a4ekWK,H3C F1000-AK1160怎么做端口映射？
问题描述：
如图：
F1000-AK1160没有NAT--NAT内部服务器，这种的要怎么做公网端口映射？
组网及组网描述：
无
12小时前提问https://www.h3c.com/cn/Service/Document_Software/Document_Center/IP_Security/FW_VPN/F1000-AK/default.htm?category=590044&subcategory=590046&subcategory3=716340
有配置指导的
12小时前回答有没有1对1nat转换配置了？
确定需要映射的内部服务器的IP地址和端口号； 在F1000-AK1160中创建一个端口映射规则，将公网IP地址和端口号映射到内部服务器的IP地址和端口号； 确认F1000-AK1160的防火墙设置允许公网流量传输到内部服务器； 测试端口映射是否成功，可以使用外部网络连接到公网IP地址和端口号，确认能否访问到内部服务器。需要注意的是，在没有NAT的情况下，公网IP地址直接暴露在网络中，安全风险较高，需要加强安全措施，如设置访问控制列表、启用端口扫描检测等。
12小时前回答web界面怎么操作了？
那就命令行呗。
12小时前回答加微15069770019帮解决
爱爬杆的小石头丶新建一个策略 做目的地址转换
10小时前回答您好，请知：
可以使用nat server将内部服务器映射到外网。
以下是配置举例，请参考：
2.13.3 外网用户通过外网地址访问内网服务器配置举例
1. 组网需求
某公司内部对外提供Web、FTP和SMTP服务，而且提供两台Web服务器。公司内部网址为10.110.0.0/16。其中，内部FTP服务器地址为10.110.10.3/16，内部Web服务器1的IP地址为10.110.10.1/16，内部Web服务器2的IP地址为10.110.10.2/16，内部SMTP服务器IP地址为10.110.10.4/16。公司拥有
· 外部的主机可以访问内部的服务器。
· 选用
2. 组网图
图2-5 外网用户通过外网地址访问内网服务器配置组网图
3. 配置步骤
配置接口IP地址
# 根据组网图中规划的信息，配置各接口的IP地址，具体配置步骤如下。
<Device> system-view
[Device] interface gigabitethernet 1/0/1
[Device-GigabitEthernet1/0/1] ip address 10.110.10.10 16
[Device-GigabitEthernet1/0/1] quit
请参考以上步骤配置其他接口的IP地址，具体配置步骤略。
将接口加入安全域
# 请根据组网图中规划的信息，将接口加入对应的安全域，具体配置步骤如下。
[Device] security-zone name trust
[Device-security-zone-Trust] import interface gigabitethernet 1/0/1
[Device-security-zone-Trust] quit
[Device] security-zone name untrust
[Device-security-zone-Untrust] import interface gigabitethernet 1/0/2
[Device-security-zone-Untrust] quit
配置安全策略
# 配置名称为untrust-trust的安全策略，保证Untrust安全域中的Host可以访问Trust安全域中的Server，具体配置步骤如下。
[Device] security-policy ip
[Device-security-policy-ip] rule name untrust-trust
[Device-security-policy-ip-1-untrust-trust] source-zone untrust
[Device-security-policy-ip-1-untrust-trust] destination-zone trust
[Device-security-policy-ip-1-untrust-trust] destination-ip-host 10.110.10.1
[Device-security-policy-ip-1-untrust-trust] destination-ip-host 10.110.10.2
[Device-security-policy-ip-1-untrust-trust] destination-ip-host 10.110.10.3
[Device-security-policy-ip-1-untrust-trust] destination-ip-host 10.110.10.4
[Device-security-policy-ip-1-untrust-trust] action pass
[Device-security-policy-ip-1-untrust-trust] quit
[Device-security-policy-ip] quit
(4) 配置NAT功能
# 配置服务对象组，提供FTP、Web和SMTP服务。
[Device] object-group service service1
[Device-obj-grp-service-service1] service tcp destination eq
[Device-obj-grp-service-service1] quit
[Device] object-group service service2
[Device-obj-grp-service-service2] service tcp destination eq 80
[Device-obj-grp-service-service2] quit
[Device] object-group service service3
[Device-obj-grp-service-service3] service tcp destination eq 8080
[Device-obj-grp-service-service3] quit
[Device] object-group service service4
[Device-obj-grp-service-service4] service tcp destination eq 25
[Device-obj-grp-service-service4] quit
# 配置全局NAT规则，允许外网主机访问内网服务器。
[Device] nat global-policy
[Device-nat-global-policy] rule name rule1
[Device-nat-global-policy-rule-rule1] destination-ip host
[Device-nat-global-policy-rule-rule1] source-zone untrust
[Device-nat-global-policy-rule-rule1] service service1
[Device-nat-global-policy-rule-rule1] action dnat ip-address 10.110.10.3 local-port
[Device-nat-global-policy-rule-rule1] quit
[Device-nat-global-policy] rule name rule2
[Device-nat-global-policy-rule-rule2] destination-ip host
[Device-nat-global-policy-rule-rule2] source-zone untrust
