部分拓扑是这样的：R2与R3通过以太口互连，在R3上启用NAT。R2的接口地址是192.168.1.1/24，R3的接口地址是192.168.1.2/24，该接口是NAT的outside接口。R3的相关配置内容如下：
interface Loopback0
ip address 172.16.4.1 255.255.255.0
!
interface Loopback1
ip address 172.16.5.1 255.255.255.0
!
interface FastEthernet0/0
ip address 172.16.3.1 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
!
interface FastEthernet0/1
ip address 192.168.1.2 255.255.255.0
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
!
router eigrp 100
network 172.16.3.0 0.0.0.255
network 172.16.4.0 0.0.0.255
network 172.16.5.0 0.0.0.255
network 192.168.1.0
no auto-summary
!
router ospf 5
router-id 3.3.3.3
log-adjacency-changes
network 172.16.0.0 0.0.255.255 area 0
network 192.168.1.0 0.0.0.255 area 0
!
router rip
version 2
network 172.16.0.0
no auto-summary
!
ip nat pool teet 20.20.20.1 20.20.20.1 prefix-length 24
ip nat inside source list 1 pool teet overload
!
access-list 1 permit 192.168.1.0 0.0.0.255
!
之后，eigrp 和ospf的邻居关系都失去了。使用debug看，显示出一下信息：
*Sep 6 09:26:08.957: NAT: translation failed (A), dropping packet s=192.168.1.2 d=192.168.1.1
*Sep 6 09:26:10.153: NAT: translation failed (A), dropping packet s=192.168.1.2 d=224.0.0.10
*Sep 6 09:26:13.957: NAT: translation failed (A), dropping packet s=192.168.1.2 d=192.168.1.1
*Sep 6 09:26:14.633: NAT: translation failed (A), dropping packet s=192.168.1.2 d=224.0.0.10
*Sep 6 09:26:15.269: NAT: translation failed (A), dropping packet s=192.168.1.2 d=224.0.0.5
以上信息重复出现。
说明路由器自己outside接口发出的数据在地址翻译时失败，因而被丢弃。
那么修改ACL，
R3(config)#no access-list 1
R3(config)#access-list 1 deny host 192.168.1.2
R3(config)#access-list 1 deny host 192.168.1.0 0.0.0.255
察看访问列表：
R3#sh access-lists
Standard IP access list 1
10 deny 192.168.1.2 (23 matches)
20 permit 192.168.1.0, wildcard bits 0.0.0.255
这样修改之后，就正常建立邻居，交换路由信息了。
R3#SH IP ROUTE
172.16.0.0/16 is variably subnetted, 6 subnets, 2 masks
C 172.16.4.0/24 is directly connected, Loopback0
C 172.16.5.0/24 is directly connected, Loopback1
R 172.16.0.0/29 [120/1] via 172.16.3.2, 00:00:06, FastEthernet0/0
D 172.16.1.0/24 [90/156160] via 192.168.1.1, 00:02:33, FastEthernet0/1
D 172.16.2.0/24 [90/30720] via 192.168.1.1, 00:02:33, FastEthernet0/1
C 172.16.3.0/24 is directly connected, FastEthernet0/0
C 192.168.1.0/24 is directly connected, FastEthernet0/1
R3#
笔者认为：outside接口发出的数据，本来就不应该翻译。因为地址翻译执行的前提是数据必须经由outside和inside接口，只经由一个接口不应该翻译。
阅读(2211) | 评论(0) | 转发(1) |
