H3C MSR 2600 Series, Руководство по настройке, Страница: 144 / 288

129
Outbound dynamic NAT for internal-to-external access
(non-overlapping addresses)
Network requirements
As shown in Figure 53 , a company has a segment address 192.168.0.0/16 and two public IP addresses
202.38.1.2 and 202.38.1.3. Configure outbound dynamic NAT to allow only internal users on segment
192.168.1.0/24 to access the Internet.
Figure 53 Network diagram
Configuration procedure
# Specify IP addresses for the interfaces. (Details not shown.)
# Configure address group 0, and add an address member from 202.38.1.2 to 202.38.1.3.
<Router> system-view
[Router] nat address-group 0
[Router-nat-address-group-0] address 202.38.1.2 202.38.1.3
[Router-nat-address-group-0] quit
# Configure ACL 2000, and create a rule to permit packets only from segment 192.168.1.0/24 to pass
through.
[Router] acl number 2000
[Router-acl-basic-2000] rule permit source 192.168.1.0 0.0.0.255
[Router-acl-basic-2000] quit
# Enable outbound dynamic PAT on interface GigabitEthernet 1/2. The source IP addresses of the
packets permitted by the ACL rule is translated into the addresses in address group 0.
[Router] interface gigabitethernet 1/2
[Router-GigabitEthernet1/2] nat outbound 2000 address-group 0
[Router-GigabitEthernet1/2] quit
Verifying the configuration
After completing the configurations, Host A can access the WWW server, while Host B cannot.
# Display all NAT configuration and statistics.
[Router] display nat all
NAT address group information:
There are 1 NAT address groups.
Group Number Start Address End Address