赞
踩
注意:一般出口防火墙会配置一条默认路由到运营商!!!运营商那边也是一样的道理!!!
既然有了源NAT以及目的NAT,那么如果将两者结合起来,对“同一流”同时转换源目地址,这就是双向NAT,不可以简单理解成同时配置了源NAT、目的NAT就是双向NAT,双向NAT主要用于以下两种场景。
前提:私网服务器与防火墙源NAT地址池必须在同一个网段!!!
- [USG]firewall zone dmz
- [USG-zone-dmz]add interface g1/0/0
- [USG-zone-dmz]firewall zone untrust
- [USG-zone-untrust]add interface g1/0/1
-
- [USG]nat server protocol tcp global 198.51.100.2 9980 inside 192.168.1.2 80 unr-
- route
- [USG]display firewall server-map
- 2023-12-25 12:49:48.860
- Current Total Server-map : 2
- Type: Nat Server, ANY -> 198.51.100.2:9980[192.168.1.2:80], Zone:---, protoc
- ol:tcp
- Vpn: public -> public
-
- Type: Nat Server Reverse, 192.168.1.2[198.51.100.2] -> ANY, Zone:---, protoc
- ol:tcp
- Vpn: public -> public, counter: 1
-
- [USG]nat address-group addressgroup1
- [USG-address-group-addressgroup1]mode pat
- [USG-address-group-addressgroup1]section 0 192.168.1.5 192.168.1.10
- [USG-address-group-addressgroup1]q
- [USG]nat-policy
- [USG-policy-nat]rule name policy_nat1
- [USG-policy-nat-rule-policy_nat1]source-zone untrust
- [USG-policy-nat-rule-policy_nat1]destination-zone dmz
- [USG-policy-nat-rule-policy_nat1]destination-address 192.168.1.2 32
- [USG-policy-nat-rule-policy_nat1]action source-nat address-group addressgroup1
- [USG-policy-nat-rule-policy_nat1]q
- [USG-policy-nat]q
-
- [USG]security-policy
- [USG-policy-security]rule name policy1
- [USG-policy-security-rule-policy1]source-zone untrust
- [USG-policy-security-rule-policy1]destination-zone dmz
- [USG-policy-security-rule-policy1]destination-address 192.168.1.2 32
- [USG-policy-security-rule-policy1]service http
- [USG-policy-security-rule-policy1]action permit
- [USG-policy-security-rule-policy1]q
- [USG-policy-security]q
-
- [USG]ip route-static 0.0.0.0 0 198.51.100.253

- [USG]display firewall session table
- 2023-12-25 12:58:38.630
- Current Total Sessions : 1
- http VPN: public --> public 203.0.113.2:2051[192.168.1.9:2049] --> 198.51.100
- .2:9980[192.168.1.2:80]
三个点:①配置黑洞路由,unr-route;②源NAT地址池地址段为私网地址,而不是公网地址;③安全策略的目的地址是服务器的私网地址,因为先执行了NAT-Server,再进行源NAT转换。
为什么有了NAT-SERVER,还需要双向NAT呢?
原因在于,源NAT地址池的地址段是私网地址,且与服务器私网地址属于同一个网段,服务器收到转换后的报文,发现源地址与自己属于同一网段,那么回应报文时,就不会查路由,而是发出ARP广播报文询问此地址的MAC地址,防火墙会回应,服务器就将回应报文发给防火墙。
私网服务器不用查路由,总得来说,就是不需要配置网关,如果有很多服务器要修改网关,这时候双向NAT就方便了。
这种主要是小型网络,服务器和私网用户同属一个安全区域,且处于同个网络。
现在,私网用户想通过公网IP:198.51.100.2访问私网服务器,除了要配置NAT Server之外,还要配置源NAT,转换成私网地址或者公网地址,都是没问题的。
为什么不能单独配置NAT Server呢?
当私网用户访问198.51.100.2:9980,防火墙将其转换成192.168.1.2:80,发送给私网服务器,私网服务器回应报文时,发现之前报文的源地址与自己处于同一网段,于是直接不经过防火墙发送给了私网用户。
- [USG]firewall zone trust
- [USG-zone-trust]add interface g1/0/0
-
- [USG]nat server protocol tcp global 198.51.100.2 9980 inside 192.168.1.2 80 unr-
- route
-
- [USG]display firewall server-map
- 2023-12-25 13:26:17.240
- Current Total Server-map : 2
- Type: Nat Server, ANY -> 198.51.100.2:9980[192.168.1.2:80], Zone:---, protoc
- ol:tcp
- Vpn: public -> public
-
- Type: Nat Server Reverse, 192.168.1.2[198.51.100.2] -> ANY, Zone:---, protoc
- ol:tcp
- Vpn: public -> public, counter: 1
-
- [USG]nat address-group addressgroup1
- [USG-address-group-addressgroup1]mode pat
- [USG-address-group-addressgroup1]section 0 192.168.0.5 192.168.0.10
- [USG-address-group-addressgroup1]q
- [USG]nat-policy
- [USG-policy-nat]rule name policy_nat1
- [USG-policy-nat-rule-policy_nat1]source-zone trust
- [USG-policy-nat-rule-policy_nat1]destination-zone trust
- [USG-policy-nat-rule-policy_nat1]destination-address 192.168.1.2 32
- [USG-policy-nat-rule-policy_nat1]action source-nat address-group addressgroup1
- [USG-policy-nat-rule-policy_nat1]q
- [USG-policy-nat]q
- [USG]

- [USG]display firewall session table
- 2023-12-25 13:30:05.200
- Current Total Sessions : 1
- http VPN: public --> public 192.168.1.3:2050[192.168.0.8:2049] --> 198.51.100
- .2:9980[192.168.1.2:80]
一般防火墙对同个区域内流动的报文是不进行控制的,因此没有配置安全策略,根据实际情况而定。
Copyright © 2003-2013 www.wpsshop.cn 版权所有,并保留所有权利。