华为防火墙NAT控制详细介绍

标签：ip地址   目标地址   公网   方式   address   就是   源地址   name   eth   

（2）NAPT的配置
还是上面的图，重做NAPT
配置IP


配置安全策略

配置NAT地址组，地址组中对应的是公网IP

配置NAT策略

配置路由黑洞

验证结果用PC1ping外网PC2


（3）出接口地址（Easy-IP）就是用R1路由器的g0/0/1的接口去访问PC2（重新配置）
配置IP


配置安全策略

配置NAT策略

验证可以发现，都是转换的R1路由器g0/0/1接口IP去访问的

五，综合案例
要求：

1. 财务主机通过no-pat访问internet（使用100.2.2.10-11）
2. 学术部主机通过napt访问internet（使用100.2.2.12）
3. 公司其它部门通过g1/0/0访问internet
4. 配置natserver发布dmz中的服务器（使用100.2.2.9）
   
   一、财务主机通过no-pat访问internet
   1.配置网络参数及路由
   [USG6000V1] int g1/0/2
   [USG6000V1-GigabitEthernet1/0/2] ip add 192.168.1.1 24
   [USG6000V1-GigabitEthernet1/0/2] undo sh
   Info: Interface GigabitEthernet1/0/2 is not shutdown.
   [USG6000V1-GigabitEthernet1/0/2] quit
   [USG6000V1] int g1/0/0
   [USG6000V1-GigabitEthernet1/0/0] ip add 100.1.1.2 30
   [USG6000V1-GigabitEthernet1/0/0] undo sh
   [USG6000V1-GigabitEthernet1/0/0] quit
   [USG6000V1] i proute-static 0.0.0.0 0.0.0.0 100.1.1.1
   2.配置安全策略
   [USG6000V1] firewall zone trust
   [USG6000V1-zone-trust] add int g1/0/2
   [USG6000V1-zone-trust] quit
   [USG6000V1] firewall zone untrust
   [USG6000V1-zone-untrust] add int g1/0/0
   [USG6000V1-zone-untrust] quit
   [USG6000V1] security-policy
   [USG6000V1-policy-security] rule name sec_1
   [USG6000V1-policy-security-rule-sec_1] source-address 192.168.1.0 24
   [USG6000V1-policy-security-rule-sec_1] destination-zone untrust
   [USG6000V1-policy-security-rule-sec_1] action permit
   3.配置nat地址组，地址池中的地址对应的是公网地址
   [USG6000V1-policy-security] quit
   [USG6000V1] nat address-group natgroup
   [USG6000V1-address-group-natgroup] section 0 100.2.2.10 100.2.2.11
   [USG6000V1-address-group-natgroup] mode no-pat local
   [USG6000V1-address-group-natgroup]
   4.配置nat策略
   [USG6000V1] nat-policy
   [USG6000V1-policy-nat] rule name natpolicy
   [USG6000V1-policy-nat-rule-natpolicy] source-address 192.168.1.0 24
   [USG6000V1-policy-nat-rule-natpolicy] destination-zone untrust
   [USG6000V1-policy-nat-rule-natpolicy] action nat address-group natgroup
   [USG6000V1-policy-nat-rule-natpolicy] quit
   [USG6000V1-policy-nat] quit
   5.针对转换后的全局地址配置黑洞路由
   [USG6000V1] ip route-static 100.2.2.10 32 null 0
   [USG6000V1] ip route-static 100.2.2.11 32 null 0
   6.配置r1（isp）
   <Huawei>sys
   Enter system view, return user view with Ctrl+Z.
   [Huawei] sysname r1
   [r1] undo info ena
   [r1] int g0/0/0
   [r1-GigabitEthernet0/0/0] ip add 100.1.1.1 30
   [r1-GigabitEthernet0/0/0] int g0/0/1
   [r1-GigabitEthernet0/0/1] ip add 200.1.1.1 24
   [r1-GigabitEthernet0/0/1] undo sh
   [r1-GigabitEthernet0/0/1] quit
   [r1] ip route-static 100.2.2.8 29 100.1.1.2
   7.测试：从财务客户机上访问internet服务器
   
