CCNA R&S (CCNA5.0) Cấu hình NAT và ACL trong bài lab openlab1-s2new
4. NAT configuration:
a) NAT overload:
On router GATE1 (HA NOI office) configure access-list 1 to permit all user on Ha Noi’s LAN connect toward the Internet, using public IP address of interface G0/0 of router GATE 1
GATE1(config)#access-list 1 permit 10.1.1.0 0.0.0.255
GATE1(config)#access-list 1 permit 10.2.2.0 0.0.0.255
GATE1(config)#access-list 1 permit 192.168.123.0 0.0.0.255
GATE1(config)#access-list 1 permit 172.17.1.0 0.0.0.255
GATE1(config)#ip nat inside source list 1 interface GigabitEthernet0/0 overload
b) Static NAT:
On router GATE1 config static NAT to public Web server and Mail server to the Internet, using public IP address 200.0.0.10; 200.0.0.20.
GATE1(config)#ip nat inside source static 192.168.33.10 200.0.0.10
GATE1(config)#ip nat inside source static 192.168.33.20 200.0.0.20
Chỉ ra chiều đi vào , đi ra của NAT
GATE1(config)#interface GigabitEthernet0/0
GATE1(config-if)#ip nat outside
GATE1(config)#interface GigabitEthernet0/1
GATE1(config-if)#ip nat inside
GATE1(config)#interface GigabitEthernet0/2
GATE1(config-if)#ip nat inside
GATE1(config)#interface Serial0/0/0
GATE1(config-if)#ip nat inside
Normal 0 false false false EN-US X-NONE X-NONE MicrosoftInternetExplorer4
5. Security :
+ On all routers GATE1,GATE2,GATE3,GATE4,BR1,BR2 configure as a telnet server using password “cisco@telnet”, secret password as “cisco@sec”, and create access-list 10, permit only Tech’s Lan (172.16.1.0/24) can telnet to router.
GATE1(config)#access-list 10 permit 172.16.1.0 0.0.0.255
GATE1(config)#line vty 0 4
GATE1(config-line)#access-class 10 in
GATE1(config-line)# password cisco@telnet
GATE1(config-line)#login
Trên các router khác tương tự
+ On router GATE 1 configure IPv4 access-list 100 permit request traffic(web, mail,dns and TFTP) from all users sent to DMZ LAN and apply to interface GATE1-G0/2
GATE1(config)#access-list 100 permit tcp any 192.168.33.0 0.0.0.255 eq www
GATE1(config)#access-list 100 permit tcp any 192.168.33.0 0.0.0.255 eq smtp
GATE1(config)#access-list 100 permit tcp any 192.168.33.0 0.0.0.255 eq pop3
GATE1(config)#access-list 100 permit udp any 192.168.33.0 0.0.0.255 eq domain
GATE1(config)#access-list 100 permit udp any 192.168.33.0 0.0.0.255 eq tftp
GATE1(config)#interface GigabitEthernet0/2
GATE1(config-if)#ip access-group 100 out
+ On router GATE 1 config IPv6 access-list(name DMZ-SERVER) permit request traffic(web, mail,dns and TFTP) from all users sent to DMZ LAN and apply to interface GATE1-G0/2
GATE1(config)#ipv6 access-list DMZ-SERVER
GATE1(config-ipv6-acl)#permit tcp any 2003:3::/64 eq www
GATE1(config-ipv6-acl)#permit tcp any 2003:3::/64 eq smtp
GATE1(config-ipv6-acl)#permit tcp any 2003:3::/64 eq pop3
GATE1(config-ipv6-acl)#permit tcp any 2003:3::/64 eq domain
GATE1(config-ipv6-acl)#permit udp any 2003:3::/64 eq domain
GATE1(config-ipv6-acl)#permit udp any 2003:3::/64 eq tf
GATE1(config-ipv6-acl)#permit udp any 2003:3::/64 eq tftp
GATE1(config-ipv6-acl)#exit
GATE1(config)#interface GigabitEthernet0/2
GATE1(config-if)#ipv6 traffic-filter DMZ-SERVER out
Nguồn: Trung tâm thiết bị viễn thông bách khoa