■Cisco 1812JにPATを設定する(IPマスカレード)
普通のルータのように振る舞う最低限の設定
Client 172.31.31.0/24 --> (Fa1)172.31.31.254/32(Fa0)10.10.10.10/24 --> WAN 10.10.10.254/24
■debian1側をClientとして172.31.31.10/24のIPを割り当て
$ sudo /sbin/ifconfig eth2 172.31.31.10/24 up
■1812J側のFa1を172.31.31.254(inside)に。
R1>enable
Password:
R1#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
R1#show running-config | section interface FastEthernet1
interface FastEthernet1
no ip address
shutdown
duplex auto
speed auto
R1#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#interface fastEthernet 1
R1(config-if)#ip nat inside
R1(config-if)#ip address 172.31.31.254 255.255.255.0
R1(config-if)#no shutdown
R1(config-if)#end
R1#show running-config | section interface FastEthernet1
interface FastEthernet1
ip address 172.31.31.254 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
■ClientとFa1との疎通を確認
$ ping -c 2 172.31.31.254
PING 172.31.31.254 (172.31.31.254) 56(84) bytes of data.
64 bytes from 172.31.31.254: icmp_req=1 ttl=255 time=0.515 ms
64 bytes from 172.31.31.254: icmp_req=2 ttl=255 time=0.482 ms
--- 172.31.31.254 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 999ms
rtt min/avg/max/mdev = 0.482/0.498/0.515/0.027 ms
R1#ping 172.31.31.10
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.31.31.10, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
■Fa0を10.10.10.10/32(outside)に。
R1#show running-config | section interface FastEthernet0
interface FastEthernet0
no ip address
shutdown
duplex auto
speed auto
R1#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#interface fastEthernet 0
R1(config-if)#ip nat outside
R1(config-if)#ip address 10.10.10.10 255.255.255.0
R1(config-if)#no cdp enable
R1(config-if)#end
R1#show running-config | section interface FastEthernet0
interface FastEthernet0
ip address 10.10.10.10 255.255.255.0
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
no cdp enable
R1#ping 10.10.10.10
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.10.10, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
■debian2を10.10.10.254/24(WAN)に。
$ sudo /sbin/ifconfig eth2 10.10.10.254/24 up
$ ping -c 2 10.10.10.10
PING 10.10.10.10 (10.10.10.10) 56(84) bytes of data.
64 bytes from 10.10.10.10: icmp_req=1 ttl=255 time=0.597 ms
64 bytes from 10.10.10.10: icmp_req=2 ttl=255 time=0.521 ms
--- 10.10.10.10 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 999ms
rtt min/avg/max/mdev = 0.521/0.559/0.597/0.038 ms
■この状態だとルーティングを設定しても到達しない。
$ sudo route add -net 10.10.10.0/24 gw 172.31.31.254
$ ping -c 2 10.10.10.254
PING 10.10.10.254 (10.10.10.254) 56(84) bytes of data.
--- 10.10.10.254 ping statistics ---
2 packets transmitted, 0 received, 100% packet loss, time 1008ms
$ sudo route add -net 172.31.31.0/24 gw 10.10.10.10
$ ping -c 2 172.31.31.10
PING 172.31.31.10 (172.31.31.10) 56(84) bytes of data.
--- 172.31.31.10 ping statistics ---
2 packets transmitted, 0 received, 100% packet loss, time 1999ms
■WANという名前でoverloadを定義する。
R1#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#ip nat pool WAN 172.31.31.253 172.31.31.253 prefix 24
R1(config)#ip nat inside source list 7 pool WAN overload
R1(config)#access-list 7 permit 172.31.31.0 0.0.0.255
R1(config)#end
■debian2のWAN側でのパケットキャプチャ
WAN側にはCDPパケットが流れない。
22:30:23.725723 IP 172.31.31.10 > 10.10.10.254: ICMP echo request, id 7659, seq 1, length 64
22:30:23.725762 IP 10.10.10.254 > 172.31.31.10: ICMP echo reply, id 7659, seq 1, length 64
22:30:24.725051 IP 172.31.31.10 > 10.10.10.254: ICMP echo request, id 7659, seq 2, length 64
22:30:24.725071 IP 10.10.10.254 > 172.31.31.10: ICMP echo reply, id 7659, seq 2, length 64
■debian1のClient側でのパケットキャプチャ
Client側にもCisco製品が無ければCDPパケットは不要。頻度は1回/分
22:35:05.619283 IP 172.31.31.10 > 10.10.10.254: ICMP echo request, id 7733, seq 1, length 64
22:35:05.619906 IP 10.10.10.254 > 172.31.31.10: ICMP echo reply, id 7733, seq 1, length 64
22:35:06.620345 IP 172.31.31.10 > 10.10.10.254: ICMP echo request, id 7733, seq 2, length 64
22:35:06.621007 IP 10.10.10.254 > 172.31.31.10: ICMP echo reply, id 7733, seq 2, length 64
22:35:07.248698
22:35:17.248985
22:35:27.249263
22:35:29.585362 CDPv2, ttl: 180s, Device-ID 'R1.localdomain', length 342
22:35:37.249541
22:35:47.249820
22:35:57.250100
22:36:07.250403
22:36:17.250658
22:36:27.250938
22:36:29.587027 CDPv2, ttl: 180s, Device-ID 'R1.localdomain', length 342
■Fa1側を一度停止
R1#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
R1(config-if)#shutdown
R1(config-if)#end
R1#
May 9 23:35:20.303: %LINK-5-CHANGED: Interface FastEthernet1, changed state to administratively down
May 9 23:35:21.303: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet1, changed state to down
■クライアント側は24bitマスクなので、IP設定を変えてみる。
$ env LANG=C /sbin/ifconfig eth2 | grep inet | awk '{print $2,$4}'
addr:172.31.31.10 Mask:255.255.255.0
$ sudo /sbin/ifconfig eth2 172.31.31.11/24 up
$ env LANG=C /sbin/ifconfig eth2 | grep inet | awk '{print $2,$4}'
addr:172.31.31.11 Mask:255.255.255.0
$ sudo route add -net 10.10.10.0/24 gw 172.31.31.254
■Fa1側を再開
R1#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#interface fastEthernet 1
R1(config-if)#end
May 9 23:35:39.795: %LINK-3-UPDOWN: Interface FastEthernet1, changed state to up
May 9 23:35:57.915: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet1, changed state to up
■debian1側からの確認
$ ping -c 2 10.10.10.254
PING 10.10.10.254 (10.10.10.254) 56(84) bytes of data.
