Поднят Site-to-Site VPN между Cisco 2801 и PIX'ой через городскую сетку (сети 160.101.0.0 и 160.110.0.0 через 172.0.0.0).
Также реализован доступ нескольких тачек из подсети 160.101.0.0 в городскую сеть 172.0.0.0 через НАТ (172.25.8.18).
Вопрос в следующем: КАК реализовать доступ из городской сети (конкретно тачке 172.16.120.185) в подсеть 160.101.0.0 (конкретно к тачке 160.101.0.150)
при условии, что Site-to-Site VPN останется рабочим?

Я ОЧЕНЬ мало понимаю еще в ЦИСКАХ, поэтому особо не пинайте ногами :)
Сдается мне, Cisco блочит соединения из сети 172.16.0.0. Как это победить???
Помогите пожалуйста! Заранее спасибо.

П.С. вот мой конфиг ЦИСКИ:

!This is the running config of the router: 160.101.30.15
!----------------------------------------------------------------------------
!version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname cisco2801
!
boot-start-marker
boot-end-marker
!
security authentication failure rate 3 log
security passwords min-length 6
logging buffered 51200
logging console critical
enable secret 5 $1$NCXp$PeFL27MX/nFUF4tgEDKgu0
!
no aaa new-model
clock timezone PCTime 3
no ip source-route
ip cef
!
!
!
!
ip tcp synwait-time 10
no ip bootp server
ip domain name voda.local
ip name-server 160.101.0.5
ip name-server 172.31.255.1
ip ssh time-out 60
ip ssh authentication-retries 2
!
multilink bundle-name authenticated
!
!
voice-card 0
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
crypto pki trustpoint TP-self-signed-2357908148
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-2357908148
revocation-check none
rsakeypair TP-self-signed-2357908148
!
!
crypto pki certificate chain TP-self-signed-2357908148
certificate self-signed 01
  3082024C 308201B5 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
  31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
  69666963 6174652D 32333537 39303831 3438301E 170D3037 30353137 30373435
  35305A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
  4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D32 33353739
  30383134 3830819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
  81009BDE CADD3CCD 8F52C13C 79998CDE 56585D13 EF41F95D FA4ED436 98386BD4
  0D9E6047 4BBF73D3 98C6ABA6 E5790982 6BD013D6 68201FC7 5DDE1C9D 496619FF
  053BB340 EBC00469 1B4AB3F9 C3429B95 865263EE A4E03653 A6593AA4 F9670B18
  FAEBC047 BC544304 23FCF944 87A2611B 6A53F27D A7A1E373 31B9A7E4 AF4918D5
  E9350203 010001A3 74307230 0F060355 1D130101 FF040530 030101FF 301F0603
  551D1104 18301682 14636973 636F3238 30312E76 6F64612E 6C6F6361 6C301F06
  03551D23 04183016 80142CBD 74B17FE5 5B73D9DB DD5A989A 7C9FD00F F5B2301D
  0603551D 0E041604 142CBD74 B17FE55B 73D9DBDD 5A989A7C 9FD00FF5 B2300D06
  092A8648 86F70D01 01040500 03818100 8422E9B7 EE7C108A 8C0D11C8 1FA768FC
  C2F03432 3B507B05 66F920C1 5D66B34E DD077247 3734DEEF 96F1B28C DD03CA63
  C289637A 9BFCD536 A5FC0E30 791315E9 E21718F0 147C16F0 CCDC2158 50B5CBEF
  D58B7882 92BBF9AB 38608BE3 C2F70450 562B0506 67922351 3CC72B75 5C58E1C5
  8C3A0A09 C9E50A63 6ABDCC06 C7A1EF42
  quit
!
!
username kanalkvos privilege 15 secret 5 $1$ru8O$6G94vNXkcBhIFw6i/FBYq0
!
!
translation-rule 1
Rule 0 ^4 11114
!
!
!
crypto isakmp policy 1
encr 3des
authentication pre-share
lifetime 28800
crypto isakmp key zxc123 address 172.16.105.138 255.255.255.0
!
!
crypto ipsec transform-set myset esp-3des esp-sha-hmac
