Здравствуйте!
Есть коммутатор WS-C2960S-48TS-S и маршрутизатор CISCO2951/K9.
Есть 3 белых ip адреса(xx.xx.xx.120/29).
На 1(хх.хх.хх.122) ip настроен нат из локальной сети(192.168.0.0/24)(Vlan1)
Остальные 2(хх.хх.хх.123,хх.хх.хх.124 ) проброшены на коммутатор при помощи ip unnumbered (Vlan101 и Vlan102).
Для проброшенных ip хх.хх.хх.123 и хх.хх.хх.124 маршрут по умолчанию хх.хх.хх.122.
Интернет они видят. Но из локальной сети не видно двух внешних ip. Нужно из сети 192.168.0.0/24 видеть xx.xx.xx.123 и xx.xx.xx.124 помогите пожалуйста.
При трасировке из локалки маршрут идет через хх.хх.хх.121(маршрут по умолчанию для внешней подсети).
Конфиг маршрутизатора:
interface GigabitEthernet0/0
description $ETH-LAN$$ETH-SW-LAUNCH$$INTF-INFO-GE 0/0$
ip address 192.168.0.254 255.255.255.0
no ip redirects
ip nat inside
ip virtual-reassembly
ip policy route-map tracking
duplex auto
speed auto
vlan-id dot1q 1
  exit-vlan-config
!        
!        
interface GigabitEthernet0/1
description $ES_LAN$
ip address xx.xx.xx.122 255.255.255.248
ip access-group FIREWALL in
no ip redirects
ip nat outside
ip inspect INSPECT_OUT out
ip virtual-reassembly
duplex auto
speed auto
!        
interface GigabitEthernet0/2
no ip address
ip virtual-reassembly
duplex auto
speed auto
!        
interface GigabitEthernet0/2.101
encapsulation dot1Q 101
ip unnumbered GigabitEthernet0/1
no ip redirects
no ip proxy-arp
ip virtual-reassembly
ip policy route-map SFT

interface GigabitEthernet0/2.102
encapsulation dot1Q 102
ip unnumbered GigabitEthernet0/1
no ip redirects
ip virtual-reassembly
ip policy route-map SFT
!        
ip forward-protocol nd
!        
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!        
ip dns server
no ip nat create flow-entries
ip nat pool FTPACL 192.168.0.250 192.168.0.250 netmask 255.255.255.0 type rotary
ip nat inside source list NAT interface GigabitEthernet0/1 overload
ip nat inside source static tcp 192.168.0.250 21 xx.xx.xx.122 21 extendable
ip nat inside source static tcp 192.168.0.149 32000 xx.xx.xx.122 32000 extendable
ip nat inside destination list 100 pool FTPACL
ip route 0.0.0.0 0.0.0.0 xx.xx.xx.121 20 track 123
ip route 0.0.0.0 0.0.0.0 xx.xx.xx.120 track 124
ip route 8.8.4.4 255.255.255.255 xx.xx.xx.121
ip route 8.8.8.8 255.255.255.255 192.168.0.111
ip route xx.xx.xx.122 255.255.255.255 GigabitEthernet0/2.101
ip route xx.xx.xx.124 255.255.255.255 GigabitEthernet0/2.102
!        
ip access-list extended FIREWALL
permit ip any host xx.xx.xx.124
permit tcp any any eq ftp
permit tcp any any range 60010 60030
permit tcp any any eq 32000
permit tcp any host xx.xx.xx.124 eq 1194
permit tcp any host xx.xx.xx.124 eq www
permit tcp any host xx.xx.xx.124 eq 3690
permit icmp any host xx.xx.xx.124
ip access-list extended NAT
permit ip 192.168.0.0 0.0.0.255 any
!        
ip sla 1  
icmp-echo 8.8.4.4 source-interface GigabitEthernet0/1
threshold 2
timeout 2000
frequency 3
ip sla schedule 1 life forever start-time now
ip sla 2  
icmp-echo 8.8.8.8 source-interface GigabitEthernet0/0
threshold 2
timeout 2000
frequency 3
ip sla schedule 2 life forever start-time now
access-list 1 permit 192.168.0.0 0.0.0.255
access-list 2 permit xx.xx.xx.120 0.0.0.7
access-list 100 permit tcp any any range 60010 60030
access-list 101 permit tcp any any eq ftp
!        
!        
!        
!        
route-map tracking permit 100
match ip address 1
set ip next-hop verify-availability 192.168.0.111 10 track 124
set ip next-hop verify-availability xx.xx.xx.121 20 track 123
!        
route-map SFT permit 200
match ip address 2
set ip next-hop xx.xx.xx.121
!        

