【技术分享】双出口环境下私网用户通过NAPT访问Internet
发布作者：微思网络 发布时间：2023-06-08 浏览量：0次
如图1所示，某企业在网络边界处部署了FW作为安全网关，并分别从运营商ISP1和ISP2处购买了宽带上网服务，实现内部网络接入Internet的需求。 研发部门和市场部门中的PC可以通过运营商ISP1和ISP2访问Internet，要求去往特定目的地址的流量必须经由相应的运营商来转发。 当一条链路出现故障时，流量可以被及时切换到另一条链路上，避免业务中断。 配置接口IP地址和安全区域，完成网络基本参数配置。 配置安全策略，允许私网指定网段与Internet进行报文交互。 配置NAT地址池。 配置源NAT策略，实现私网指定网段访问Internet时自动进行源地址转换。 配置静态路由。
本举例中假设某企业从运营商ISP1和ISP2获取了如下信息，这些信息仅供举例使用，实际配置时请从当地运营商获取。# 配置接口GigabitEthernet 0/0/1的IP地址。
<FW> system-view
[FW] interface GigabitEthernet 0/0/1
[FW-GigabitEthernet 0/0/1] ip address 1.1.1.1 24
[FW-GigabitEthernet 0/0/1] quit
# 配置接口GigabitEthernet 0/0/3的IP地址。
[FW] interface GigabitEthernet 0/0/3
[FW-GigabitEthernet 0/0/3] ip address 10.3.0.1 24
[FW-GigabitEthernet 0/0/3] quit
# 配置接口GigabitEthernet 0/0/7的IP地址。
[FW] interface GigabitEthernet 0/0/7
[FW-GigabitEthernet 0/0/7] ip address 2.2.2.2 24
[FW-GigabitEthernet 0/0/7] quit
# 将接口GigabitEthernet 0/0/3加入Trust区域。
[FW] firewall zone trust
[FW-zone-trust] add interface GigabitEthernet 0/0/3
[FW-zone-trust] quit
# 将接口GigabitEthernet 0/0/1加入isp1区域。
[FW] firewall zone name isp1
[FW-zone-isp1] set priority 10
[FW-zone-isp1] add interface GigabitEthernet 0/0/1
[FW-zone-isp1] quit
# 将接口GigabitEthernet 0/0/7加入isp2区域。
[FW] firewall zone name isp2
[FW-zone-isp2] set priority 20
[FW-zone-isp2] add interface GigabitEthernet 0/0/7
[FW-zone-isp2] quit[FW] security-policy
[FW-policy-security] rule name policy1
[FW-policy-security-rule-policy1] source-zone trust
[FW-policy-security-rule-policy1] destination-zone isp1
[FW-policy-security-rule-policy1] source-address 10.3.0.0 24
[FW-policy-security-rule-policy1] action permit
[FW-policy-security-rule-policy1] quit
[FW-policy-security] rule name policy2
[FW-policy-security-rule-policy2] source-zone trust
[FW-policy-security-rule-policy2] destination-zone isp2
[FW-policy-security-rule-policy2] source-address 10.3.0.0 24
[FW-policy-security-rule-policy2] action permit
[FW-policy-security-rule-policy2] quit
[FW-policy-security] quit[FW] nat address-group addressgroup1
[FW-address-group-addressgroup1] mode pat
[FW-address-group-addressgroup1] section 0 1.1.1.10 1.1.1.12
[FW-address-group-addressgroup1] route enable
[FW-address-group-addressgroup1] quit
[FW] nat address-group addressgroup2
[FW-address-group-addressgroup2] mode pat
[FW-address-group-addressgroup2] section 0 2.2.2.10 2.2.2.12
[FW-address-group-addressgroup2] route enable
[FW-address-group-addressgroup2] quit[FW] nat-policy
[FW-policy-nat] rule name policy_nat1
[FW-policy-nat-rule-policy_nat1] source-zone trust
[FW-policy-nat-rule-policy_nat1] destination-zone isp1
[FW-policy-nat-rule-policy_nat1] source-address 10.3.0.0 24
[FW-policy-nat-rule-policy_nat1] action source-nat address-group addressgroup1
[FW-policy-nat-rule-policy_nat1] quit
[FW-policy-nat] rule name policy_nat2
[FW-policy-nat-rule-policy_nat2] source-zone trust
[FW-policy-nat-rule-policy_nat2] destination-zone isp2
[FW-policy-nat-rule-policy_nat2] source-address 10.3.0.0 24
[FW-policy-nat-rule-policy_nat2] action source-nat address-group addressgroup2
[FW-policy-nat-rule-policy_nat2] quit
[FW-policy-nat] quit[FW] ip route-static 1.1.2.0 24 1.1.1.254
[FW] ip route-static 1.1.3.0 24 1.1.1.254
[FW] ip route-static 2.2.3.0 24 2.2.2.254
[FW] ip route-static 2.2.4.0 24 2.2.2.254
