当前位置：网站首页>ACL and NAT

ACL and NAT

2022-07-21 12:19:00 【Au poplar】

Catalog

ACL（ Access control list ）

ACL Overview and background

ACL application

ACL Application principles

ACL Matching rules

NAT（ Translation of Internet address ）

NAT Working mechanism

static state NAT

NATPT（ Port mapping ）

ACL（ Access control list ）

ACL Overview and background

ACL: access list Access control list

White list ： Reject all by default , Let's play one. Can communicate with one My own internal business

The blacklist ： Open all by default , Add a , Cannot communicate with one .

ACL application

ACL Two applications :

1. Applied to interface ACL----- Filter packets （ Protozoa ip Address , Protozoa mac, port Quintuples ）

2. Used in routing protocols ------- Match the corresponding route entry

3. NAT、IPSEC VPN、QOS----- Match the data stream of interest （ Match what I set Streaming ）

ACL species

ACL Application principles

basic ACL: Try to use it close to the destination

senior ACL: Try to use it close to the source ( Can protect bandwidth and other resources )

ACL Matching rules

1、 The same direction of an interface , Only one... Can be called acl

2、 One acl There can be more than one rule The rules , According to the rules ID Sort from small to large , From top to bottom

3、 Once a packet is sent by some rule matching , No more downward matching

4、 When used for packet access control , By default, all ( Huawei equipment )

NAT（ Translation of Internet address ）

A packet purpose ip Or source ip Private network address , Operators' devices cannot forward data .

NAT Working mechanism

When a packet goes from the intranet to the public network , The router sends the source in the packet ip（ Private address ）, Translate into public network address

static state NAT

The project manually associates a private address with a public address , One-to-one correspondence , The disadvantages are the same as static routing

NATPT（ Port mapping ）

NAT Server---- The intranet server provides external services , For purpose ip And destination port mapping , The corresponding port of the intranet server is mapped to the router public network ip Corresponding port of address

Easy-IP

1. Use the list to match the private network ip Address

2. Map all private addresses to the public address of the current interface of the router

experiment

nat

Enterprises export
[R1]int g0/0/0 // Access interface g0/0/0
[R1-GigabitEthernet0/0/0]undo shut undo shut// Turn on the physical interface
[R1-GigabitEthernet0/0/0]ip add 192.168.1.1 24 // To configure IP Address and subnet mask length
[R1-GigabitEthernet0/0/0]int g0/0/1 // Access interface g0/0/1
[R1-GigabitEthernet0/0/1]undo shut // Turn on the physical interface
[R1-GigabitEthernet0/0/1]ip add 202.10.10.1 24 // To configure IP Address and subnet mask length
[R1]nat address-group 1 15.0.0.10 15.0.0.11 // To configure NAT Internet address pool
[R1]acl 2000 // Create a standard access control list 2000
[R1-acl-basic-2000]rule permit source 192.168.1.0 0.0.0.255 // To configure ACL Grab the intranet address segment
[R1-acl-basic-2000]int g0/0/1 // Access interface g0/0/1
[R1-GigabitEthernet0/0/1]nat outbound 2000 address-group 1 // Call... At the Internet port acl2000
[R1]ip route-static 0.0.0.0 32 202.10.10.2 // Configure the default route , Next jump into the interface 202.10.10.2
[R1-GigabitEthernet0/0/1]display nat outbound // Check for success

ACL

R1

[Huawei]sys R1

[R1]int g0/0/1

[R1-GigabitEthernet0/0/1]ip add 192.168.2.254 24

[R1-GigabitEthernet0/0/1]int g0/0/2

[R1-GigabitEthernet0/0/2]ip add 192.168.3.254 24

[R1-GigabitEthernet0/0/2]int g0/0/0

[R1-GigabitEthernet0/0/0]ip add 192.168.1.254 24

[R1-GigabitEthernet0/0/0]int g0/0/1

[R1-GigabitEthernet0/0/1]q

[R1]acl 2000

[R1-acl-basic-2000]rule deny source 192.168.1.1 0

acl number 2000

[R1-acl-basic-2000]int g0/0/1

[R1-GigabitEthernet0/0/1]traf

[R1-GigabitEthernet0/0/1]traffic-filter outbound 2000

[R1-GigabitEthernet0/0/1]traffic-filter outbound acl 2000

[R1-GigabitEthernet0/0/1]undo traffic-filter outbound

[R1-GigabitEthernet0/0/1]dis th

[V200R003C00]

interface GigabitEthernet0/0/1

ip address 192.168.2.254 255.255.255.0

return

[R1-GigabitEthernet0/0/1]q

[R1]acl 3000

[R1-acl-adv-3000]rule deny tcp 192.168.1.1 0 des

[R1-acl-adv-3000]rule deny tcp source

[R1-acl-adv-3000]rule deny tcp source 192.168.1.1 0 destination 192.168.2.1 0 de

stination-port eq www

[R1-acl-adv-3000]int g0/0/0

[R1-GigabitEthernet0/0/0]traffic-filter inbound acl 3000

result

版权声明
本文为[Au poplar]所创，转载请带上原文链接，感谢
https://yzsam.com/2022/202/202207201707573942.html

边栏推荐

猜你喜欢

随机推荐