华为USG：私网用户通过三元组NAT访问Internet

华为USG：私网用户通过三元组NAT访问Internet

（1）组网需求

某公司在网络边界处部署了FW作为安全网关。为了使私网中192.168.1.0/24网段的用户可以正常访问Internet，需要在FW上配置源NAT策略。除了公网接口的IP地址外，公司还向ISP申请了6个IP地址（192.168.2.249～192.168.2.254）作为私网地址转换后的公网地址。网络环境如图1所示，其中Router是ISP提供的接入网关。

同时，要求私网用户与Internet上的主机之间能进行P2P业务交流，如文件共享、语音通信、视频传输等，Internet上的主机也能主动访问私网用户。

（2）拓扑图

（3）配置

sw1:

interface Vlanif1

 ip address 192.168.1.100 255.255.255.0

interface GE1/0/0

 undo shutdown

ip route-static 0.0.0.0 0.0.0.0 192.168.1.254

sw2:

interface GE1/0/0

 undo portswitch

 undo shutdown

 ip address 192.168.2.100 255.255.255.0

#

fw:

aaa

  manager-user admin

  password cipher @%@%dh[dSye2Y1ZNa`W|"kn*I8Pe#|sy/^'(J.[z3\V8z\D58PhI@%@%

  service-type web terminal telnet

  level 15

interface GigabitEthernet0/0/0

 undo shutdown

 ip binding vpn-instance default

 ip address 10.12.3.3 255.255.0.0

 service-manage http permit

 service-manage https permit

 service-manage ping permit

 service-manage ssh permit

 service-manage snmp permit

 service-manage telnet permit

 service-manage netconf permit

#

interface GigabitEthernet1/0/0

 undo shutdown

 ip address 192.168.1.254 255.255.255.0

 service-manage http permit

 service-manage https permit

 service-manage ping permit

 service-manage ssh permit

 service-manage snmp permit               

 service-manage telnet permit

 service-manage netconf permit

#

interface GigabitEthernet1/0/1

 undo shutdown

 ip address 192.168.2.254 255.255.255.0

 service-manage ping permit

#

firewall zone local

 set priority 100

#                                         

firewall zone trust

 set priority 85

 add interface GigabitEthernet0/0/0

 add interface GigabitEthernet1/0/0

#

firewall zone untrust

 set priority 5

 add interface GigabitEthernet1/0/1

#

firewall zone dmz

 set priority 50

#

security-policy

 default action permit

测试：目前sw1是ping不通sw2的

<sw1>ping 192.168.2.100

  PING 192.168.2.100: 56  data bytes, press CTRL_C to break

    Request time out

    Request time out

    Request time out

    Request time out

    Request time out

  --- 192.168.2.100 ping statistics ---

    5 packet(s) transmitted

    0 packet(s) received

    100.00% packet loss

<sw1>

（4.1）配置NAT地址池，配置时开启允许端口地址转换，实现公网地址复用。

nat address-group addressgroup1 0

 mode full-cone global

 route enable

 section 0 192.168.2.249 192.168.2.254

（4.2）配置源NAT策略，实现私网指定网段访问Internet时自动进行源地址转换。

nat-policy

 rule name policy1

  source-zone trust

  destination-zone untrust

  source-address 192.168.1.0 mask 255.255.255.0

  action source-nat address-group addressgroup1

（4.3）在FW上配置缺省路由，使私网流量可以正常转发至ISP的路由器。

[USG6000V2]ip route-static 0.0.0.0 0.0.0.0 192.168.2.100

测试：

<sw1>ping -c 400 192.168.2.100

  PING 192.168.2.100: 56  data bytes, press CTRL_C to break

    Reply from 192.168.2.100: bytes=56 Sequence=1 ttl=254 time=8 ms

    Reply from 192.168.2.100: bytes=56 Sequence=2 ttl=254 time=11 ms

    Reply from 192.168.2.100: bytes=56 Sequence=3 ttl=254 time=6 ms

    Reply from 192.168.2.100: bytes=56 Sequence=4 ttl=254 time=5 ms

    Reply from 192.168.2.100: bytes=56 Sequence=5 ttl=254 time=6 ms

[USG6000V2]display firewall session table 

2023-02-09 08:40:00.500 

 Current Total Sessions : 5

 icmp  VPN: public --> public  192.168.1.100:1024[192.168.2.254:2048] --> 192.168.2.100:2048

 SMB  VPN: default --> default  10.12.12.217:138 --> 10.12.255.255:138

 tcp  VPN: default --> default  10.12.18.99:3470 --> 10.12.3.3:8443

 tcp  VPN: public --> public  192.168.2.254:60124 --> 192.168.0.1:1024

 NetBios  VPN: default --> default  10.12.12.150:137 --> 10.12.255.255:137

[USG6000V2]