封包不會回到使用 Cisco Packet Tracer 中的 NAT 的網路中

封包不會回到使用 Cisco Packet Tracer 中的 NAT 的網路中

這是我的網路:

http://i.imgur.com/ObkYYnM.png

我已盡力嘗試解決該問題,但沒有成功。每當封包來自LAN 1 或LAN 3 時,本地IP 位址都會轉換為每個路由器可用的3 個公共位址之一,但來自LAN 2 或4 的封包會立即被路由器丟棄,並顯示「裝置無法分配可用的位址」。用於轉換的 IP 位址。它會丟棄資料包。”

因此,雖然封包確實從 LAN 1 和 3 路由出去,但它們永遠不會返回。路由器無法將封包中設定為目標的公用 IP 位址轉換為傳送封包的電腦的正確私人 IP。例如,從LAN 1 到LAN 3(LAN 2 和4,正如我之前提到的,立即丟棄資料包)的ping 正確地從Router0 來回傳輸,但隨後是同一個Router0,看到回應目的地是以下之一它的介面位址,丟棄封包,表示它從未發送過 ping,因此不等待任何回顯答案。我可能遺漏了一些東西,我承認我仍然無法完全理解 NAT 和 PAT 實際上是如何工作的(不幸的是,我的老師根本沒有幫助),但我不知道從哪裡開始讓一切正常工作。

我現在將發布 4 個路由器的啟動設定。

路由器0

!  
version 12.2  
no service timestamps log datetime msec  
no service timestamps debug datetime msec  
no service password-encryption  
!  
hostname Router   
!    
!    
!    
!    
!    
!    
!    
!    
ip cef  
no ipv6 cef  
!  
!  
!  
!  
!  
!  
!  
!  
!  
!  
!  
!  
!  
!  
!  
!  
!  
!  
interface FastEthernet0/0  
 no ip address  
 duplex auto  
 speed auto  
 shutdown  
!  
interface FastEthernet1/0  
 ip address 192.168.1.1 255.255.255.0  
 ip nat inside  
 duplex auto  
 speed auto  
!  
interface Serial2/0  
 ip address 200.200.0.1 255.255.255.252  
 ip nat outside  
 clock rate 64000  
!  
interface Serial3/0  
 ip address 200.200.3.2 255.255.255.252  
 ip nat outside  
!  
interface FastEthernet4/0  
 ip address 200.200.4.1 255.255.255.252  
 ip nat outside  
!  
interface FastEthernet5/0  
 no ip address  
 shutdown  
!  
router ospf 1  
 log-adjacency-changes  
 network 200.200.0.0 0.0.0.3 area 0  
 network 200.200.4.0 0.0.0.3 area 0  
 network 200.200.3.0 0.0.0.3 area 0  
!  
ip nat inside source list 101 interface FastEthernet4/0 overload  
ip classless  
!  
ip flow-export version 9  
!  
!  
access-list 101 permit ip any any  
!  
!  
!  
!  
!  
line con 0  
!  
line aux 0  
!  
line vty 0 4  
 login  
!  
!  
!  
end  

路由器1

!
version 12.2
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname Router
!
!
!
!
!
!
!
!
ip cef
no ipv6 cef
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface FastEthernet0/0
 no ip address
 duplex auto
 speed auto
 shutdown
!
interface FastEthernet1/0
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
 duplex auto
 speed auto
!
interface Serial2/0
 ip address 200.200.3.1 255.255.255.252
 ip nat outside
 clock rate 64000
!
interface Serial3/0
 ip address 200.200.2.2 255.255.255.252
 ip nat outside
!
interface FastEthernet4/0
 ip address 200.200.5.2 255.255.255.252
 ip nat outside
!
interface FastEthernet5/0
 no ip address
 shutdown
!
router ospf 1
 log-adjacency-changes
 network 200.200.3.0 0.0.0.3 area 0
 network 200.200.5.0 0.0.0.3 area 0
 network 200.200.2.0 0.0.0.3 area 0
!
ip nat inside source list 101 interface FastEthernet4/0 overload
ip classless
!
ip flow-export version 9
!
!
access-list 101 permit ip any any
!
!
!
!
!
line con 0
!
line aux 0
!
line vty 0 4
 login
!
!
!
end

