>Покажи весь конфиг...
!
version 12.2
!
aaa new-model
!
!
aaa authentication ppp default group radius local
aaa authorization network default if-authenticated
aaa session-id common
ip subnet-zero
no ip rcmd domain-lookup
!
vpdn enable
!
vpdn-group 1
! Default PPTP VPDN group
accept-dialin
protocol pptp
virtual-template 1
!
!
!
interface Ethernet0/0
ip address X.X.X.X 255.255.255.252
ip access-group 101 in
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip route-cache flow
no ip mroute-cache
half-duplex
no cdp enable
crypto map zzz
!
interface FastEthernet0/0
no ip address
ip accounting output-packets
speed auto
full-duplex
no cdp enable
!
interface FastEthernet0/0.1
encapsulation dot1Q 1 native
ip address 192.168.10.1 255.255.255.0
ip accounting output-packets
ip nat inside
no cdp enable
!
interface FastEthernet0/0.2
encapsulation dot1Q 2
ip address 192.168.20.1 255.255.255.0
ip access-group 120 in
ip accounting output-packets
ip nat inside
no cdp enable
!
interface Virtual-Template1
ip unnumbered Ethernet0/0
peer default ip address pool vpdnpool
compress mppc
ppp encrypt mppe auto required
ppp authentication ms-chap ms-chap-v2
!
ip local pool vpdnpool 192.168.10.150 192.168.10.160
ip nat inside source route-map nat interface Ethernet0/0 overload
ip classless
ip route 0.0.0.0 0.0.0.0 X.X.X.Y
no ip http server
no ip http secure-server
ip flow-export version 5
ip flow-export destination 192.168.10.190 9996
!
route-map nat permit 10
match ip address 114
!
radius-server host 192.168.10.198 auth-port 1645 acct-port 1646
radius-server key cisco
radius-server authorization permit missing Service-Type
!
access-list 101 permit ip 192.168.0.0 0.0.0.255 192.168.10.0 0.0.0.255
access-list 101 permit ip 192.168.11.0 0.0.0.255 192.168.10.0 0.0.0.255
access-list 101 deny ip 192.168.0.0 0.0.255.255 any
access-list 101 deny ip host 0.0.0.0 any
access-list 101 deny ip 10.0.0.0 0.255.255.255 any
access-list 101 deny ip 172.16.0.0 0.15.255.255 any
access-list 101 deny ip 127.0.0.0 0.255.255.255 any
access-list 101 permit ip any any
access-list 114 deny ip 192.168.10.0 0.0.0.255 192.168.0.0 0.0.0.255
access-list 114 deny ip 192.168.10.0 0.0.0.255 192.168.11.0 0.0.0.255
access-list 114 permit ip 192.168.10.0 0.0.0.255 any
access-list 114 permit ip 192.168.20.0 0.0.0.255 any
access-list 120 deny ip 192.168.20.0 0.0.0.255 192.168.10.0 0.0.0.255
access-list 120 permit ip 192.168.20.0 0.0.0.255 any
В другом месте конфиг такой же, только внутри сетка 192.168.1.0/24
Адреса выдаются VPDN-щикам правильные, из указанного пула, внутренние подсети доступны без проблем, но натиться и выходить наружу эти адреса не хотят.
