6-华为防火墙：配置基于源IP地址的NAT

5、配置no-pat：
[SRG]nat address-group 1 202.100.1.10 202.100.1.20 //创建地址组
[SRG]nat-policy interzone trust untrust outbound //创建Zone间NAT策略
[SRG-nat-policy-interzone-trust-untrust-outbound]policy 0
[SRG-nat-policy-interzone-trust-untrust-outbound-0]policy source 192.168.1.0 mask 24 //需要转换的源地址段
[SRG-nat-policy-interzone-trust-untrust-outbound-0]address-group 1 no-pat //转换后的地址组，并且不转换到端口
[SRG-nat-policy-interzone-trust-untrust-outbound-0]action source-nat //执行源转换动作
测试：
<R2>telnet 202.100.1.1

查看防火墙会话转换：
[SRG]display firewall session table verbose //源端口50573，转换后端口依然是50573

查看防火墙Map：
[SRG]display firewall server-map

二：实验二：配置PAT，有外部地址池的端口转换
[SRG-nat-policy-interzone-trust-untrust-outbound-0]undo address-group
[SRG-nat-policy-interzone-trust-untrust-outbound-0]address-group 1
测试：
<R2>telnet 202.100.1.1
[SRG]display firewall session table verbose

三、实验三：配置Easy-IP，转换192.168.1.2到USG的g0/0/0接口地址
[SRG]nat-policy interzone trust untrust outbound
[SRG-nat-policy-interzone-trust-untrust-outbound-1]policy 0
[SRG-nat-policy-interzone-trust-untrust-outbound-0]undo address-group
[SRG-nat-policy-interzone-trust-untrust-outbound-0]easy-ip GigabitEthernet 0/0/0
测试：
[SRG]display firewall session table verbose

6-华为防火墙：配置基于源IP地址的NAT

原文：http://blog.51cto.com/13856092/2138637