路由器2

!
version 12.2
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname Router
!
!
!
!
!
!
!
!
ip cef
no ipv6 cef
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface FastEthernet0/0
 no ip address
 duplex auto
 speed auto
 shutdown
!
interface FastEthernet1/0
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
 duplex auto
 speed auto
!
interface Serial2/0
 ip address 200.200.1.1 255.255.255.252
 ip nat outside
 clock rate 64000
!
interface Serial3/0
 ip address 200.200.0.2 255.255.255.252
 ip nat outside
!
interface FastEthernet4/0
 no ip address
 shutdown
!
interface FastEthernet5/0
 ip address 200.200.5.1 255.255.255.252
 ip nat outside
!
router ospf 1
 log-adjacency-changes
 network 200.200.1.0 0.0.0.3 area 0
 network 200.200.5.0 0.0.0.3 area 0
 network 200.200.0.0 0.0.0.3 area 0
!
ip nat inside source list 101 interface FastEthernet4/0 overload
ip classless
!
ip flow-export version 9
!
!
access-list 101 permit ip any any
!
!
!
!
!
line con 0
!
line aux 0
!
line vty 0 4
 login
!
!
!
end

路由器3

!
version 12.2
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname Router
!
!
!
!
!
!
!
!
ip cef
no ipv6 cef
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface FastEthernet0/0
 no ip address
 duplex auto
 speed auto
 shutdown
!
interface FastEthernet1/0
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
 duplex auto
 speed auto
!
interface Serial2/0
 ip address 200.200.2.1 255.255.255.252
 ip nat outside
 clock rate 64000
!
interface Serial3/0
 ip address 200.200.1.2 255.255.255.252
 ip nat outside
!
interface FastEthernet4/0
 no ip address
 shutdown
!
interface FastEthernet5/0
 ip address 200.200.4.2 255.255.255.252
 ip nat outside
!
router ospf 1
 log-adjacency-changes
 network 200.200.2.0 0.0.0.3 area 0
 network 200.200.4.0 0.0.0.3 area 0
 network 200.200.1.0 0.0.0.3 area 0
!
ip nat inside source list 101 interface FastEthernet4/0 overload
ip classless
!
ip flow-export version 9
!
!
access-list 101 permit ip any any
!
!
!
!
!
line con 0
!
line aux 0
!
line vty 0 4
 login
!
!
!
end

提前致謝。

答案1

你的納特命令在路由器2路由器3錯了 :

ip nat inside source list 101 interface FastEthernet4/0 overload

您已向兩台路由器發出此命令。但實際的WAN介面是快速乙太網路5/0。你的納特兩個路由器中的命令應該是:

ip nat inside source list 101 interface FastEthernet5/0 overload

第二,

儘管您已為所有 WAN 介面(串列)設定了 ip nat Outside,但每個路由器的 NATing 指令中僅指定了一個介面。

因此,當發生重新路由時(資料包通過另一個路由外部介面),封包的來源位址不會被NAT轉換。

要解決此問題,您需要一個 NAT 命令廣域網路介面。因此,您首先需要建立單獨的 ACL(針對相同來源 LAN),並將一個 ACL 套用至每個 NAT 指令。

例如:

在路由器3上

!
interface FastEthernet1/0
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
!
interface Serial2/0
 ip address 200.200.2.1 255.255.255.252
 ip nat outside
!
interface Serial3/0
 ip address 200.200.1.2 255.255.255.252
 ip nat outside
!
!
interface FastEthernet5/0
 ip address 200.200.4.2 255.255.255.252
 ip nat outside
!    
ip nat inside source list 101 interface FastEthernet5/0 overload
ip nat inside source list 102 interface Serial2/0 overload
ip nat inside source list 103 interface Serial3/0 overload
!
access-list 101 permit ip any any
access-list 102 permit ip any any
access-list 103 permit ip any any

相關內容