!
crypto map MY 1 ipsec-isakmp
set peer 172.16.105.138
set transform-set myset
match address 100
!
!
!
!
!
interface FastEthernet0/0
description TO_LAN$ETH-LAN$
ip address 160.101.30.15 255.255.0.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip virtual-reassembly
ip route-cache flow
duplex auto
speed auto
no cdp enable
no mop enabled
!
interface FastEthernet0/1
description TO_WAN$ETH-LAN$
ip address 172.25.8.18 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip virtual-reassembly
ip route-cache flow
duplex auto
speed auto
no cdp enable
no mop enabled
crypto map MY
!
ip route 0.0.0.0 0.0.0.0 172.25.8.254
!
!
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 5 life 86400 requests 10000
ip nat translation max-entries 100
ip nat pool KVOS 172.25.8.18 172.25.8.18 netmask 255.255.255.0
ip nat inside source route-map SDM_RMAP_1 interface FastEthernet0/1 overload
ip nat inside source route-map SDM_RMAP_2 interface FastEthernet0/1 overload
ip nat inside source route-map SDM_RMAP_3 interface FastEthernet0/1 overload
ip nat inside source route-map nonat pool KVOS
!
ip access-list extended BORIS
remark SDM_ACL Category=2
deny   ip 160.101.0.0 0.0.255.255 160.110.0.0 0.0.255.255
permit ip host 160.101.3.110 172.0.0.0 0.255.255.255
ip access-list extended DIMA
remark SDM_ACL Category=2
deny   ip 160.101.0.0 0.0.255.255 160.110.0.0 0.0.255.255
permit ip host 160.101.0.30 172.0.0.0 0.255.255.255
ip access-list extended IVANOVSS
remark SDM_ACL Category=2
deny   ip 160.101.0.0 0.0.255.255 160.110.0.0 0.0.255.255
permit ip host 160.101.100.100 172.0.0.0 0.255.255.255
!
logging trap debugging
access-list 100 remark SDM_ACL Category=20
access-list 100 permit ip 160.101.0.0 0.0.255.255 160.110.0.0 0.0.255.255
access-list 100 deny   ip 160.101.0.0 0.0.255.255 any
access-list 101 remark SDM_ACL Category=18
access-list 101 deny   ip 160.101.0.0 0.0.255.255 160.110.0.0 0.0.255.255
access-list 101 permit ip any any
no cdp run
!
!
!
route-map SDM_RMAP_1 permit 1
match ip address DIMA
!
route-map SDM_RMAP_2 permit 1
match ip address BORIS
!
route-map SDM_RMAP_3 permit 1
match ip address IVANOVSS
!
route-map nonat permit 10
match ip address 101
!
!
!
!
control-plane
!
!
!
voice-port 0/3/0
cptone RU
!
voice-port 0/3/1
cptone RU
!
voice-port 0/3/2
cptone RU
!
voice-port 0/3/3
cptone RU
!
!
!
!
!
dial-peer voice 100 voip
destination-pattern 1..
session target ipv4:172.16.105.138
!
dial-peer voice 200 voip
destination-pattern 2..
session target ipv4:172.16.105.138
!
dial-peer voice 4000 pots
destination-pattern 4...
translate-outgoing called 1
port 0/3/0
forward-digits all
!
dial-peer voice 4001 pots
destination-pattern 4...
translate-outgoing called 1
port 0/3/1
forward-digits all
!
dial-peer voice 4002 pots
destination-pattern 4...
translate-outgoing called 1
port 0/3/2
forward-digits all
!
dial-peer voice 4003 pots
destination-pattern 4...
translate-outgoing called 1
port 0/3/3
forward-digits all
!
!
!
banner login ^CAuthorized access only!
Disconnect IMMEDIATELY if you are not an authorized user!

^C
!
line con 0
login local
transport output telnet
line aux 0
login local
transport output telnet
line vty 0 4
privilege level 15
login local
transport input telnet ssh
line vty 5 15
privilege level 15
login local
transport input telnet ssh
!
scheduler allocate 20000 1000
end