Конфиг коммутатора

vlan internal allocation policy ascending
!
ip ssh time-out 60
ip ssh authentication-retries 2
ip ssh version 2
!
interface FastEthernet0
no ip address
shutdown
!
interface GigabitEthernet0/1
!
interface GigabitEthernet0/2
!
interface GigabitEthernet0/3
!
interface GigabitEthernet0/4
speed 100
!
interface GigabitEthernet0/5
speed 100
!
interface GigabitEthernet0/6
switchport access vlan 102
switchport mode access
speed 100
!
interface GigabitEthernet0/7
speed 100
!
interface GigabitEthernet0/8
!
interface GigabitEthernet0/9
speed 100
!
interface GigabitEthernet0/10
speed 100
interface GigabitEthernet0/11
speed 100
!        
interface GigabitEthernet0/12
speed 100
!        
interface GigabitEthernet0/13
speed 100
!        
interface GigabitEthernet0/14
speed 100
!        
interface GigabitEthernet0/15
speed 100
!        
interface GigabitEthernet0/16
speed 100
!        
interface GigabitEthernet0/17
!
interface GigabitEthernet0/18
speed 100
!
interface GigabitEthernet0/19
speed 100
!
interface GigabitEthernet0/20
speed 100
!
interface GigabitEthernet0/21
speed 100
!
interface GigabitEthernet0/22
speed 100
!
interface GigabitEthernet0/23
speed 100
!
interface GigabitEthernet0/24
speed 100
!
interface GigabitEthernet0/25
speed 100
!
interface GigabitEthernet0/26
speed 100
!
interface GigabitEthernet0/27
speed 100
!
interface GigabitEthernet0/28
switchport access vlan 101
switchport mode access
speed 100
!
interface GigabitEthernet0/29
speed 100
!
interface GigabitEthernet0/30
!
interface GigabitEthernet0/31
speed 100
!
interface GigabitEthernet0/32
speed 100
!
interface GigabitEthernet0/33
speed 100
!
interface GigabitEthernet0/34
speed 100
!
interface GigabitEthernet0/35
speed 100
!
interface GigabitEthernet0/36
speed 100
!
interface GigabitEthernet0/37
speed 100
!
interface GigabitEthernet0/38
speed 100
!
interface GigabitEthernet0/39
speed 100
!
interface GigabitEthernet0/40
speed 100
!
interface GigabitEthernet0/41
speed 100
!
interface GigabitEthernet0/42
speed 100
!
interface GigabitEthernet0/43
speed 100
!
interface GigabitEthernet0/44
speed 100
!
interface GigabitEthernet0/45
speed 100
!
interface GigabitEthernet0/46
speed 100
!
interface GigabitEthernet0/47
!
interface GigabitEthernet0/48
switchport trunk allowed vlan 101,102
switchport mode trunk
!
interface GigabitEthernet0/49
!
interface GigabitEthernet0/50
!
interface Vlan1
ip address 192.168.0.100 255.255.255.0
!
interface Vlan101
no ip address
no ip proxy-arp
!
interface Vlan102
no ip address
!
ip http server
ip http authentication local
no ip http secure-server
!
line con 0
line vty 0 4
privilege level 15
transport input ssh
line vty 5 15
!
ntp clock-period 22518511