GNS3 作PIX中的NAT时的问题

简单的网络拓扑

PC1—>SWITCH-->;PIX 802—>;OUTSIDE SWITCH—>OUTSIDE PC

PIX802的配置如下：

PIX Version 8.0(2)
!
hostname pixfirewall
enable passWord 8Ry2YjIyt7RRXU24 encrypted
names
!
interface Ethernet0
nameif outside
security-level 0
ip address 192.168.2.1 255.255.255.0
!
interface Ethernet1
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
!
interface Ethernet2
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet3
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet4
shutdown
no nameif
no security-level
no ip address
!
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
access-list permiticmp extended permit icmp any any
access-list permitnat1 extended permit ip host 192.168.1.2 host 192.168.2.2
pager lines 24
mtu outside 1500
mtu inside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 2.2.2.2 netmask 255.255.255.255
nat (inside) 1 access-list permitnat1
access-group permiticmp in interface outside
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mGCp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
no crypto isakmp nat-traversal
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
!
!
prompt hostname context
Cryptochecksum:00000000000000000000000000000000
: end

注意到公网的IP网段是192.168.2.0/24,然而NAT转化后的IP是2.2.2.2与公网是不同的网段，可以最后测试时，竟然可以PING 通？？

请问各位对此有什么见解？？

最后看到的解决方案：

Http://www.cisco.com/en/US/products/hw/***devc/ps2030/products_tech_note09186a0080094aad.shtml

Troubleshoot

This section provides infORMation you can use to troubleshoot your configuration.

• If you use ICMP pings to test a configured translation, the pings are likely to fail and make it seem as though the translation is not working. By default, the PIX blocks ICMP messages from lower security interfaces to higher security interfaces. This occurs even if the echo-reply is in response to a ping initiated from the inside. As a result, be sure to use another method, like Telnet, to verify your configuration.

• After you make any changes to translation rules on the PIX it is strongly encouraged that the clear xlate command be issued. This ensures that any old translations do not interfere with newly configured ones and cause them to operate incorrectly.

• After you configure or change static translations between servers on the inside or DMZ and the outside, it might be necessary to clear the ARP cache of the gateway router or other next-hop device.

•  

• 本文的由于前期理解不深，上面所有的论述大部分不正确，根据NAT的四个表，映射最后还是通过路由来传递，只是IP的源与目的的改变；

•  

•  
• 最新补充。终结版