不涉及
設備MSR3620在出口位置，做了NAT Server，將內網一台服務器映射到公網，服務器提供了WEB服務，在WEB上可以訪問服務器上的虛機，虛機地址和服務器地址一樣，但是端口不同
interface Ten-GigabitEthernet0/X
ip address X.X.X.X 255.255.255.252
nat outbound
nat server protocol tcp global current-interface A inside 192.168.1.D 443
nat server protocol tcp global current-interface B inside 192.168.1.D Y
nat server protocol tcp global current-interface C inside 192.168.1.D Z
在公網訪問測試，能打開WEB界麵，但是訪問WEB上的虛機時無法連接。
在內網通過WEB界麵訪問虛機正常，說明服務器是正常的，虛機也是正常的，在設備debug，看到訪問過程是正常的：
<H3C>*Nov 18 19:07:26:139 2024 H3C IPFW/7/IPFW_PACKET:
Receiving, interface = Ten-GigabitEthernet0/X
version = 4, headlen = 20, tos = 4
pktlen = 52, pktid = 35599, offset = 0, ttl = 112, protocol = 6
checksum = 34526, s = 221.12.4.143, d = X.X.X.X
channelID = 0, vpn-InstanceIn = 0, vpn-InstanceOut = 0.
VsysID = 1
prompt: Receiving IP packet from interface Ten-GigabitEthernet0/X.
Payload: TCP
source port = 62060, destination port = B
sequence num = 0xc0427819, acknowledgement num = 0x00000000, flags = 0x2
window size = 64240, checksum = 0x8881, header length = 32.
*Nov 18 19:07:26:139 2024 H3C NAT/7/COMMON:
PACKET: (Ten-GigabitEthernet0/20-in-config) Protocol: TCP
221.12.4.143:62060 - X.X.X.X:B(VPN: 0)(vsys: 1) ------>
221.12.4.143:62060 - 192.168.1.D: Y(VPN: 0)(vsys: 1)
*Nov 18 19:07:26:140 2024 H3C IPFW/7/IPFW_PACKET:
Sending, interface = Vlan-interface1
version = 4, headlen = 20, tos = 4
pktlen = 52, pktid = 35599, offset = 0, ttl = 111, protocol = 6
checksum = 56483, s = 221.12.4.143, d = 192.168.1.D
channelID = 0, vpn-InstanceIn = 0, vpn-InstanceOut = 0.
VsysID = 1
prompt: Sending IP packet received from interface Ten-GigabitEthernet0/X at interface Vlan-interface1.
Payload: TCP
source port = 62060, destination port = Y
sequence num = 0xc0427819, acknowledgement num = 0x00000000, flags = 0x2
window size = 64240, checksum = 0x9905, header length = 32.
*Nov 18 19:07:26:140 2024 H3C IPFW/7/IPFW_PACKET:
Receiving, interface = Vlan-interface1
version = 4, headlen = 20, tos = 0
pktlen = 52, pktid = 0, offset = 0, ttl = 64, protocol = 6
checksum = 38583, s = 192.168.1.D, d = 221.12.4.143
channelID = 0, vpn-InstanceIn = 0, vpn-InstanceOut = 0.
VsysID = 1
prompt: Receiving IP packet from interface Vlan-interface1.
Payload: TCP
source port = Y, destination port = 62060
sequence num = 0xca824f67, acknowledgement num = 0xc042781a, flags = 0x12
window size = 29200, checksum = 0x0738, header length = 32.
*Nov 18 19:07:26:140 2024 H3C NAT/7/COMMON:
PACKET: (Ten-GigabitEthernet0/X-out-session) Protocol: TCP
192.168.1.D: Y - 221.12.4.143:62060(VPN: 0)(vsys: 1) ------>
X.X.X.X:B - 221.12.4.143:62060(VPN: 0)(vsys: 1)
*Nov 18 19:07:26:140 2024 H3C IPFW/7/IPFW_PACKET:
Sending, interface = Ten-GigabitEthernet0/X
version = 4, headlen = 20, tos = 0
pktlen = 52, pktid = 0, offset = 0, ttl = 63, protocol = 6
checksum = 17138, s = X.X.X.X, d = 221.12.4.143
channelID = 0, vpn-InstanceIn = 0, vpn-InstanceOut = 0.
VsysID = 1
prompt: Sending IP packet received from interface Vlan-interface1 at interface Ten-GigabitEthernet0/X.
Payload: TCP
source port = B, destination port = 62060
sequence num = 0xca824f67, acknowledgement num = 0xc042781a, flags = 0x12
window size = 29200, checksum = 0xf81b, header length = 32.
進一步在內網測試，發現通過軟件登錄時，使用了443端口，而非Y端口，所以懷疑通過WEB訪問時，被重定向到了一個內網端口，從公網發起訪問時，沒有訪問到真正的服務，為驗證猜測，在接口下新增如下配置，轉換時端口不變，新增配置後測試訪問正常。
nat server protocol tcp global current-interface Y inside 192.168.1.D Y
nat server protocol tcp global current-interface Z inside 192.168.1.D Z
內網服務器WEB上訪問虛機經過了一次端口跳轉，且跳轉的是內網真實端口，所以該端口也需要在公網進行映射。