   二、学术部主机通过napt访问internet（使用100.2.2.12）
   1.配置网络参数
   [USG6000V1] int g1/0/3
   [USG6000V1-GigabitEthernet1/0/3] ip add 192.168.2.1 24
   [USG6000V1-GigabitEthernet1/0/3] quit
   [USG6000V1] firewall zone trust
   [USG6000V1-zone-trust] add int g1/0/3
   [USG6000V1-zone-trust]q uit
   2.配置安全策略
   [USG6000V1] security-policy
   [USG6000V1-policy-security-rule-sec_2] source-address 192.168.2.0 24
   [USG6000V1-policy-security-rule-sec_2] destination-zone untrust
   [USG6000V1-policy-security-rule-sec_2] action permit
   [USG6000V1-policy-security-rule-sec_2] quit
   3.配置nat地址组
   [USG6000V1] nat address-group natgroup_2.0
   [USG6000V1-address-group-natgroup_2.0] section 0 100.2.2.12 100.2.2.12
   [USG6000V1-address-group-natgroup_2.0] mode pat
   [USG6000V1-address-group-natgroup_2.0] quit
   4.配置nat策略
   [USG6000V1] nat-policy
   [USG6000V1-policy-nat] rule name natpolicy_2.0
   [USG6000V1-policy-nat-rule-natpolicy_2.0] source-address 192.168.2.0 24
   [USG6000V1-policy-nat-rule-natpolicy_2.0] destination-zone untrust
   [USG6000V1-policy-nat-rule-natpolicy_2.0] action nat address-group natgroup_2.0
   [USG6000V1-policy-nat-rule-natpolicy_2.0] quit
   [USG6000V1-policy-nat] quit
   5.针对转换后的全局地址，配置黑洞路由
   [USG6000V1] ip route-static 100.2.2.12 32 null 0
   6.验证nat配置
   .
   三、出接口地址（easy-ip）使公司其它部门通过g1/0/0访问internet
   
   1.配置网络参数
   [USG6000V1] int g1/0/4
   [USG6000V1-GigabitEthernet1/0/4] ip add 192.168.3.1 24
   [USG6000V1-GigabitEthernet1/0/4] quit
   [USG6000V1] firewall zone trust
   [USG6000V1-zone-trust] add int g1/0/4
   [USG6000V1-zone-trust]
   2.配置安全策略
   [USG6000V1] security-policy
   [USG6000V1-policy-security] rule name sec_3
   [USG6000V1-policy-security-rule-sec_3] source-address 192.168.3.0 24
   [USG6000V1-policy-security-rule-sec_3] destination-zone untrust
   [USG6000V1-policy-security-rule-sec_3] action permit
   [USG6000V1-policy-security-rule-sec_3] quit
   [USG6000V1-policy-security] quit
   3.配置nat策略
   [USG6000V1] nat-policy
   [USG6000V1-policy-nat] rule name natpolicy_3.0
   [USG6000V1-policy-nat-rule-natpolicy_3.0] source-address 192.168.3.0 24
   [USG6000V1-policy-nat-rule-natpolicy_3.0] destination-zone untrust
   [USG6000V1-policy-nat-rule-natpolicy_3.0] action nat easy-ip
   [USG6000V1-policy-nat-rule-natpolicy_3.0] quit
   [USG6000V1-policy-nat] quit
   4.验证easy-ip
   1）ping测试
   
   四、配置natserver发布dmz中的服务器（使用100.2.2.9）
   1.配置网络参数
   [USG6000V1-GigabitEthernet1/0/0] int g1/0/1
   [USG6000V1-GigabitEthernet1/0/1] ip add 192.168.0.1 24
   [USG6000V1-GigabitEthernet1/0/1] quit
   [USG6000V1] firewall zone dmz
   [USG6000V1-zone-dmz] add int g1/0/1
   [USG6000V1-zone-dmz] quit
   2.配置安全策略
   [USG6000V1] security-policy
   [USG6000V1-policy-security] rule name sec_4
   [USG6000V1-policy-security-rule-sec_4] source-zone untrust
   [USG6000V1-policy-security-rule-sec_4] destination-address 192.168.0.0 24
   [USG6000V1-policy-security-rule-sec_4] action permit
   [USG6000V1-policy-security] quit
   3.配置ftp应用层检测（此步骤可以省略，默认已经开启）
   [USG6000V1] firewall inter trust untrust
   [USG6000V1-interzone-trust-untrust] detect ftp
   [USG6000V1-interzone-trust-untrust] quit
   4.配置nat server
   [USG6000V1] nat server natserver global 100.2.2.9 inside 192.168.0.2
   5.配置黑洞路由
   [USG6000V1] ip route-static 100.2.2.9 32 null 0
   6.验证
   1）在互联网主机上访问dmz中的服务器
   

华为防火墙NAT控制详细介绍

标签：ip地址   目标地址   公网   方式   address   就是   源地址   name   eth   

原文地址：https://blog.51cto.com/14400213/2446085