V7 NAT hairpin转换过程
1.组网
2.需求
通过配置NAT hairpin，实现内网主机通过公网地址访问内部服务器。
3.关键配置
#
interface GigabitEthernet0/2
port link-mode route
description WAN
ip address 1.1.1.1 255.255.255.0
nat outbound
nat server protocol tcp global 1.1.1.1 23 inside 192.168.1.10 23
#
interface GigabitEthernet0/0
port link-mode route
description LAN
ip address 192.168.1.1 255.255.255.0
nat hairpin enable
#
4.测试
内网主机192.168.1.1通过公网地址访问内网服务器192.168.1.10
<R1>*Jun 30 09:44:46:222 2020 R1 IPFW/7/IPFW_PACKET:
Receiving, interface = GigabitEthernet0/0, version = 4, headlen = 20, tos = 192,
pktlen = 60, pktid = 141, offset = 0, ttl = 255, protocol = 6,
checksum = 63170, s = 192.168.1.2, d = 1.1.1.1
prompt: Receiving IP packet.
*Jun 30 09:44:46:222 2020 R1 NAT/7/COMMON:
//公网口出方向做源地址转换
PACKET: (GigabitEthernet0/2-out) Protocol: TCP
192.168.1.2:11393 - 1.1.1.1: 23(VPN: 0) ------>
1.1.1.1: 1025 - 1.1.1.1: 23(VPN: 0)
*Jun 30 09:44:46:222 2020 R1 NAT/7/COMMON:
//内网口入方向做目的地址转换
PACKET: (GigabitEthernet0/0-in) Protocol: TCP
1.1.1.1: 1025 - 1.1.1.1: 23(VPN: 0) ------>
1.1.1.1: 1025 - 192.168.1.10: 23(VPN: 0)
*Jun 30 09:44:46:222 2020 R1 IPFW/7/IPFW_PACKET:
Sending, interface = GigabitEthernet0/0, version = 4, headlen = 20, tos = 192,
pktlen = 60, pktid = 141, offset = 0, ttl = 254, protocol = 6,
checksum = 63418, s = 1.1.1.1, d = 192.168.1.10
prompt: Sending the packet from GigabitEthernet0/0 at GigabitEthernet0/0.
*Jun 30 09:44:46:224 2020 R1 IPFW/7/IPFW_PACKET:
Receiving, interface = GigabitEthernet0/0, version = 4, headlen = 20, tos = 192,
pktlen = 60, pktid = 135, offset = 0, ttl = 255, protocol = 6,
checksum = 63168, s = 192.168.1.10, d = 1.1.1.1
prompt: Receiving IP packet.
*Jun 30 09:44:46:224 2020 R1 NAT/7/COMMON:
//服务器返回的报文在内网口入方向做源地址转换
PACKET: (GigabitEthernet0/0-in) Protocol: TCP
192.168.1.10: 23 - 1.1.1.1: 1025(VPN: 0) ------>
1.1.1.1: 23 - 1.1.1.1: 1025(VPN: 0)
*Jun 30 09:44:46:224 2020 R1 NAT/7/COMMON:
//服务器返回的报文在内网口出方向做目的地址转换
PACKET: (GigabitEthernet0/0-out) Protocol: TCP
1.1.1.1: 23 - 1.1.1.1: 1025(VPN: 0) ------>
1.1.1.1: 23 - 192.168.1.2:11393(VPN: 0)
*Jun 30 09:44:46:224 2020 R1 IPFW/7/IPFW_PACKET:
Sending, interface = GigabitEthernet0/0, version = 4, headlen = 20, tos = 192,
pktlen = 60, pktid = 135, offset = 0, ttl = 254, protocol = 6,
checksum = 63432, s = 1.1.1.1, d = 192.168.1.2
prompt: Sending the packet from GigabitEthernet0/0 at GigabitEthernet0/0.