NAT与EIGRP的奇怪现象

部分拓扑是这样的：R2与R3通过以太口互连，在R3上启用NAT。R2的接口地址是192.168.1.1/24，R3的接口地址是192.168.1.2/24，该接口是NAT的outside接口。R3的相关配置内容如下：

interface Loopback0

 ip address 172.16.4.1 255.255.255.0

!

interface Loopback1

 ip address 172.16.5.1 255.255.255.0

!

interface FastEthernet0/0

 ip address 172.16.3.1 255.255.255.0

 ip nat inside

 ip virtual-reassembly

 duplex auto

 speed auto

!

interface FastEthernet0/1

 ip address 192.168.1.2 255.255.255.0

 ip nat outside

 ip virtual-reassembly

 duplex auto

 speed auto

!

router eigrp 100

 network 172.16.3.0 0.0.0.255

 network 172.16.4.0 0.0.0.255

 network 172.16.5.0 0.0.0.255

 network 192.168.1.0

 no auto-summary

!

router ospf 5

 router-id 3.3.3.3

 log-adjacency-changes

 network 172.16.0.0 0.0.255.255 area 0

 network 192.168.1.0 0.0.0.255 area 0

!

router rip

 version 2

 network 172.16.0.0

 no auto-summary

!

ip nat pool teet 20.20.20.1 20.20.20.1 prefix-length 24

ip nat inside source list 1 pool teet overload

!

access-list 1 permit 192.168.1.0 0.0.0.255

!

之后，eigrp 和ospf的邻居关系都失去了。使用debug看，显示出一下信息：

*Sep  6 09:26:08.957: NAT: translation failed (A), dropping packet s=192.168.1.2 d=192.168.1.1

*Sep  6 09:26:10.153: NAT: translation failed (A), dropping packet s=192.168.1.2 d=224.0.0.10

*Sep  6 09:26:13.957: NAT: translation failed (A), dropping packet s=192.168.1.2 d=192.168.1.1

*Sep  6 09:26:14.633: NAT: translation failed (A), dropping packet s=192.168.1.2 d=224.0.0.10

*Sep  6 09:26:15.269: NAT: translation failed (A), dropping packet s=192.168.1.2 d=224.0.0.5

以上信息重复出现。

说明路由器自己outside接口发出的数据在地址翻译时失败，因而被丢弃。

那么修改ACL，

R3(config)#no access-list 1

R3(config)#access-list 1 deny host 192.168.1.2

R3(config)#access-list 1 deny host 192.168.1.0 0.0.0.255

察看访问列表：

R3#sh access-lists 

Standard IP access list 1

    10 deny   192.168.1.2 (23 matches)

    20 permit 192.168.1.0, wildcard bits 0.0.0.255

这样修改之后，就正常建立邻居，交换路由信息了。

R3#SH IP ROUTE 

     172.16.0.0/16 is variably subnetted, 6 subnets, 2 masks

C       172.16.4.0/24 is directly connected, Loopback0

C       172.16.5.0/24 is directly connected, Loopback1

R       172.16.0.0/29 [120/1] via 172.16.3.2, 00:00:06, FastEthernet0/0

D       172.16.1.0/24 [90/156160] via 192.168.1.1, 00:02:33, FastEthernet0/1

D       172.16.2.0/24 [90/30720] via 192.168.1.1, 00:02:33, FastEthernet0/1

C       172.16.3.0/24 is directly connected, FastEthernet0/0

C    192.168.1.0/24 is directly connected, FastEthernet0/1

R3#

笔者认为：outside接口发出的数据，本来就不应该翻译。因为地址翻译执行的前提是数据必须经由outside和inside接口，只经由一个接口不应该翻译。