背景
與第三方機構對接時，採用nat的方式訪問。配置爲歷史遺留配置，前人測試通過後未正式部署。此次正式部署發現網絡不通，NAT也沒表項。
拓撲
以上圖作爲示意圖，圖中1.1.1.1轉換成2.2.2.72訪問3.3.3.3。R3上只有去2.2.2.72的路由。因此，在沒有NAT的情況下，1.1.1.1是無法訪問3.3.3.3的。
現象
1、在R1上用1.1.1.1作爲源ping R3的3.3.3.3。
R1#ping 3.3.3.3 source 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds:
Packet sent with a source address of 1.1.1.1
UUUUU
Success rate is 0 percent (0/5)
2、在R2上show ip nat translations沒有看到相關的表項。
過程
1、在R2上debug ip nat相關信息。
R2#debug ip nat
IP NAT debugging is on
R2#
May 20 22:34:48.567: NAT: translation failed (A), dropping packet s=1.1.1.1 d=3.3.3.3
May 20 22:34:48.667: NAT: translation failed (A), dropping packet s=1.1.1.1 d=3.3.3.3
May 20 22:34:48.771: NAT: translation failed (A), dropping packet s=1.1.1.1 d=3.3.3.3
May 20 22:34:48.875: NAT: translation failed (A), dropping packet s=1.1.1.1 d=3.3.3.3
*May 20 22:34:48.975: NAT: translation failed (A), dropping packet s=1.1.1.1 d=3.3.3.3
可以看到轉換失敗。說明故障點在NAT上。
加上detaild參數，尋找詳細信息。
R2#debug ip nat detailed
IP NAT detailed debugging is on
R2#
May 20 22:35:10.371: NAT: address not stolen for 1.1.1.1, proto 1 port 5
May 20 22:35:10.371: NAT: failed to allocate address for 1.1.1.1, list/map 110
May 20 22:35:10.371: NAT: Can't create new inside entry - forced_punt_flags: 0
May 20 22:35:10.379: NAT: address not stolen for 1.1.1.1, proto 1 port 5
May 20 22:35:10.379: NAT: failed to allocate address for 1.1.1.1, list/map 110
*May 20 22:35:10.379: NAT: translation failed (A), dropping packet s=1.1.1.1 d=3.3.3.3
以上詳細信息說明了轉換失敗的原因，看着感覺是地址耗盡。可是查看了NAT轉換表，作爲PAT這個轉換地址連一個條目都沒有。
檢查ACL發現有命中，檢查NAT的轉換信息，轉換都是miss條目。
R2#show ip access-lists
Extended IP access list 110
10 permit ip host 1.1.1.1 host 3.3.3.3 (51 matches)R2#show ip nat statistics
Total active translations: 0 (0 static, 0 dynamic; 0 extended)
Outside interfaces:
FastEthernet0/1
Inside interfaces:
FastEthernet0/0
Hits: 10 Misses: 0
CEF Translated packets: 10, CEF Punted packets: 25
Expired translations: 1
Dynamic mappings:
-- Inside Source
[Id: 1] access-list 110 pool pool-110 refcount 0
pool pool-110: netmask 255.255.255.248
start 2.2.2.72 end 2.2.2.72
type generic, total addresses 1, allocated 0 (0%), misses 50
nat-limit statistics:
max entry: max allowed 0, used 0, missed 0
原因
仔細檢查了下NAT的配置：
R2：
ip access list extend 110
10 permit ip host 1.1.1.1 host 3.3.3.3ip nat pool pool-110 2.2.2.72 2.2.2.72 netmask 255.255.255.248
ip nat inside source list 110 pool pool-110 overload
發現pool條目的掩碼是255.255.255.248，對於2.2.2.72而言，配合這個掩碼，這個地址就是個網絡地址，因此無法被正常轉換。
於是修改掩碼爲255.255.255.0，ping測試正常通過。
R1#ping 3.3.3.3 source 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds:
Packet sent with a source address of 1.1.1.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 92/125/148 ms
總結
在網絡配置過程中，每一個參數都有它獨特的意義。在NAT配置過程中，NAT地址的MASK往往是被忽略的一部分。然而，在本例中，就是因爲這個不起眼的參數導致了網絡不通。