163
Requirements analysis
To meet the network requirements, you must perform the following tasks:
• Configure inbound dynamic NAT with ALG to make sure the internal host reaches the Web
server instead of another internal host. NAT with ALG can translate the Web server's IP address
in the DNS reply payload to a dynamically assigned public address.
• Configure outbound dynamic NAT to translate the source IP address of packets from an internal
host to a dynamically assigned public address.
• Add a static route to the public IP address of the external Web server.
Configuration procedure
# Specify IP addresses for the interfaces on the router. (Details not shown.)
# Enable NAT with ALG and DNS.
<Router> system-view
[Router] nat alg dns
# Configure ACL 2000, and create a rule to permit packets only from subnet 192.168.1.0/24 to pass
through.
[Router] acl basic 2000
[Router-acl-ipv4-basic-2000] rule permit source 192.168.1.0 0.0.0.255
[Router-acl-ipv4-basic-2000] quit
# Create address group 1.
[Router] nat address-group 1
# Add address 202.38.1.2 to the group.
[Router-address-group-1] address 202.38.1.2 202.38.1.2
[Router-address-group-1] quit
# Create address group 2.
[Router] nat address-group 2
# Add address 202.38.1.3 to the group.
[Router-address-group-2] address 202.38.1.3 202.38.1.3
[Router-address-group-2] quit
# Enable inbound NO-PAT on interface GigabitEthernet 2/0/2 to translate the source IP address in
the DNS reply payload into the address in address group 1, and allow reversible NAT.
[Router] interface gigabitethernet 2/0/2
[Router-GigabitEthernet2/0/2] nat inbound 2000 address-group 1 no-pat reversible
# Enable outbound PAT on interface GigabitEthernet 2/0/2 to translate the source address of
outgoing packets into the address in address group 2.
[Router-GigabitEthernet2/0/2] nat outbound 2000 address-group 2
[Router-GigabitEthernet2/0/2] quit
# Configure a static route to 202.38.1.2 with GigabitEthernet 2/0/2 as the output interface and
20.2.2.2 as the next hop. (The next hop address varies by network.)
[Router] ip route-static 202.38.1.2 32 gigabitethernet 2/0/2 20.2.2.2
Verifying the configuration
# Verify that Host A can access the Web server by using its domain name. (Details not shown.)
# Display all NAT configuration and statistics.
[Router] display nat all
NAT address group information:
Totally 2 NAT address groups.
To Next Page
Loading...
Need help?
General
