一个INSIDE口 多个OUTSIDE口的NAT配置

Feature History

Release  Modification 
12.2(4)T
 This feature was introduced.
 
12.2(4)T2
 Support for the Cisco 7500 series routers was added.
 

This document describes the NAT—Ability to Use Route Maps with Static Translations feature. It includes the following sections:

Feature Overview

Supported Platforms

Supported Standards, MIBs, and RFCs

Configuration Tasks

Configuration Examples

Command Reference

Feature Overview
Previous to this feature, route mapping was supported only with dynamic Network Address Translation (NAT) translation.

The NAT—Ability to Use Route Maps with Static Translations feature enables NAT multihoming capability with static address translations. Multihomed internal networks now can host common services such as the Internet and Domain Name System (DNS), which are accessed from different outside networks.

——————————————————————————–
 Note   Network static support is not included in this feature.

Benefits
The ability to configure route map statements provides the option of using IP Security (IPSec) with NAT.
Translation decisions can be made based on the destination IP address when static translation entries are used.
Related Documents
Cisco IOS IP Command Reference, Volume 1 of 3: Addressing and Services, Release 12.2
Cisco IOS IP Configuration Guide, Release 12.2
Supported Platforms
Cisco 2500 series
Cisco 2600 series
Cisco 3620 router
Cisco 3640 router
Cisco 3660 router
Cisco 7100 series
Cisco 7200 series
Cisco 7500 series
Determining Platform Support Through Feature Navigator
Cisco IOS software is packaged in feature sets that support specific platforms. To get updated information regarding platform support for this feature, access Feature Navigator. Feature Navigator dynamically updates the list of supported platforms as new platform support is added for the feature.

Feature Navigator is a web-based tool that enables you to quickly determine which Cisco IOS software images support a specific set of features and which features are supported in a specific Cisco IOS image.

To access Feature Navigator, you must have an account on Cisco.com. If you have forgotten or lost your account information, send a blank e-mail to cco-locksmith@cisco.com. An automatic check will verify that your e-mail address is registered with Cisco.com. If the check is successful, account details with a new random password will be e-mailed to you. Qualified users can establish an account on Cisco.com by following the directions at http://www.cisco.com/register.

Feature Navigator is updated when major Cisco IOS software releases and technology releases occur. As of May 2001, Feature Navigator supports M, T, E, S, and ST releases. You can access Feature Navigator at the following URL:

http://www.cisco.com/go/fn

Supported Standards, MIBs, and RFCs
Standards
No new or modified standards are supported by this feature.

MIBs
No new or modified MIBs are supported by this feature.

To obtain lists of supported MIBs by platform and Cisco IOS release, and to download MIB modules, go to the Cisco MIB website on Cisco.com at the following URL:

http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml

RFCs
No new or modified RFCs are supported by this feature.

Configuration Tasks
See the following sections for configuration tasks for the NAT—Ability to Use Route Maps with Static Translations feature. Each task in the list is identified as either required or optional:

Enabling Static NAT Route Mapping (required)
Verifying Static NAT Route Mapping (optional)
Enabling Static NAT Route Mapping
To enable route mapping with static NAT configurations, use the following command in global configuration mode:

Command  Purpose 
Router(config)# ip nat inside source {list {access-list-number | access-list-name} pool pool-name [overload] | static local-ip global-ip route-map map-name} Enables route mapping with static NAT translation configured on the NAT inside interface.
 

Verifying Static NAT Route Mapping
To verify the static NAT route mapping configuration, use the following command in privileged EXEC mode:

Command  Purpose 
Router# show ip nat translations [verbose] Displays active NAT translations.
 

Configuration Examples
This section provides the following configuration example:

Enabling Static NAT Route Mapping
Enabling Static NAT Route Mapping Example
The following example shows the use of route mapping with static NAT translations:

interface Ethernet3
 ip address 172.68.1.100 255.255.255.0
 ip nat outside
 media-type 10BaseT
!
interface Ethernet4
 ip address 192.68.1.100 255.255.255.0
 ip nat outside
 media-type 10BaseT
!
interface Ethernet5
 ip address 11.1.1.100 255.255.255.0
 ip nat inside
 media-type 10BaseT
!
router rip
 network 172.68.0.0
 network 192.68.1.0
!
 ip nat inside source static 11.1.1.2 192.68.1.21 route-map isp2
 ip nat inside source static 11.1.1.2 172.68.1.21 route-map isp1
 ip nat inside source static 11.1.1.1 192.68.1.11 route-map isp2
 ip nat inside source static 11.1.1.1 172.68.1.11 route-map isp1
 access-list 101 permit ip 11.1.1.0 0.0.0.255 172.0.0.0 0.255.255.255.
 access-list 102 permit ip 11.1.1.0 0.0.0.255 192.0.0.0 0.255.255.255
!
route-map isp2 permit 10
 match ip address 102
 set ip next-hop 192.68.1.1
!
route-map isp1 permit 10
 match ip address 101
 set ip next-hop 172.68.1.1

