华为路由交换由浅入深系列(十二):ENSP2.0

模拟NAT+Firewall+DNS+DHCP功能ENSP2.
0模拟NAT+Firewall+DNS+DHCP功能,主要涉及在华为路由器上面,如何实现防火墙特性、NAT、DNS、DHCP功能.
掌握目标1、路由器DHCP客户端配置(模拟PC)2、防火墙特性配置3、NAT配置4、DNS与DHCP的配置掌握一、实验拓扑:二、PC的配置#sysnamePCdhcpenablednsresolvednsserver8.
8.
8.
8#interfaceGigabitEthernet0/0/0ipaddressdhcp-alloc三、网关路由器的配置#sysnameGW#dhcpenablednsresolvednsserver8.
8.
8.
8#aclnumber3000rule5permitipsource192.
168.
10.
00.
0.
0.
255aclnumber3001rule5denyicmpicmp-typeechorule10permitip#firewallzonetrustpriority10#firewallzoneuntrustpriority5#firewallzoneLocalpriority15#firewallinterzonetrustuntrustfirewallenablepacket-filter3001inbounddetectaspfftpdetectaspfsipdetectaspfrtspdetectaspfhttpdetectaspfhttpjava-blockingdetectaspfhttpactivex-blocking#interfaceGigabitEthernet0/0/0ipaddress192.
168.
10.
1255.
255.
255.
0zonetrustdhcpselectinterfacedhcpserverdns-list8.
8.
8.
8#interfaceGigabitEthernet0/0/1ipaddress211.
1.
1.
2255.
255.
255.
0natoutbound3000zoneuntrust#iproute-static0.
0.
0.
00.
0.
0.
0GigabitEthernet0/0/1211.
1.
1.
1#user-interfacevty04authentication-modepasswordsetauthenticationpasswordcipherhuaweiuserprivilegelevel3四、公网路由器的配置#sysnameINTERNET#iphostwww.
baidu.
com100.
100.
100.
100iphostwww.
google.
com200.
200.
200.
200#dnsresolvednsserver8.
8.
8.
8dnsproxyenable#interfaceGigabitEthernet0/0/0ipaddress211.
1.
1.
1255.
255.
255.
0#interfaceNULL0#interfaceLoopBack0ipaddress100.
100.
100.
100255.
255.
255.
0#interfaceLoopBack1ipaddress200.
200.
200.
200255.
255.
255.
0#interfaceLoopBack100ipaddress8.
8.
8.
8255.
255.
255.
0#user-interfacevty04authentication-modepasswordsetauthenticationpasswordcipherhuaweiuserprivilegelevel3#五、测试PC上网pingwww.
google.
comPINGwww.
google.
com:56databytes,pressCTRL_CtobreakReplyfrom200.
200.
200.
200:bytes=56Sequence=1ttl=254time=20msReplyfrom200.
200.
200.
200:bytes=56Sequence=2ttl=254time=20msReplyfrom200.
200.
200.
200:bytes=56Sequence=3ttl=254time=10msReplyfrom200.
200.
200.
200:bytes=56Sequence=4ttl=254time=10msReplyfrom200.
200.
200.
200:bytes=56Sequence=5ttl=254time=30ms---www.
google.
compingstatistics---5packet(s)transmitted5packet(s)received0.
00%packetlossround-tripmin/avg/max=10/18/30mstelnetwww.
baidu.
comPressCTRL_]toquittelnetmodeTrying100.
100.
100.
100.
.
.
Connectedto100.
100.
100.
100.
.
.
LoginauthenticationPassword:huaweidisaccess-userInfo:Noonlineuser.
disipinterbri*down:administrativelydown^down:standby(l):loopback(s):spoofingThenumberofinterfacethatisUPinPhysicalis5ThenumberofinterfacethatisDOWNinPhysicalis1ThenumberofinterfacethatisUPinProtocolis5ThenumberofinterfacethatisDOWNinProtocolis1InterfaceIPAddress/MaskPhysicalProtocolGigabitEthernet0/0/0211.
1.
1.
1/24upupGigabitEthernet0/0/1unassigneddowndownLoopBack0100.
100.
100.
100/24upup(s)LoopBack1200.
200.
200.
200/24upup(s)LoopBack1008.
8.
8.
8/24upup(s)NULL0unassignedupup(s)六、测试网关的状态[GW]disnatsessionallNATSessionTableInformation:Protocol:ICMP(1)SrcAddrVpn:192.
168.
10.
254DestAddrVpn:200.
200.
200.
200TypeCodeIcmpId:0843997NAT-InfoNewSrcAddr:211.
1.
1.
2NewDestAddr:----NewIcmpId:10255Protocol:TCP(6)SrcAddrPortVpn:192.
168.
10.
25446273DestAddrPortVpn:100.
100.
100.
1005888NAT-InfoNewSrcAddr:211.
1.
1.
2NewSrcPort:10253NewDestAddr:----NewDestPort:----Protocol:UDP(17)SrcAddrPortVpn:192.
168.
10.
2547109DestAddrPortVpn:8.
8.
8.
813568NAT-Info[GW]disfirewallsessionallFirewallSessionTableInformation:Protocol:TCP(6)SrcAddrPortVpn:192.
168.
10.
25446273DestAddrPortVpn:100.
100.
100.
1005888Firewall-InfoInZone:trustOutZone:untrustProtocol:UDP(17)SrcAddrPortVpn:192.
168.
10.
2547109DestAddrPortVpn:8.
8.
8.
813568Firewall-InfoInZone:trustOutZone:untrustProtocol:UDP(17)SrcAddrPortVpn:192.
168.
10.
2542245DestAddrPortVpn:8.
8.
8.
813568Firewall-InfoInZone:trustOutZone:untrustProtocol:UDP(17)SrcAddrPortVpn:192.
168.
10.
25433990DestAddrPortVpn:8.
8.
8.
813568Firewall-InfoInZone:trustOutZone:untrustProtocol:UDP(17)SrcAddrPortVpn:192.
168.
10.
2544806DestAddrPortVpn:8.
8.
8.
813568Firewall-InfoInZone:trustOutZone:untrustProtocol:UDP(17)SrcAddrPortVpn:192.
168.
10.
2544038DestAddrPortVpn:8.
8.
8.
813568Firewall-InfoInZone:trustOutZone:untrustProtocol:TCP(6)SrcAddrPortVpn:192.
168.
10.
25421700DestAddrPortVpn:100.
100.
100.
1005888Firewall-Info博主也只是业余时间写写技术文档,请大家见谅,大家觉得不错的话,可以推荐给朋友哦,博主会努力推出更好的系列文档的.
如果大家有任何疑问或者文中有错误跟疏忽的地方,欢迎大家留言指出,博主看到后会第一时间修改,谢谢大家的支持,更多技术文章尽在网络之路博客,http://ccieh3c.
com.