6-華為防火墻：配置基于源IP地址的NAT

一、實驗一：配置No-Pat
1、基本配置略：
2、R1開啟Telnet功能：
[R1]user-interface vty 0 4
[R1-ui-vty0-4]authentication-mode password ?
<cr>Please press ENTER to execute command
[R1-ui-vty0-4]authentication-mode password
Please configure the login password (maximum length 16):cisco
[R1-ui-vty0-4]user privilege level 15
3、配置Trust到Untrust的Zone間策略：
[SRG]policy interzone trust untrust outbound
[SRG-policy-interzone-trust-untrust-outbound]policy create-mode auto-sort enable
[SRG-policy-interzone-trust-untrust-outbound]policy 5
[SRG-policy-interzone-trust-untrust-outbound-5]policy source 192.168.1.0 mask 24
[SRG-policy-interzone-trust-untrust-outbound-5]policy destination 202.100.1.0 mask 24
[SRG-policy-interzone-trust-untrust-outbound-5]policy service service-set telnet
[SRG-policy-interzone-trust-untrust-outbound-5]policy service service-set icmp
[SRG-policy-interzone-trust-untrust-outbound-5]action permit
4、NAT未部署前地址未轉(zhuǎn)換：
<R2>telnet 202.100.1.1
Login authentication
Password:cisco

5、配置no-pat：
[SRG]nat address-group 1 202.100.1.10 202.100.1.20 //創(chuàng)建地址組
[SRG]nat-policy interzone trust untrust outbound //創(chuàng)建Zone間NAT策略
[SRG-nat-policy-interzone-trust-untrust-outbound]policy 0
[SRG-nat-policy-interzone-trust-untrust-outbound-0]policy source 192.168.1.0 mask 24 //需要轉(zhuǎn)換的源地址段
[SRG-nat-policy-interzone-trust-untrust-outbound-0]address-group 1 no-pat //轉(zhuǎn)換后的地址組，并且不轉(zhuǎn)換到端口
[SRG-nat-policy-interzone-trust-untrust-outbound-0]action source-nat //執(zhí)行源轉(zhuǎn)換動作
測試：
<R2>telnet 202.100.1.1

查看防火墻會話轉(zhuǎn)換：
[SRG]display firewall session table verbose //源端口50573，轉(zhuǎn)換后端口依然是50573

查看防火墻Map：
[SRG]display firewall server-map

二：實驗二：配置PAT，有外部地址池的端口轉(zhuǎn)換
[SRG-nat-policy-interzone-trust-untrust-outbound-0]undo address-group
[SRG-nat-policy-interzone-trust-untrust-outbound-0]address-group 1
測試：
<R2>telnet 202.100.1.1
[SRG]display firewall session table verbose

三、實驗三：配置Easy-IP，轉(zhuǎn)換192.168.1.2到USG的g0/0/0接口地址
[SRG]nat-policy interzone trust untrust outbound
[SRG-nat-policy-interzone-trust-untrust-outbound-1]policy 0
[SRG-nat-policy-interzone-trust-untrust-outbound-0]undo address-group
[SRG-nat-policy-interzone-trust-untrust-outbound-0]easy-ip GigabitEthernet 0/0/0
測試：
[SRG]display firewall session table verbose