动态外部转换

使用动态外部转换
外部网络所有地址访问内网使用172.16.1.100-101地址池，当地址池不够用时使用复用地址172.16.1.111
外部网络所有地址访问DMZ时使用复用地址10.10.1.100
pixfirewall# sh run
PIX Version 7.2(1)
!
interface Ethernet0
 nameif inside
 security-level 100
 ip address 172.16.1.1 255.255.255.0
!
interface Ethernet1
 nameif outside
 security-level 0
 ip address 192.168.1.1 255.255.255.0
!
interface Ethernet2
 nameif dmz
 security-level 50
 ip address 10.10.1.1 255.255.255.0
!
access-list 1 extended permit ip any any       ----这条命令一样实现，但是只有原地址为2.2.0.0通过，而192.168.0.0网段不可以通过PIX进行转换，因为访问控制列表不允许access-list 1 extended permit ip 2.2.0.0 255.255.0.0 any

global (inside) 1 172.16.1.100-172.16.1.101 netmask 255.255.255.0
global (inside) 1 172.16.1.111 netmask 255.255.255.0
global (dmz) 1 10.10.1.100 netmask 255.255.255.0
nat (outside) 1 0.0.0.0 0.0.0.0 outside        ----指定外部所有地址进行转换，outside选项为：启动外部NAT，从低安全级接口到高安全级接口连接中的源地址将进行转换，这个特性被称为双向NAT。使用用pix版本6.2或更高(关键参数）
access-group 1 in interface outside
route inside 1.1.1.0 255.255.255.0 172.16.1.2 1
route outside 2.2.0.0 255.255.0.0 192.168.1.2 1
route dmz 3.3.3.0 255.255.255.0 10.10.1.2 1

pixfirewall# sh xl
7 in use, 7 most used
PAT Global 10.10.1.100(3) Local 2.2.3.2 ICMP id 41      ----外部到DMZ转换
Global 172.16.1.101 Local 2.2.3.2                       ----外部到inside转换
PAT Global 10.10.1.100(1) Local 192.168.1.2 ICMP id 39  ----外部到DMZ转换
PAT Global 10.10.1.100(2) Local 2.2.2.2 ICMP id 40      ----外部到DMZ转换
Global 172.16.1.100 Local 2.2.2.2                       ----外部到inside转换
PAT Global 10.10.1.100(4) Local 2.2.4.2 ICMP id 42      ----外部到DMZ转换
PAT Global 172.16.1.111(1) Local 2.2.4.2 ICMP id 38     ----外部到inside转换
pixfirewall#

R1#sh run
interface Loopback0
 ip address 1.1.1.1 255.255.255.0
!
interface FastEthernet0/0
 ip address 172.16.1.2 255.255.255.0
 duplex auto
 speed auto
!
ip route 0.0.0.0 0.0.0.0 172.16.1.1

R2#sh run
interface Loopback0
 ip address 2.2.2.2 255.255.255.0
!
interface Loopback1
 ip address 2.2.3.2 255.255.255.0
!
interface Loopback2
 ip address 2.2.4.2 255.255.255.0
!
interface FastEthernet0/0
 ip address 192.168.1.2 255.255.255.0
 duplex auto
 speed auto
!
ip route 0.0.0.0 0.0.0.0 192.168.1.1

R3#sh run
interface Loopback0
 ip address 3.3.3.3 255.255.255.0
!
interface FastEthernet0/0
 ip address 10.10.1.2 255.255.255.0
 duplex auto
 speed auto
!
ip route 0.0.0.0 0.0.0.0 10.10.1.1