Command Reference
This section documents the modified ip nat inside source command. All other commands used with this feature are documented in the Cisco IOS Release 12.2 command reference publications.

ip nat inside source
To enable Network Address Translation (NAT) of the inside source address, use the ip nat inside source command in global configuration mode. To remove the static translation or remove the dynamic association to a pool, use the no form of this command.

ip nat inside source {list {access-list-number | access-list-name} pool pool-name [overload] | static local-ip global-ip route-map map-name}
no ip nat inside source {list {access-list-number | access-list-name} pool pool-name [overload] | static local-ip global-ip route-map map-name}
Syntax Description

list access-list-number
 Standard IP access list number. Packets with source addresses that pass the access list are dynamically translated using global addresses from the named pool.
 
list access-list-name
 Name of a standard IP access list. Packets with source addresses that pass the access list are dynamically translated using global addresses from the named pool.
 
pool pool-name
 Name of the pool from which global IP addresses are allocated dynamically.
 
overload
 (Optional) Enables the router to use one global address for many local addresses. When overloading is configured, the TCP or UDP port number of each inside host distinguishes between the multiple conversations using the same local IP address.
 
static local-ip
 Sets up a single static translation. The local-ip argument establishes the lo

cal IP address assigned to
a host on the inside network. The address could be randomly chosen, allocated from RFC 1918, or obsolete.
 
global-ip
 Sets up a single static translation. The global-ip argument establishes the globally unique IP address of an inside host as it appears to the outside world.
 
route-map map-name
 Name of the route map configuration on the NAT inside interface in static translations.
 

Defaults

No default behavior or values

Command Modes

Global configuration

Command History

Release  Modification 
11.2
 This command was introduced.
 
12.2(4)T
 This command was modified to include the ability to use route maps with static translations, and the route-map map-name keyword/argument was added.
 

Usage Guidelines

This command has two forms: dynamic and static address translation. The form with an access list establishes dynamic translation. Packets from addresses that match the standard access list are translated using global addresses allocated from the pool named with the ip nat pool command.

Alternatively, the syntax form with the keyword static establishes a single static translation.

Examples

The following example translates between inside hosts addressed from either the 192.168.1.0 or 192.168.2.0 network to the globally unique 171.69.233.208/28 network:

ip nat pool net-208 171.69.233.208 171.69.233.223 prefix-length 28
ip nat inside source list 1 pool net-208
!
interface ethernet 0
 ip address 171.69.232.182 255.255.255.240
 ip nat outside
!
interface ethernet 1
 ip address 192.168.1.94 255.255.255.0
 ip nat inside
!
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 1 permit 192.168.2.0 0.0.0.255
The following example shows the use of route mapping with static NAT translations:

!
interface Ethernet3
 ip address 172.68.1.100 255.255.255.0
 ip nat outside
 media-type 10BaseT
!
interface Ethernet4
 ip address 192.68.1.100 255.255.255.0
 ip nat outside
 media-type 10BaseT
!
interface Ethernet5
 ip address 11.1.1.100 255.255.255.0
 ip nat inside
 media-type 10BaseT
!
router rip
 network 172.68.0.0
 network 192.68.1.0
!
 ip nat inside source static 11.1.1.2 192.68.1.21 route-map isp2
 ip nat inside source static 11.1.1.2 172.68.1.21 route-map isp1
 ip nat inside source static 11.1.1.1 192.68.1.11 route-map isp2
 ip nat inside source static 11.1.1.1 172.68.1.11 route-map isp1
 access-list 101 permit ip 11.1.1.0 0.0.0.255 172.0.0.0 0.255.255.255.
 access-list 102 permit ip 11.1.1.0 0.0.0.255 192.0.0.0 0.255.255.255
!
route-map isp2 permit 10
 match ip address 102
 set ip next-hop 192.68.1.1
!
route-map isp1 permit 10
 match ip address 101
 set ip next-hop 172.68.1.1
Related Commands

Contents

Introduction
Prerequisites
      Requirements
      Components Used
      Conventions
Background Information
Access List Approach
      Host 1 to Host 2
      Host 1 to Host 3
Route Map Approach
      Host 1 to Host 2
      Host 1 to Host 3
Related Information

Introduction

This document explains how the use of access lists versus route maps changes the functionality of Network Address Translation (NAT). For more information on NAT, see Cisco IOS NAT.