[Device-nat-global-policy-rule-rule2] service service2
[Device-nat-global-policy-rule-rule2] action dnat ip-address 10.110.10.1 local-port 80
[Device-nat-global-policy-rule-rule2] quit
[Device-nat-global-policy] rule name rule3
[Device-nat-global-policy-rule-rule3] destination-ip host
[Device-nat-global-policy-rule-rule3] source-zone untrust
[Device-nat-global-policy-rule-rule3] service service3
[Device-nat-global-policy-rule-rule3] action dnat ip-address 10.110.10.2 local-port 80
[Device-nat-global-policy-rule-rule3] quit
[Device-nat-global-policy] rule name rule4
[Device-nat-global-policy-rule-rule4] destination-ip host
[Device-nat-global-policy-rule-rule4] source-zone untrust
[Device-nat-global-policy-rule-rule4] service service4
[Device-nat-global-policy-rule-rule4] action dnat ip-address 10.110.10.4 local-port 25
[Device-nat-global-policy-rule-rule4] quit
[Device-nat-global-policy] quit
4. 验证配置
# 以上配置完成后，外网Host能够通过NAT地址访问各内网服务器。通过查看如下显示信息，可以验证以上配置成功。
[Device] display nat all
NAT global-policy information:
Totally 4 NAT global-policy rules.
Rule name: rule1
Type : nat
DestIP address :
Source-zone name : untrust
Service object group : service1
DNAT action:
IPv4 address: 10.110.10.3
Port:
NAT counting : 0
Config status: Active
Rule name: rule2
Type : nat
DestIP address :
Source-zone name : untrust
Destination-zone name : trust
Service object group : service2
DNAT action:
IPv4 address: 10.110.10.1
Port: 80
NAT counting : 0
Config status: Active
Rule name: rule3
Type : nat
DestIP address :
Source-zone name : untrust
Destination-zone name : trust
Service object group : service3
DNAT action:
IPv4 address: 10.110.10.2
Port: 80
NAT counting : 0
Config status: Active
Rule name: rule4
Type : nat
DestIP address :
Source-zone name : untrust
Destination-zone name : trust
Service object group : service4
DNAT action:
IPv4 address: 10.110.10.4
Port: 25
NAT counting : 0
Config status: Active
NAT logging:
Log enable : Disabled
Flow-begin : Disabled
Flow-end : Disabled
Flow-active : Disabled
Port-block-assign : Disabled
Port-block-withdraw : Disabled
Alarm : Disabled
NO-PAT IP usage : Disabled
NAT mapping behavior:
Mapping mode : Address and Port-Dependent
ACL : ---
Config status: Active
NAT ALG:
DNS : Enabled
FTP : Enabled
H323 : Disabled
ICMP-ERROR : Enabled
ILS : Disabled
MGCP : Disabled
NBT : Disabled
PPTP : Enabled
RTSP : Enabled
RSH : Disabled
SCCP : Disabled
SCTP : Disabled
SIP : Disabled
SQLNET : Disabled
TFTP : Disabled
XDMCP : Disabled
Static NAT load balancing: Disabled
NAT link-switch recreate-session: Disabled
NAT configuration-for-new-connection: Disabled
# 通过以下显示命令，可以看到Host访问FTP server时生成NAT会话信息。
[Device] display nat session verbose
Slot 1:
Initiator:
Source IP/port:
Destination IP/port:
DS-Lite tunnel peer: -
VPN instance/VLAN ID/Inline ID: -/-/-
Protocol: TCP(6)
Inbound interface: GigabitEthernet1/0/2
Source security zone: Untrust
Responder:
Source IP/port: 10.110.10.3/
Destination IP/port:
DS-Lite tunnel peer: -
VPN instance/VLAN ID/Inline ID: -/-/-
Protocol: TCP(6)
Inbound interface: GigabitEthernet1/0/1
Source security zone: Trust
State: TCP_ESTABLISHED
Application: FTP
Rule ID: -/-/-
Rule name:
Start time:
Initiator->Responder: 7 packets 313 bytes
Responder->Initiator: 6 packets 330 bytes
Total sessions found: 1
8小时前回答你点下网络菜单，看看有没有nat，如果也没有，可以命令行
2小时前回答你正在,H3C F1000-AK1160怎么做端口映射？
