当前位置：首页 > news >正文

智能选路+NAT实验

news 来源：原创 2025/5/8 4:28:05

拓扑信息：

1.IP配置

R2:

[r2]interface GigabitEthernet 0/0/0
[r2-GigabitEthernet0/0/0]ip address 13.0.0.3 24
[r2]interface GigabitEthernet 0/0/1
[r2-GigabitEthernet0/0/1]ip address 100.1.1.254  24
[r2]interface GigabitEthernet 0/0/2
[r2-GigabitEthernet0/0/2]ip address 110.1.1.254 24

R3:

[r3]interface GigabitEthernet 0/0/0
[r3-GigabitEthernet0/0/0]ip address 12.0.0.2 24
[r3]interface GigabitEthernet 0/0/1     
[r3-GigabitEthernet0/0/1]ip address 210.1.1.254 24
[r3]interface GigabitEthernet 0/0/2
[r3-GigabitEthernet0/0/2]ip address 200.1.1.254 24

防火墙：

[FW]interface GigabitEthernet 1/0/0    
[FW-GigabitEthernet1/0/0]ip address 192.168.1.254 24
[FW-GigabitEthernet1/0/0]interface GigabitEthernet 1/0/1
[FW-GigabitEthernet1/0/1]ip address 13.0.0.1 24
[FW-GigabitEthernet1/0/1]interface GigabitEthernet 1/0/2
[FW-GigabitEthernet1/0/2]ip address 12.0.0.1 24

2.安全区域划分：

[FW]firewall zone trust     
[FW-zone-trust]add interface GigabitEthernet 1/0/0

[FW]firewall zone name untrust_1
[FW-zone-untrust_1]add interface GigabitEthernet 1/0/1

[FW]firewall zone name untrust_2
[FW-zone-untrust_2]add interface GigabitEthernet 1/0/2

3.导入地址库：

网络->路由->智能选路->运营商地址库->导入

4.配置链路接口：

网络->接口->链路接口->新建

关闭链路接口的缺省路由下放功能，否则无法正常下放明细路由。

5.配置真实DNS服务器：

[FW]slb enable 
[FW]slb
[FW-slb]group 0 dns
[FW-slb-group-0]metric roundrobin
[FW-slb-group-0]rserver 0 rip 100.1.1.1 port 53
[FW-slb-group-0]rserver 1 rip 200.1.1.1 port 53

6.创建虚拟服务器，虚拟DNS服务器：

[FW]slb	
[FW-slb]vserver 0 dns
[FW-slb-vserver-0]vip 10.10.10.10
[FW-slb-vserver-0]group dns

7.配置DNS透明代理功能：

web界面：网络->DNS->DNS透明代理->DNS透明代理功能->启用

[FW]dns-transparent-policy  
[FW-policy-dns]dns transparent-proxy enable

将200.1.1.1和100.1.1.1的DNS的IP地址与出接口绑定

[FW]dns-transparent-policy
[FW-policy-dns]dns server bind interface GigabitEthernet 1/0/1 preferred
100.1.1.1 
[FW-policy-dns]dns server bind interface GigabitEthernet 1/0/2 preferred
200.1.1.1

8.透明代理策略：

[FW]dns-transparent-policy   
[FW-policy-dns]rule name dns_policy
[FW-policy-dns-rule-dns_policy]source-address 192.168.1.0 24
[FW-policy-dns-rule-dns_policy]enable   
[FW-policy-dns-rule-dns_policy]action tpdns

9.配置安全策略：

10.配置NAT策略：

[FW]nat-policy
[FW-policy-nat]rule name policy1
[FW-policy-nat-rule-policy1]source-zone trust 
[FW-policy-nat-rule-policy1]destination-zone untrust_1
[FW-policy-nat-rule-policy1]source-address 192.168.1.0 24

[FW]nat-policy
[FW-policy-nat]rule name policy2
[FW-policy-nat-rule-policy2]source-zone trust 
[FW-policy-nat-rule-policy2]destination-zone untrust_2
[FW-policy-nat-rule-policy2]source-address 192.168.1.0 24