本文讲述了华为HCIA认证考试NAT 实验。分享给大家供大家参考，具体如下：

HCIA---NAT 实验

目录

搭建拓扑图

实验要求

1.AR3只能配置IP地址；
2.内网PC1和PC3可以上网，PC2不允许上网；
3.互联网PC可以直接登陆到AR1和PC1。

配置过程

配置 IP 地址、DHCP

R1：

sys
[Huawei]sys R1
[R1]dhcp en
[R1]int gi 0/0/1
[R1-GigabitEthernet0/0/1]ip add 172.16.1.1 24
[R1-GigabitEthernet0/0/1]dhcp ｓｅｌｅｃｔ interface
[R1-GigabitEthernet0/0/1]dhcp server dns-list 1.1.1.1
[R1-GigabitEthernet0/0/1]dhcp server excluded-ip-address 172.16.1.2
[R1-GigabitEthernet0/0/1]dhcp server static-bing ip-address 172.16.1.253 mac-address 5489-98BC-11DA
[R1-GigabitEthernet0/0/1]int gi 0/0/0
[R1-GigabitEthernet0/0/0]ip add 172.16.2.1 24
[R1-GigabitEthernet0/0/0]quit
[R1]ip route-static 0.0.0.0 0 172.16.2.2

R2：

sys
[Huawei]sys R2
[R2]int gi 0/0/0
[R2-GigabitEthernet0/0/0]ip add 172.16.2.2 24
[R2-GigabitEthernet0/0/0]int gi 0/0/1
[R2-GigabitEthernet0/0/1] ip add 202.100.1.10 24
[R2-GigabitEthernet0/0/1]qu
[R2] ip route-static 172.16.1.0 24 172.16.2.1
[R2] ip route-static 0.0.0.0 0 202.100.1.30

R3：

sys
[Huawei]sys R3
[R3]int gi 0/0/0
[R3-GigabitEthernet0/0/0]ip add 100.1.1.1 24
[R3-GigabitEthernet0/0/0]int gi 0/0/1
[R3-GigabitEthernet0/0/1]ip add 202.100.1.30 24
[R3-GigabitEthernet0/0/1]qu
[R3]qu
save

PC1：

[PC1]int gi 0/0/0
[PC1-GigabitEthernet0/0/0]ip add 172.16.1.2 24
[PC1-GigabitEthernet0/0/0]qu
[PC1]ip route-static 0.0.0.0 0 172.16.1.1

互联网 PC：

sys
[Huawei]sys INTERNET PC
[INTERNET PC]int gi 0/0/0
[INTERNET PC-GigabitEthernet0/0/0]ip add 100.1.1.2 24
[INTERNET PC-GigabitEthernet0/0/0]qu
[INTERNET PC]ip route-static 0.0.0.0 0 100.1.1.1
[INTERNET PC]qu
save

配置 telnet 服务

R2：

[R2]user-interface vty 0 4
[R2-ui-vty0-4]authentication-mode aaa
[R2-ui-vty0-4]aaa
[R2-aaa]local-user R1 privilege level 15 password cipher 333333
[R2-aaa]qu

配置 ACL

R2：

[R2]acl 3500
[R2-acl-adv-3500]rule deny icmp source 172.16.1.253 0
[R2-acl-adv-3500]qu
[R2]int gi 0/0/0
[R2-GigabitEthernet0/0/0]traffic-filter inbound acl 3500
[R2-GigabitEthernet0/0/0]qu

配置 NAT

R2：

[R2]acl 2000
[R2-acl-basic-2000]rule permit source 172.16.1.0 0.0.0.255
[R2-acl-basic-2000]qu
[R2]int gi 0/0/1
[R2-GigabitEthernet0/0/1]nat outbound 2000
[R2-GigabitEthernet0/0/1]nat server protocol tcp global 202.100.1.20 23 inside 172.16.2.1 23
[R2-GigabitEthernet0/0/1]nat server protocol tcp global 202.100.1.20 8000 inside 172.16.1.1 23
[R2-GigabitEthernet0/0/1]nat server protocol tcp global 202.100.1.20 8001 inside 172.16.1.2 23
[R2]qu
save