配置vrf NAT

noteId: WEB8fc3ea05e6cfcb76d316f9672219aed2 · 原始路径：/ALL/网络 - C模块/VRF/配置vrf NAT.note

1、vrf 配置 NAT：

要配置一条vrf的默认路由，指到公网，否则vrf路由到了网关会因为没有路由而丢弃ip route vrf SHANGHAI2026 0.0.0.0 0.0.0.0 150.1.5.1 globalint g0/1 ip nat insideint g0/2 ip nat outside# ACL 正常匹配vrf路由，但是要注意，如果有MPLS VPN，那么要先deny去往MPLS（其他vrf）的流量，否则它们会被vrf匹配上ip access-list extended NAT deny ip 172.16.2.0 0.0.0.255 192.168.10.0 0.0.0.255 deny ip 172.16.2.0 0.0.0.255 192.168.20.0 0.0.0.255 deny ip 172.16.2.0 0.0.0.255 192.168.0.0 0.0.0.255 deny ip 172.16.2.0 0.0.0.255 192.168.1.0 0.0.0.255 deny ip 172.16.2.0 0.0.0.255 172.16.1.0 0.0.0.255 permit ip 172.16.2.0 0.0.0.255 any# 配置NATip nat pool NAT 100.64.4.1 100.64.4.1 netmask 255.255.255.252ip nat inside source list NAT pool NAT vrf SHANGHAI2026 overload或：ip nat inside source list NAT interface g0/2 vrf SHANGHAI2026 overload