智能选路+NAT实验

拓扑信息：

1.IP配置

R2:

[r2]interface GigabitEthernet 0/0/0 [r2-GigabitEthernet0/0/0]ip address 13.0.0.3 24 [r2]interface GigabitEthernet 0/0/1 [r2-GigabitEthernet0/0/1]ip address 100.1.1.254 24 [r2]interface GigabitEthernet 0/0/2 [r2-GigabitEthernet0/0/2]ip address 110.1.1.254 24

R3:

[r3]interface GigabitEthernet 0/0/0 [r3-GigabitEthernet0/0/0]ip address 12.0.0.2 24 [r3]interface GigabitEthernet 0/0/1 [r3-GigabitEthernet0/0/1]ip address 210.1.1.254 24 [r3]interface GigabitEthernet 0/0/2 [r3-GigabitEthernet0/0/2]ip address 200.1.1.254 24

防火墙：

[FW]interface GigabitEthernet 1/0/0 [FW-GigabitEthernet1/0/0]ip address 192.168.1.254 24 [FW-GigabitEthernet1/0/0]interface GigabitEthernet 1/0/1 [FW-GigabitEthernet1/0/1]ip address 13.0.0.1 24 [FW-GigabitEthernet1/0/1]interface GigabitEthernet 1/0/2 [FW-GigabitEthernet1/0/2]ip address 12.0.0.1 24

2.安全区域划分： [FW]firewall zone trust [FW-zone-trust]add interface GigabitEthernet 1/0/0 [FW]firewall zone name untrust_1 [FW-zone-untrust_1]add interface GigabitEthernet 1/0/1 [FW]firewall zone name untrust_2 [FW-zone-untrust_2]add interface GigabitEthernet 1/0/2 3.导入地址库：

网络->路由->智能选路->运营商地址库->导入

4.配置链路接口：

网络->接口->链路接口->新建

 关闭链路接口的缺省路由下放功能，否则无法正常下放明细路由。

5.配置真实DNS服务器： [FW]slb enable [FW]slb [FW-slb]group 0 dns [FW-slb-group-0]metric roundrobin [FW-slb-group-0]rserver 0 rip 100.1.1.1 port 53 [FW-slb-group-0]rserver 1 rip 200.1.1.1 port 53 6.创建虚拟服务器，虚拟DNS服务器： [FW]slb [FW-slb]vserver 0 dns [FW-slb-vserver-0]vip 10.10.10.10 [FW-slb-vserver-0]group dns 7.配置DNS透明代理功能：

web界面：网络->DNS->DNS透明代理->DNS透明代理功能->启用

[FW]dns-transparent-policy [FW-policy-dns]dns transparent-proxy enable

将200.1.1.1和100.1.1.1的DNS的IP地址与出接口绑定 

[FW]dns-transparent-policy [FW-policy-dns]dns server bind interface GigabitEthernet 1/0/1 preferred 100.1.1.1 [FW-policy-dns]dns server bind interface GigabitEthernet 1/0/2 preferred 200.1.1.1  8.透明代理策略： [FW]dns-transparent-policy [FW-policy-dns]rule name dns_policy [FW-policy-dns-rule-dns_policy]source-address 192.168.1.0 24 [FW-policy-dns-rule-dns_policy]enable [FW-policy-dns-rule-dns_policy]action tpdns 9.配置安全策略：

10.配置NAT策略： [FW]nat-policy [FW-policy-nat]rule name policy1 [FW-policy-nat-rule-policy1]source-zone trust [FW-policy-nat-rule-policy1]destination-zone untrust_1 [FW-policy-nat-rule-policy1]source-address 192.168.1.0 24 [FW]nat-policy [FW-policy-nat]rule name policy2 [FW-policy-nat-rule-policy2]source-zone trust [FW-policy-nat-rule-policy2]destination-zone untrust_2 [FW-policy-nat-rule-policy2]source-address 192.168.1.0 24 11.测试：