Prerequisites

Requirements

There are no specific requirements for this document.

Components Used

The information in this document is based on these software and hardware versions:

• Cisco 2500 Series Routers.

• Cisco IOS^® Software Release 12.3(3).

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.

Conventions

For more information on document conventions, refer to the Cisco Technical Tips Conventions.

Background Information

NAT only uses access lists and route maps when it needs to create a translation entry. If a translation entry already exists that matches the traffic then the translation entry will be used; any access lists or route maps will not be consulted. The difference between using an access list or route map is the type of translation entry that will be created.

Route Maps

When NAT uses a route map to decide to create a translation entry, it will always create a "fully extended" translation entry. This translation entry will contain both the inside and outside (local and global) address entries and any TCP or UDP port information. Refer to NAT: Local and Global Definitions for more information on inside and outside (local and global) addresses.

Access Lists (no overload)

When NAT uses an access list to decide to create a translation entry, it will create a "simple" translation entry. This "simple" entry will only contain local and global IP address entries for just the inside or outside depending on whether the ip nat inside or ip nat outside command is configured. Also, it will not include any TCP or UDP port information.

Access Lists (with overload)

When NAT uses an access list, and overload has also been specified, NAT will create a "fully extended" translation entry. (Refer to Note1 ). The operation is similar to the route-map case except that route-map has some additional features. Refer to Note 2 for more details. You can see an example of a simple NAT translation entry and a fully extended NAT translation entry by selecting one of the links below:

• Simple NAT translation entry

• Fully extended NAT translation entry

Below is an example network diagram we will use to illustrate the difference between using a route map and an access list with NAT.

In the example network diagram above, it is required that hosts on 10.1.1.0 be translated to the following:

• 131.108.2.0 when going to 131.108.1.0

• 131.118.2.0 when going to 131.118.1.0

Access List Approach

With an access list approach, you would do the following to translate the hosts on 10.1.1.0:

ip nat pool pool108 131.108.2.1 131.108.2.254 prefix-length 24!--- Defines a pool of global addresses to be allocated as needed.      ip nat pool pool118 131.118.2.1 131.118.2.254 prefix-length 24     ip nat inside source list 108 pool pool108     !--- Establishes dynamic source translation, specifying the      !--- access list defined below.      ip nat inside source list 118 pool pool118     interface ethernet0       ip address 10.1.1.1 255.255.255.0       ip nat inside       !--- Marks the interface as connected to the inside.      interface ethernet1       ip address 10.1.2.1 255.255.255.0       ip nat outside       !--- Marks the interface
as connected to the outsid
e.     access-list 108 permit ip 10.1.1.0 0.0.0.255 131.108.1.0 0.0.0.255     !--- Defines the access-list mentioning those addresses      !--- that are to be translated.     access-list 118 permit ip 10.1.1.0 0.0.0.255 131.118.1.0 0.0.0.255

Refer to IP Addressing and Services Commands for more information on these commands.

Host 1 to Host 2

Here is what happens when Host 1 Telnets to Host 2.

Packet on (Network 1) s:10.1.1.2(1024)     d:131.108.1.2(23)     Packet on (Network 2) s:131.108.2.1(1024)  d:131.108.1.2(23)   (after NAT)

Because an access list was used by NAT to match this traffic a simple translation entry is created, which only includes inside translation information and no protocol or port information:

inside                         outside         local        global          global         local        10.1.1.2     131.108.2.1       ----           ----

Return packet: Host 2 to Host 1:

Packet on (Network 2)  s:131.108.1.2(23)  d:131.108.2.1(1024)     Packet on (Network 1)  s:131.108.1.2(23)  d:10.1.1.2(1024)      (after NAT)

Host 1 to Host 3

With the above simple translation in place, here is what happens when Host 1 also Telnets to Host 3:

Packet on (Network 1)  s:10.1.1.2(1025)     d:131.118.1.2(23)     Packet on (Network 2)  s:131.108.2.1(1025)  d:131.118.1.2(23)   (after NAT)

We can see that there is a problem. Packets going from 10.1.1.0 hosts to 131.118.1.0 hosts should get translated into 131.118.2.0, not 131.108.2.0. The reason that this happens is because there is already a NAT translation entry for 10.1.1.2 <–> 131.108.2.1 which also matches the traffic between Host 1 and Host 3. Therefore, this translation entry will be used and access lists 108 and 118 are not checked.

