Juniper JUNOSE 11.2.X IP SERVICES, Руководство по настройке

Страница: 105 / 356

3.
Mark the outside interface.
host1:blue(config)# interface gigabitEthernet 3/0.1
host1:blue(config-interface)# ip nat outside
host1:blue(config-interface)# exit
4.
Create the translation for the DNS.
host1:blue(config)# ip nat inside source static 192.168.22.2 192.32.6.1
5.
Create the address pool for dynamic translations.
host1:blue(config)# ip nat pool entA192 192.32.6.2 192.32.6.63 prefix-length 24
6.
Create the access list for addresses eligible for dynamic translation (that is, private
addresses).
host1:blue(config)# access-list entA permit 192.168.22.0 0.0.0.255
7.
Create the dynamic translation rule.
host1:blue(config)# ip nat inside source list entA pool entA192
8.
Configure a default route to the outside interface.
host1:blue(config)# ip route 0.0.0.0 0.0.0.0 gigabitEthernet 3/0.1
9.
Configure a null route for the inside global addresses, to prevent routing loops when
no matching translation exists.
host1:blue(config)# ip route 192.32.6.0 255.255.255.192 null 0
NOTE: Null route applies to 192.32.6.0 and 192.32.6.1, which do not exist in the address
pool.
Twice NAT Example
Twice NAT is often useful when the inside network is using a nonprivate address space
(unregistered usage of global address space) and you want it to connect to the public
network. Inside local addresses need to be translated to legal global addresses. Legal
addresses from the outside that overlap those used on the inside network need to be
translated to unused and recognizable addresses in the inside network. Both inside source
and outside source translations must be configured on the NAT router.
Figure 8 on page 80 illustrates how the inside network is using the unregistered global
address space of 15.12.0.0/16. Outside hosts whose addresses overlap with this
subnetwork that want to access the inside network need their global addresses translated.
79 Copyright © 2010, Juniper Networks, Inc.
Chapter 2: Configuring NAT