防火墙NO-PAT地址转换

NO-PAT 是不做端口转换，只作IP地址转换，而NAPT是网络地址端口转换。

#防火墙的配置
#1、配置连接交换机的接口对应的IP
<SRG>system-view                                                                        
[SRG]int g0/0/1
[SRG-GigabitEthernet0/0/1]ip address 192.168.100.1 24
[SRG-GigabitEthernet0/0/1]quit

#2、配置连接公网的接口对应的IP
[SRG]int g0/0/2
[SRG-GigabitEthernet0/0/2]ip address 10.200.143.254 20
[SRG-GigabitEthernet0/0/2]quit

#3、配置缺省路由和回程路由
[SRG]ip route-static 0.0.0.0 0.0.0.0 10.200.143.253
[SRG]ip route-static 192.168.0.0 255.255.0.0 192.168.100.2

#4、配置域并开启域间策略

#信任区，添加内网接口
[SRG]firewall zone trust                  
[SRG-zone-trust]add int g0/0/1
[SRG-zone-trust]quit

# 非信任区，添加外网接口
[SRG]firewall zone untrust            
[SRG-zone-untrust]add int g0/0/2
[SRG-zone-untrust]quit

#开启了所有域的域间策略
[SRG]firewall packet-filter default permit all        

#5、配置NO-PAT地址转换
[SRG]nat address-group 1 10.200.128.1 10.200.143.250
[SRG]nat-policy interzone trust untrust outbound
[SRG-nat-policy-interzone-trust-untrust-outbound]policy 1
[SRG-nat-policy-interzone-trust-untrust-outbound-1]policy source 192.168.0.0 0.0.255.255
[SRG-nat-policy-interzone-trust-untrust-outbound-1]action source-nat
[SRG-nat-policy-interzone-trust-untrust-outbound-1]address-group 1 no-pat
[SRG-nat-policy-interzone-trust-untrust-outbound-1]quit