Исходное сообщение
"Cisco 871 не правильный NAT" Отправлено vaxer, 19-Дек-09 15:53
просьба помочь разобраться! есть cisco 871 на локальных интерфейсах - dhcp 192.168.0.1 192.168.0.254 wan получает от провайдера по dhcp надо раздать инет в локалку и настроить VPN на внутренний адрес 192.168.0.6 R1#sh ver Cisco IOS Software, C870 Software (C870-ADVIPSERVICESK9-M), Version 12.4(15)T10, RELEASE SOFTWARE (fc3) R1#sh run Building configuration... Current configuration : 3988 bytes ! version 12.4 no service pad service timestamps debug datetime msec service timestamps log datetime msec service password-encryption service sequence-numbers ! hostname R1 ! boot-start-marker boot-end-marker ! logging buffered 51200 warnings logging console critical enable secret 5 $1vbnxfgkhfkghfghfGHFHFGH2I3k0 ! aaa new-model ! ! aaa authentication login default local aaa authorization exec default local ! ! aaa session-id common ! crypto pki trustpoint TP-self-signed-345753246 enrollment selfsigned subject-name cn=IOS-Self-Signed-Certificate-345753246 revocation-check none rsakeypair TP-self-signed-345753246 ! ! crypto pki certificate chain TP-self-signed-345753246 certificate self-signed 01 /// лишнее вырезано         quit dot11 syslog ip cef ! ! no ip dhcp use vrf connected ip dhcp excluded-address 192.168.0.13 192.168.0.254 ! ip dhcp pool sdm-pool1    import all    network 192.168.0.0 255.255.255.0    default-router 192.168.0.106 ! ! no ip domain lookup ip domain name swert.local ! multilink bundle-name authenticated ! ! username login1 privilege 15 secret 5 $1$o0ffghfsY%Ysyhsrhs5yehzdC1 username login2 privilege 15 secret 5 $1$CKWH$ghfx57xrthxr574susr5u6. ! ! archive log config   hidekeys ! ! ip tcp synwait-time 5 ! ! ! interface FastEthernet0 spanning-tree portfast ! interface FastEthernet1 spanning-tree portfast ! interface FastEthernet2 spanning-tree portfast ! interface FastEthernet3 spanning-tree portfast ! interface FastEthernet4 ip address dhcp ip access-group 101 in ip nat outside ip virtual-reassembly duplex auto speed auto ! interface Vlan1 ip address 192.168.0.106 255.255.255.0 ip access-group 100 in ip nat inside ip virtual-reassembly ! ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 FastEthernet4 ! ! ip http server ip http access-class 23 ip http authentication local ip http secure-server ip nat pool Internet 79.165.80.1 79.165.95.254 netmask 255.255.240.0 ip nat inside source list 10 pool Internet overload ip nat inside source list 100 interface FastEthernet4 overload ! access-list 10 permit 192.168.5.0 0.0.0.255 access-list 100 permit ip 192.168.0.0 0.0.0.255 any access-list 101 permit udp any eq bootps any eq bootpc access-list 101 permit tcp any any access-list 101 permit udp any any access-list 101 permit icmp any any echo-reply access-list 101 permit icmp any any time-exceeded access-list 101 permit icmp any any unreachable no cdp run ! ! ! ! control-plane ! ! line con 0 password 7 05084564-eiths50i455e6365D5C no modem enable line aux 0 line vty 0 4 access-class 23 in privilege level 15 transport input ssh ! scheduler max-task-time 5000 end если поставить вместо 192.168.5.0 нужную подсеть в access-list 10 permit 192.168.5.0 0.0.0.255 тоесть собственно 192.168.0.0 - инет пропадат... делал все по мануалу! в чем загвоздка не понятно...