Преглеждане на кода на Конфигуриране на NAT (PAT) при Cisco ASA

[[Category:Cisco]]
=Примерна топология=
[[Файл:ASA_PAT_Topology.png]]

В топологията вътрешната LAN мрежа (inside), която е свързана към ASA0 използва IPv4 адреси 10.0.0.0/8.

Мрежата между ASA0 (модел 5505) и RBB използва IPv4 адреси 194.141.69.0/24.

Към RBB е свързана и мрежа 8.0.0.0/8.

=Базова конфигурация на ASA0=
==Интерфейси==
<pre style="white-space: pre-wrap; white-space: -moz-pre-wrap;white-space: -pre-wrap;white-space: -o-pre-wrap; word-wrap: break-word">
enable
configure terminal

interface vlan 1
nameif inside
ip address 10.0.0.1 255.0.0.0

interface vlan 2
nameif outside
ip address 194.141.69.1 255.255.255.0

interface ethernet0/0
switchport access vlan 2
</pre>

==DHCP за мрежа 10.0.0.0 (опционално)==
<pre style="white-space: pre-wrap; white-space: -moz-pre-wrap;white-space: -pre-wrap;white-space: -o-pre-wrap; word-wrap: break-word">
enable
configure terminal 

dhcpd address 10.0.0.2-10.0.0.100 inside 
dhcpd dns 8.8.8.8 interface inside
dhcpd enable inside
</pre>
==Път по подразбиране (default route) на ASA0==
<pre style="white-space: pre-wrap; white-space: -moz-pre-wrap;white-space: -pre-wrap;white-space: -o-pre-wrap; word-wrap: break-word">
enable
configure terminal

route outside 0.0.0.0 0.0.0.0 194.141.69.2
</pre>
==NAT (PAT) на ASA0==
<pre style="white-space: pre-wrap; white-space: -moz-pre-wrap;white-space: -pre-wrap;white-space: -o-pre-wrap; word-wrap: break-word">
enable
configure terminal

object network INSIDE_NET
subnet 10.0.0.0 255.0.0.0
nat (inside,outside) dynamic interface
</pre>
==Разрешаване на изходящ трафик от ASA0 (за проверка на NAT)==
<pre style="white-space: pre-wrap; white-space: -moz-pre-wrap;white-space: -pre-wrap;white-space: -o-pre-wrap; word-wrap: break-word">
enable
configure terminal

access-list PERMIT_TCP permit tcp any any
access-group PERMIT_TCP out interface outside
access-group PERMIT_TCP in interface outside
</pre>
=Ctrl+C/Ctrl+V=
==ASA==
<pre style="white-space: pre-wrap; white-space: -moz-pre-wrap;white-space: -pre-wrap;white-space: -o-pre-wrap; word-wrap: break-word">
enable
configure terminal
interface vlan 1
nameif inside
ip address 10.0.0.1 255.0.0.0
interface vlan 2
nameif outside
ip address 194.141.69.1 255.255.255.0
interface ethernet0/0
switchport access vlan 2
exit
dhcpd address 10.0.0.2-10.0.0.100 inside 
dhcpd dns 8.8.8.8 interface inside
dhcpd enable inside
route outside 0.0.0.0 0.0.0.0 194.141.69.2
access-list PERMIT_TCP permit tcp any any
access-group PERMIT_TCP out interface outside
access-group PERMIT_TCP in interface outside
object network INSIDE_NET
subnet 10.0.0.0 255.0.0.0
nat (inside,outside) dynamic interface
end
</pre>
==RBB==
<pre style="white-space: pre-wrap; white-space: -moz-pre-wrap;white-space: -pre-wrap;white-space: -o-pre-wrap; word-wrap: break-word">
enable
configure terminal
hostname R1
interface FastEthernet0/0
ip address 194.141.69.2 255.255.255.0
no shut
interface FastEthernet0/1
ip address 8.0.0.1 255.0.0.0
no shut
end
</pre>