Cisco2801 配置实例

# telnet 10.10.20.2

TestHost#show run
Building configuration...

Current configuration : 41756 bytes
!
version 16.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Test Host
!
boot-start-marker
boot-end-marker
!
logging buffered 52000 debugging
!
username cisco privilege 15 secret 5 $XXXXXXXXXKKKKKKXXXXXXX
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
aaa new-model
!
!
aaa session-id common
ip subnet-zero
ip cef
!
!
!
!
ip domain name yourdomain.com
no ftp-server write-enable
!
!
!
!
【路由器内网络LAN】
interface FastEthernet0/1
description $ETH-LAN$$ETH-SW-LAUNCH$$INTF-INFO-FE 0$
ip address 172.168.20.65 255.255.255.224 secondary   #公网地址
 ip address 10.10.20.2 255.255.255.0     #私有地址
 ip nat inside
 duplex auto
 speed auto
!

【路由器外网络WAN】       
interface FastEthernet0/0
 description $ETH-WAN$
 ip address 67.82.171.26 255.255.255.252  #互联地址
 ip nat outside
 duplex auto
 speed auto
!        
ip classless

【静态路由】
ip route 0.0.0.0 0.0.0.0 67.82.171.25
ip route 10.10.1.0 255.255.255.0 10.10.20.1
ip route 10.10.10.0 255.255.255.0 10.10.20.1

no ip http server

【绑定地址池，用于NAT转换】
ip nat pool howard 172.168.20.66 172.168.20.83 prefix-length 19
ip nat inside source list 1 interface FastEthernet0/1 overload

【私有地址进行NAT转换】
ip nat inside source static tcp 10.10.20.14 20 172.168.20.66 20 extendable
ip nat inside source static tcp 10.10.20.14 21 172.168.20.66 21 extendable
ip nat inside source static tcp 10.10.20.14 23 172.168.20.66 23 extendable

【做代理是需要加 具体端口 和extendable】
ip nat inside source static tcp 10.10.20.14 25 172.168.20.66 25 extendable
ip nat inside source static tcp 10.10.20.14 80 172.168.20.66 80 extendable
ip nat inside source static tcp 10.10.20.14 110 172.168.20.66 110 extendable
ip nat inside source static tcp 10.10.20.14 808 172.168.20.66 808 extendable
ip nat inside source static tcp 10.10.20.14 1080 172.168.20.66 1080 extendable
ip nat inside source static tcp 10.10.20.14 2121 172.168.20.66 2121 extendable
ip nat inside source static tcp 10.10.10.25 80 172.168.20.67 80 extendable

【静态转换】
ip nat inside source static 10.10.20.72 172.168.20.68
ip nat inside source static 10.10.20.19 172.168.20.69
ip nat inside source static 10.10.20.146 172.168.20.70
ip nat inside source static 10.10.20.73 172.168.20.72
!        
!        
【访问控制，注意必须加上反掩码，否则在路由器内网口绑定私有地址和公网地址会有问题，就是外面可访问公网地址，内网不能出去】
access-list 1 permit 10.10.20.0 0.0.0.255
access-list 1 permit 10.10.10.0 0.0.0.255
access-list 1 permit 10.10.1.0 0.0.0.255

【访问控制列表】
access-list 103 deny   tcp any host 123.103.99.80
access-list 103 deny   tcp any host 123.103.99.81
access-list 103 deny   tcp any host 123.103.99.132
access-list 103 deny   tcp any host 123.103.99.133
access-list 103 deny   tcp any host 123.103.99.134
access-list 103 deny   tcp any host 60.28.193.157
access-list 103 permit ip any any
!        
control-plane
   
!        
line con 0
line aux 0
line vty 0 4
 privilege level 15
 password testpassword
 transport input telnet
line vty 5 15
 privilege level 15
 transport input telnet
!        
end