基于出接口的NAT easyIP

一、需求

1、允许vlan10所有主机访问外网

2、允许vlan30除78这么主机以外的所有主机上网

3、仅仅允许vlan20内主机位为奇数的主机上网

二、配置acl及应用

1、AR1 创建acl

acl number 2000

rule 5 permit source 192.168.10.0 0.0.0.255

rule 20 deny source 192.168.30.78 0

rule 30 permit source 192.168.30.0 0.0.0.255

rule 40 permit source 192.168.20.1 0.0.0.254

2、AR1 出接接口下应用 acl2000

interface GigabitEthernet0/0/1

ip address 200.1.1.1 255.255.255.0

nat outbound 2000

三、验证

四、网络设备配置信息

1、pc及外网服务器基本IP配置

2、交换机的配置

<sw1>dis cu

vlan batch 10 20 30 40

interface Vlanif1

interface Vlanif10

ip address 192.168.10.254 255.255.255.0

interface Vlanif20

ip address 192.168.20.254 255.255.255.0

interface Vlanif30

ip address 192.168.30.254 255.255.255.0

interface Vlanif40 #与路由器互联地址

ip address 192.168.40.254 255.255.255.0

interface GigabitEthernet0/0/1

port link-type access

port default vlan 40

interface GigabitEthernet0/0/2

port link-type access

port default vlan 10

interface GigabitEthernet0/0/3

port link-type access

port default vlan 20

interface GigabitEthernet0/0/4

port link-type access

port default vlan 30

interface GigabitEthernet0/0/5

port link-type access

port default vlan 30

ip route-static 0.0.0.0 0.0.0.0 192.168.40.1

3、路由器AR1的配置

<AR1>dis cu

acl number 2000 #创建规则

rule 5 permit source 192.168.10.0 0.0.0.255

rule 20 deny source 192.168.30.78 0

rule 30 permit source 192.168.30.0 0.0.0.255

rule 40 permit source 192.168.20.1 0.0.0.254

interface GigabitEthernet0/0/0

ip address 192.168.40.1 255.255.255.0

interface GigabitEthernet0/0/1

ip address 200.1.1.1 255.255.255.0

nat outbound 2000 #接口下应用

ip route-static 0.0.0.0 0.0.0.0 200.1.1.9

ip route-static 192.168.10.0 255.255.255.0 192.168.40.254

ip route-static 192.168.20.0 255.255.255.0 192.168.40.254

ip route-static 192.168.30.0 255.255.255.0 192.168.40.254

<AR1>