某局點過設備NAT轉發異常

不涉及

設備MSR3620在出口位置，做了NAT Server，將內網一台服務器映射到公網，服務器提供了WEB服務，在WEB上可以訪問服務器上的虛機，虛機地址和服務器地址一樣，但是端口不同

interface Ten-GigabitEthernet0/X

ip address X.X.X.X 255.255.255.252

nat outbound

nat server protocol tcp global current-interface A inside 192.168.1.D 443

nat server protocol tcp global current-interface B inside 192.168.1.D Y

nat server protocol tcp global current-interface C inside 192.168.1.D Z

在公網訪問測試，能打開WEB界麵，但是訪問WEB上的虛機時無法連接。

在內網通過WEB界麵訪問虛機正常，說明服務器是正常的，虛機也是正常的，在設備debug，看到訪問過程是正常的：

<H3C>*Nov 18 19:07:26:139 2024 H3C IPFW/7/IPFW_PACKET:

Receiving, interface = Ten-GigabitEthernet0/X

version = 4, headlen = 20, tos = 4

pktlen = 52, pktid = 35599, offset = 0, ttl = 112, protocol = 6

checksum = 34526, s = 221.12.4.143, d = X.X.X.X

channelID = 0, vpn-InstanceIn = 0, vpn-InstanceOut = 0.

VsysID = 1

prompt: Receiving IP packet from interface Ten-GigabitEthernet0/X.

Payload: TCP

  source port = 62060, destination port = B

  sequence num = 0xc0427819, acknowledgement num = 0x00000000, flags = 0x2

  window size = 64240, checksum = 0x8881, header length = 32.

*Nov 18 19:07:26:139 2024 H3C NAT/7/COMMON:

 PACKET: (Ten-GigabitEthernet0/20-in-config) Protocol: TCP

    221.12.4.143:62060 -   X.X.X.X:B(VPN:    0)(vsys:    1) ------>

    221.12.4.143:62060 -   192.168.1.D: Y(VPN:    0)(vsys:    1)

*Nov 18 19:07:26:140 2024 H3C IPFW/7/IPFW_PACKET:

Sending, interface = Vlan-interface1

version = 4, headlen = 20, tos = 4

pktlen = 52, pktid = 35599, offset = 0, ttl = 111, protocol = 6

checksum = 56483, s = 221.12.4.143, d = 192.168.1.D

channelID = 0, vpn-InstanceIn = 0, vpn-InstanceOut = 0.

VsysID = 1

prompt: Sending IP packet received from interface Ten-GigabitEthernet0/X at interface Vlan-interface1.

Payload: TCP

  source port = 62060, destination port = Y

  sequence num = 0xc0427819, acknowledgement num = 0x00000000, flags = 0x2

  window size = 64240, checksum = 0x9905, header length = 32.

*Nov 18 19:07:26:140 2024 H3C IPFW/7/IPFW_PACKET:

Receiving, interface = Vlan-interface1

version = 4, headlen = 20, tos = 0

pktlen = 52, pktid = 0, offset = 0, ttl = 64, protocol = 6

checksum = 38583, s = 192.168.1.D, d = 221.12.4.143

channelID = 0, vpn-InstanceIn = 0, vpn-InstanceOut = 0.

VsysID = 1

prompt: Receiving IP packet from interface Vlan-interface1.

Payload: TCP

  source port = Y, destination port = 62060

  sequence num = 0xca824f67, acknowledgement num = 0xc042781a, flags = 0x12

  window size = 29200, checksum = 0x0738, header length = 32.

*Nov 18 19:07:26:140 2024 H3C NAT/7/COMMON:

 PACKET: (Ten-GigabitEthernet0/X-out-session) Protocol: TCP

   192.168.1.D: Y -    221.12.4.143:62060(VPN:    0)(vsys:    1) ------>

   X.X.X.X:B -    221.12.4.143:62060(VPN:    0)(vsys:    1)

*Nov 18 19:07:26:140 2024 H3C IPFW/7/IPFW_PACKET:

Sending, interface = Ten-GigabitEthernet0/X

version = 4, headlen = 20, tos = 0

pktlen = 52, pktid = 0, offset = 0, ttl = 63, protocol = 6

checksum = 17138, s = X.X.X.X, d = 221.12.4.143

channelID = 0, vpn-InstanceIn = 0, vpn-InstanceOut = 0.

VsysID = 1

prompt: Sending IP packet received from interface Vlan-interface1 at interface Ten-GigabitEthernet0/X.

Payload: TCP

  source port = B, destination port = 62060

  sequence num = 0xca824f67, acknowledgement num = 0xc042781a, flags = 0x12

  window size = 29200, checksum = 0xf81b, header length = 32.

進一步在內網測試，發現通過軟件登錄時，使用了443端口，而非Y端口，所以懷疑通過WEB訪問時，被重定向到了一個內網端口，從公網發起訪問時，沒有訪問到真正的服務，為驗證猜測，在接口下新增如下配置，轉換時端口不變，新增配置後測試訪問正常。

nat server protocol tcp global current-interface Y inside 192.168.1.D Y

nat server protocol tcp global current-interface Z inside 192.168.1.D Z

內網服務器WEB上訪問虛機經過了一次端口跳轉，且跳轉的是內網真實端口，所以該端口也需要在公網進行映射。