While the simple translation entry is in place in the NAT translation table, it can be used by any outside user on any outside host to send a packet to Host 1 as long as the outside user uses the inside global address (131.108.2.1) for Host 1. Normally a static NAT translation would be needed to allow this.

Route Map Approach

The correct way to configure the example in this document is to use route maps. With a route map approach, you would do the following to translate the hosts on 10.1.1.0:

ip nat pool pool-108 131.108.2.1 131.108.2.254 prefix-length 24     ip nat pool pool-118 131.118.2.1 131.118.2.254 prefix-length 24     ip nat inside source route-map MAP-108 pool pool-108     !--- Establishes dynamic source translation, specifying      !--- the route-map MAP-108 which is defined below.      ip nat inside source route-map MAP-118 pool pool-118     !--- Establishes dynamic source translation, specifying the route-map MAP-118.     !--- Here, the route-maps are consulted instead of      !--- access-lists (as in the previous case).     interface ethernet0       ip address 10.1.1.1 255.255.255.0       ip nat inside     interface ethernet1       ip address 10.1.2.1 255.255.255.0       ip nat outside     access-list 108 permit ip 10.1.1.0 0.0.0.255 131.108.1.0 0.0.0.255     access-list 118 permit ip 10.1.1.0 0.0.0.255 131.118.1.0 0.0.0.255     route-map MAP-108 permit 10     !--- Defines the Route-map MAP-108.     match ip address 108     !--- Specifies the criteria for translation. Here, the IP      !--- address mentioned in the access-list 108 is translated.     !--- The translation is defined.         in the ip nat inside source route-map MAP-108 pool pool-108 command     route-map MAP-118 permit 10     !--- Defines the Route-map MAP-108.     match ip address 118     !--- The IP address mentioned in the access-list 118 is translated.      !--- The translation is defined in the      !--- ip nat inside source route-map MAP-118 pool pool-118 command.

Refer to IP Addressing and Services Commands for more information on these commands.

Host 1 to Host 2

Here is what happens when Host 1 Telnets to Host 2:

Packet on (Network 1) s:10.1.1.2(1024)     d:131.108.1.2(23)     Packet on (Network 2) s:131.108.2.1(1024)  d:131.108.1.2(23)   (after NAT)

In this case, because a route map was used by NAT to match the traffic to be translated, NAT will create a fully extended translation entry, which includes both inside and outside translation information:

 inside                               outside         local            global             global             local     10.1.1.2:1024    131.108.2.1:1024   131.108.1.2:23     131.108.1.2:23

Return packet: Host 2 to Host 1:

Packet on (Network 2) s:131.108.1.2(23)  d:131.108.2.1(1024)     Packet on (Network 1) s:131.108.1.2(23)  d:10.1.1.2(1024)      (after NAT)

Host 1 to Host 3

Now when Host 1 sends a packet to Host 3 we get the following:

Packet on (Network 1) s:10.1.1.2(1025)     d:131.118.1.2(23)     Packet on (Network 2) s:131.118.2.1(1025)  d:131.118.1.2(23)   (after NAT)

The translation worked correctly because the packet on (N1) doesn’t match the fully extended translation entry that was used for the Host 1 to Host 2 traffic. Because the existing translation doesn’t match, NAT creates another translation entry for the Host 1 to Host 3 traffic.

Below are the fully extended translation entries on the NAT router:

inside                               outside         local            global             global             local     10.1.1.2:1024    131.108.2.1:1024   131.108.1.2:23     131.108.1.2:23     10.1.1.2:1025    131.118.2.1:1025   131.118.1.2:23     131.118.1.2:23

Because the NAT translation table has two full entries, it will correctly translate traffic going to the two different destinations from the same source.

Unlike the simple translation entry that was created via the access list, the fully extended translation entry created via the route map cannot be used by any other outside user to send a packet to Host 1. A static NAT translation would be needed to allow this.

Note 1

In the case of access-list with overload, the configuration is similar to the access-list without overload case. The exception is that you need to add the keyword overload to the command ip nat inside source list 108 pool pool108 and ip nat inside source list 118 pool pool118.

Note 2

The advantage of using route-maps is that under the match command you can have more options other than source IP address. For example, under the route-map, match interface or match ip next-hop can be specified. By using route-maps, you can specify the IP address as well as the interface or the next-hop address to which the packet is to be forwarded. Therefore, route-maps with NAT are used in a scenario where the subscriber is multi-homing to different ISPs.