64 bytes from 10.10.10.254: icmp_req=1 ttl=63 time=2.02 ms
64 bytes from 10.10.10.254: icmp_req=2 ttl=63 time=0.712 ms
--- 10.10.10.254 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 0.712/1.368/2.025/0.657 ms
■debian2側からの確認
$ ping -c 2 172.31.31.11
PING 172.31.31.11 (172.31.31.11) 56(84) bytes of data.
64 bytes from 172.31.31.254: icmp_req=1 ttl=63 time=0.788 ms
64 bytes from 172.31.31.254: icmp_req=2 ttl=63 time=0.672 ms
--- 172.31.31.11 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 999ms
rtt min/avg/max/mdev = 0.672/0.730/0.788/0.058 ms
■debian1側にeth3を設定
$ sudo /sbin/ifconfig eth3 172.31.31.12/24 up
$ ping -c 2 172.31.31.254
PING 172.31.31.254 (172.31.31.254) 56(84) bytes of data.
64 bytes from 172.31.31.254: icmp_req=1 ttl=255 time=1.61 ms
64 bytes from 172.31.31.254: icmp_req=2 ttl=255 time=0.510 ms
--- 172.31.31.254 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 0.510/1.063/1.616/0.553 ms
$ ping -c 2 10.10.10.254
PING 10.10.10.254 (10.10.10.254) 56(84) bytes of data.
64 bytes from 10.10.10.254: icmp_req=1 ttl=63 time=0.920 ms
64 bytes from 10.10.10.254: icmp_req=2 ttl=63 time=0.702 ms
--- 10.10.10.254 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 0.702/0.811/0.920/0.109 ms
■VLAN側には172.31.30.254/24(inside)に設定
Fa2～9のインターフェイスに直接「ip nat」コマンドは使えないが、
VLANであれば使える。
R1#show running-config | section interface Vlan1
interface Vlan1
no ip address
R1#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#interface vlan 1
R1(config-if)#ip nat inside
R1(config-if)#ip address 172.31.30.254 255.255.255.0
R1(config)#access-list 7 permit 172.31.30.1 0.0.0.254
R1(config)#end
■debian1のeth3のIP設定を変更
$ sudo /sbin/ifconfig eth3 172.31.30.30/24 up
$ sudo route add -net 10.10.10.0/24 gw 172.31.30.254
$ ping -c 2 172.31.30.254
PING 172.31.30.254 (172.31.30.254) 56(84) bytes of data.
64 bytes from 172.31.30.254: icmp_req=1 ttl=255 time=2.51 ms
64 bytes from 172.31.30.254: icmp_req=2 ttl=255 time=0.727 ms
--- 172.31.30.254 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 0.727/1.619/2.512/0.893 ms
$ ping -c 2 10.10.10.10
PING 10.10.10.10 (10.10.10.10) 56(84) bytes of data.
64 bytes from 10.10.10.10: icmp_req=1 ttl=255 time=1.39 ms
64 bytes from 10.10.10.10: icmp_req=2 ttl=255 time=0.748 ms
--- 10.10.10.10 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 0.748/1.069/1.390/0.321 ms
■debian2側にルーティング設定
$ sudo route add -net 172.31.30.0/24 gw 10.10.10.10
■debian1側からWAN側へ。
$ ping -c 2 10.10.10.254
PING 10.10.10.254 (10.10.10.254) 56(84) bytes of data.
64 bytes from 10.10.10.254: icmp_req=1 ttl=63 time=1.59 ms
64 bytes from 10.10.10.254: icmp_req=2 ttl=63 time=1.73 ms
--- 10.10.10.254 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 1.596/1.665/1.734/0.069 ms
■ここまで分かればFa1は外せる。
