华为USG：私网用户通过Smart NAT访问Internet (Smart NAT要用命令行去配置)

华为USG：私网用户通过Smart NAT访问Internet (Smart NAT要用命令行去配置)

（1）组网需求

为了使私网中192.168.1.0/24网段的用户可以正常访问Internet，需要在FW上配置源NAT策略。

除了公网接口的IP地址外，公司还向ISP申请了6个IP地址（192.168.2.249～192.168.2.254）作为私网地址转换后的公网地址。网络环境如图所示，其中sw2是ISP提供的接入网关。

通常情况下，同一时刻需要访问Internet的私网用户数量很少，使用No-PAT方式即可；

为了解决突发性私网用户数量增多的情况，预留一个公网IP地址进行NAPT方式的地址转换。

（2）源NAT策略组网图

（3）配置

sw1:

interface Vlanif1

 ip address 192.168.1.100 255.255.255.0

interface GE1/0/0

 undo shutdown

ip route-static 0.0.0.0 0.0.0.0 192.168.1.254

sw2:

interface GE1/0/0

 undo portswitch

 undo shutdown

 ip address 192.168.2.100 255.255.255.0

#

fw:

aaa

  manager-user admin

  password cipher @%@%dh[dSye2Y1ZNa`W|"kn*I8Pe#|sy/^'(J.[z3\V8z\D58PhI@%@%

  service-type web terminal telnet

  level 15

interface GigabitEthernet0/0/0

 undo shutdown

 ip binding vpn-instance default

 ip address 10.12.3.3 255.255.0.0

 service-manage http permit

 service-manage https permit

 service-manage ping permit

 service-manage ssh permit

 service-manage snmp permit

 service-manage telnet permit

 service-manage netconf permit

#

interface GigabitEthernet1/0/0

 undo shutdown

 ip address 192.168.1.254 255.255.255.0

 service-manage http permit

 service-manage https permit

 service-manage ping permit

 service-manage ssh permit

 service-manage snmp permit               

 service-manage telnet permit

 service-manage netconf permit

#

interface GigabitEthernet1/0/1

 undo shutdown

 ip address 192.168.2.254 255.255.255.0

 service-manage ping permit

#

firewall zone local

 set priority 100

#                                         

firewall zone trust

 set priority 85

 add interface GigabitEthernet0/0/0

 add interface GigabitEthernet1/0/0

#

firewall zone untrust

 set priority 5

 add interface GigabitEthernet1/0/1

#

firewall zone dmz

 set priority 50

#

security-policy

 default action permit

测试：目前sw1是ping不通sw2的

<sw1>ping 192.168.2.100

  PING 192.168.2.100: 56  data bytes, press CTRL_C to break

    Request time out

    Request time out

    Request time out

    Request time out

    Request time out

  --- 192.168.2.100 ping statistics ---

    5 packet(s) transmitted

    0 packet(s) received

    100.00% packet loss

<sw1>

（4.1）配置NAT地址池。

nat address-group addressgroup1 0

 mode no-pat global

 route enable

 smart-nopat 192.168.2.254

 section 0 192.168.2.249 192.168.2.253

（4.2）配置源NAT策略，实现私网指定网段访问Internet时自动进行源地址转换。

nat-policy

 rule name policy_nat1

  source-zone trust

  destination-zone untrust

  source-address 192.168.1.0 mask 255.255.255.0

  action source-nat address-group addressgroup1

（4.3）在FW上配置缺省路由，使私网流量可以正常转发至ISP的路由器。

[USG6000V2]ip route-static 0.0.0.0 0.0.0.0 192.168.2.100

测试：

<sw1>ping -c 400 192.168.2.100

  PING 192.168.2.100: 56  data bytes, press CTRL_C to break

    Reply from 192.168.2.100: bytes=56 Sequence=1 ttl=254 time=8 ms

    Reply from 192.168.2.100: bytes=56 Sequence=2 ttl=254 time=11 ms

    Reply from 192.168.2.100: bytes=56 Sequence=3 ttl=254 time=6 ms

    Reply from 192.168.2.100: bytes=56 Sequence=4 ttl=254 time=5 ms

    Reply from 192.168.2.100: bytes=56 Sequence=5 ttl=254 time=6 ms

<USG6000V2>display firewall session table 

2023-02-09 08:24:12.490 

 Current Total Sessions : 3

 tcp  VPN: default --> default  10.12.18.99:3470 --> 10.12.3.3:8443

 SMB  VPN: default --> default  10.12.160.10:138 --> 10.12.255.255:138

 icmp  VPN: public --> public  192.168.1.100:33792[192.168.2.249:33792] --> 192.168.2.100:2048

<USG6000V2>