这是我的网络:
我已尽最大努力尝试解决该问题,但未成功。每当数据包来自 LAN 1 或 LAN 3 时,本地 IP 地址都会被转换为每个路由器可用的 3 个公共地址之一,但来自 LAN 2 或 4 的数据包会被路由器立即丢弃,并显示“设备无法分配可用的 IP 地址进行转换。它会丢弃该数据包。”。
因此,虽然数据包确实从 LAN 1 和 3 路由出去,但它们再也不会回来。路由器无法将数据包中设置为目标的公共 IP 地址转换为发送数据包的机器的正确私有 IP。例如,从 LAN 1 到 LAN 3 的 ping(LAN 2 和 4,如我之前提到的,会立即丢弃数据包)正确地从 Router0 来回传输,但随后同一个 Router0 看到响应目标是其接口地址之一,丢弃数据包,并表示它从未发送过 ping,因此没有等待任何回显回复。我可能遗漏了一些东西,我承认我仍然无法完全理解 NAT 和 PAT 的实际工作原理(不幸的是,我的老师根本没有帮助),但我不知道从哪里开始才能让一切正常。
现在我将发布4个路由器的启动配置。
路由器0
!
version 12.2
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname Router
!
!
!
!
!
!
!
!
ip cef
no ipv6 cef
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface FastEthernet0/0
no ip address
duplex auto
speed auto
shutdown
!
interface FastEthernet1/0
ip address 192.168.1.1 255.255.255.0
ip nat inside
duplex auto
speed auto
!
interface Serial2/0
ip address 200.200.0.1 255.255.255.252
ip nat outside
clock rate 64000
!
interface Serial3/0
ip address 200.200.3.2 255.255.255.252
ip nat outside
!
interface FastEthernet4/0
ip address 200.200.4.1 255.255.255.252
ip nat outside
!
interface FastEthernet5/0
no ip address
shutdown
!
router ospf 1
log-adjacency-changes
network 200.200.0.0 0.0.0.3 area 0
network 200.200.4.0 0.0.0.3 area 0
network 200.200.3.0 0.0.0.3 area 0
!
ip nat inside source list 101 interface FastEthernet4/0 overload
ip classless
!
ip flow-export version 9
!
!
access-list 101 permit ip any any
!
!
!
!
!
line con 0
!
line aux 0
!
line vty 0 4
login
!
!
!
end
路由器1
!
version 12.2
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname Router
!
!
!
!
!
!
!
!
ip cef
no ipv6 cef
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface FastEthernet0/0
no ip address
duplex auto
speed auto
shutdown
!
interface FastEthernet1/0
ip address 192.168.1.1 255.255.255.0
ip nat inside
duplex auto
speed auto
!
interface Serial2/0
ip address 200.200.3.1 255.255.255.252
ip nat outside
clock rate 64000
!
interface Serial3/0
ip address 200.200.2.2 255.255.255.252
ip nat outside
!
interface FastEthernet4/0
ip address 200.200.5.2 255.255.255.252
ip nat outside
!
interface FastEthernet5/0
no ip address
shutdown
!
router ospf 1
log-adjacency-changes
network 200.200.3.0 0.0.0.3 area 0
network 200.200.5.0 0.0.0.3 area 0
network 200.200.2.0 0.0.0.3 area 0
!
ip nat inside source list 101 interface FastEthernet4/0 overload
ip classless
!
ip flow-export version 9
!
!
access-list 101 permit ip any any
!
!
!
!
!
line con 0
!
line aux 0
!
line vty 0 4
login
!
!
!
end
路由器2
!
version 12.2
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname Router
!
!
!
!
!
!
!
!
ip cef
no ipv6 cef
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface FastEthernet0/0
no ip address
duplex auto
speed auto
shutdown
!
interface FastEthernet1/0
ip address 192.168.1.1 255.255.255.0
ip nat inside
duplex auto
speed auto
!
interface Serial2/0
ip address 200.200.1.1 255.255.255.252
ip nat outside
clock rate 64000
!
interface Serial3/0
ip address 200.200.0.2 255.255.255.252
ip nat outside
!
interface FastEthernet4/0
no ip address
shutdown
!
interface FastEthernet5/0
ip address 200.200.5.1 255.255.255.252
ip nat outside
!
router ospf 1
log-adjacency-changes
network 200.200.1.0 0.0.0.3 area 0
network 200.200.5.0 0.0.0.3 area 0
network 200.200.0.0 0.0.0.3 area 0
!
ip nat inside source list 101 interface FastEthernet4/0 overload
ip classless
!
ip flow-export version 9
!
!
access-list 101 permit ip any any
!
!
!
!
!
line con 0
!
line aux 0
!
line vty 0 4
login
!
!
!
end
路由器 3
!
version 12.2
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname Router
!
!
!
!
!
!
!
!
ip cef
no ipv6 cef
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface FastEthernet0/0
no ip address
duplex auto
speed auto
shutdown
!
interface FastEthernet1/0
ip address 192.168.1.1 255.255.255.0
ip nat inside
duplex auto
speed auto
!
interface Serial2/0
ip address 200.200.2.1 255.255.255.252
ip nat outside
clock rate 64000
!
interface Serial3/0
ip address 200.200.1.2 255.255.255.252
ip nat outside
!
interface FastEthernet4/0
no ip address
shutdown
!
interface FastEthernet5/0
ip address 200.200.4.2 255.255.255.252
ip nat outside
!
router ospf 1
log-adjacency-changes
network 200.200.2.0 0.0.0.3 area 0
network 200.200.4.0 0.0.0.3 area 0
network 200.200.1.0 0.0.0.3 area 0
!
ip nat inside source list 101 interface FastEthernet4/0 overload
ip classless
!
ip flow-export version 9
!
!
access-list 101 permit ip any any
!
!
!
!
!
line con 0
!
line aux 0
!
line vty 0 4
login
!
!
!
end
提前致谢。
答案1
你的纳特命令路由器2和路由器 3错了 :
ip nat inside source list 101 interface FastEthernet4/0 overload
您已将此命令发送给两个路由器。但实际的 WAN 接口快速以太网5/0。 你的纳特两个路由器中的命令应为:
ip nat inside source list 101 interface FastEthernet5/0 overload
第二,
尽管您已经为所有 wan 接口(串行)配置了 ip nat outside,但是每个路由器的 NATing 命令中仅指定了一个接口。
因此,当发生重新路由(数据包通过另一个外部如果网络接口不支持NAT,则数据包的源地址将不会被NAT。
为了解决这个问题,你需要一个 NAT 命令每wan 接口。因此,您首先需要创建单独的 ACL(针对同一源 LAN),并将一个 acl 应用于每个 NAT 命令。
例如:
在路由器 3 上
!
interface FastEthernet1/0
ip address 192.168.1.1 255.255.255.0
ip nat inside
!
interface Serial2/0
ip address 200.200.2.1 255.255.255.252
ip nat outside
!
interface Serial3/0
ip address 200.200.1.2 255.255.255.252
ip nat outside
!
!
interface FastEthernet5/0
ip address 200.200.4.2 255.255.255.252
ip nat outside
!
ip nat inside source list 101 interface FastEthernet5/0 overload
ip nat inside source list 102 interface Serial2/0 overload
ip nat inside source list 103 interface Serial3/0 overload
!
access-list 101 permit ip any any
access-list 102 permit ip any any
access-list 103 permit ip any any