Сразу скажу что тема шире чем в заголовке.
Есть Cisco3825, на ней 3 субинтерфейса к провайдерам. Есть своя AS(PA). Успешно настроено BGP-соседство с 2 провайдерами по fullview.
Тут бы жить и радоваться, но вот с клиентского компьютера маршрутизация в Инет не идёт, хотя с роутера - без вопросов.
Клиентская маршрутизация настроена через PBR, ранее без AS, работала без нареканий.

Главный вопрос - что не так настроено? Вот конфиг:

!
! Last configuration change at 15:49:57 NOVST Wed Apr 2 2014 by xxxx
! NVRAM config last updated at 15:49:59 NOVST Wed Apr 2 2014 by xxxx
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec localtime show-timezone
service password-encryption
!
hostname main-gw
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
!
aaa new-model
!
!
!
aaa session-id common
clock calendar-valid
!
dot11 syslog
ip source-route
ip cef
!
!
!
!
ip domain name xxxxx.ru
ip name-server 8.8.8.8
ip name-server 8.8.4.4
login on-failure log
login on-success log
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
voice-card 0
!
!
!
username xxxx privilege 15 secret 5 qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
archive
log config
!
!
!
!
!
ip ssh version 2
!
!
!
!
interface GigabitEthernet0/0
no ip address
duplex auto
speed auto
media-type rj45
!
interface GigabitEthernet0/0.40
description notmy_AS
encapsulation dot1Q 40
ip address 40.40.40.14 255.255.252.0
ip nat outside
ip virtual-reassembly
no cdp enable
!
interface GigabitEthernet0/0.55
description ISP1
encapsulation dot1Q 55
ip address 55.55.55.146 255.255.255.252 secondary
ip address 55.55.55.162 255.255.255.252
ip nat outside
ip virtual-reassembly
no cdp enable
!
interface GigabitEthernet0/0.60
description ISP2
encapsulation dot1Q 60
ip address 60.60.60.70 255.255.255.252
no ip redirects
no ip unreachables
ip virtual-reassembly
no cdp enable
!
interface GigabitEthernet0/0.77
description ISP3
encapsulation dot1Q 77
ip address 77.77.77.147 255.255.255.0
ip nat outside
ip virtual-reassembly
no cdp enable
!
interface GigabitEthernet0/1
no ip address
duplex auto
speed auto
media-type rj45
!
interface GigabitEthernet0/1.1
description LAN
encapsulation dot1Q 1 native
ip address 10.11.12.120 255.255.255.0
ip nat inside
ip virtual-reassembly
!
interface GigabitEthernet0/1.25
description AS_DMZ
encapsulation dot1Q 25
ip address 25.25.25..1 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip virtual-reassembly
no cdp enable
!
router bgp 65432
bgp router-id 25.25.25.1
bgp log-neighbor-changes
neighbor 55.55.55.145 remote-as 64321
neighbor 55.55.55.145 description ISP1_fullview
neighbor 55.55.55.161 remote-as 64321
neighbor 55.55.55.161 description ISP1
neighbor 60.60.60.69 remote-as 62109
neighbor 60.60.60.69 description ISP2
!
address-family ipv4
  neighbor 55.55.55.145 activate
  neighbor 55.55.55.145 next-hop-self
  neighbor 55.55.55.145 soft-reconfiguration inbound
  neighbor 55.55.55.145 prefix-list BGP_ADVERT out
  neighbor 55.55.55.161 activate
  neighbor 55.55.55.161 next-hop-self
  neighbor 55.55.55.161 soft-reconfiguration inbound
  neighbor 55.55.55.161 prefix-list BGP_ADVERT out
  neighbor 60.60.60.69 activate
  neighbor 60.60.60.69 next-hop-self
  neighbor 60.60.60.69 soft-reconfiguration inbound
  neighbor 60.60.60.69 prefix-list BGP_ADVERT out
  no auto-summary
  no synchronization
  network 25.25.25.0 mask 255.255.255.0
exit-address-family
!
ip local pool VPN_POOL 10.11.12.101 10.11.12.110
ip forward-protocol nd
ip route 10.11.12.0 255.255.255.0 Null0
no ip http server
no ip http secure-server
!
!
ip nat inside source route-map OURNET_TO_INTERNET interface GigabitEthernet0/1.25 overload
!
ip access-list extended LAN_TO_INET
permit ip 10.11.12.0 0.0.0.255 any
ip access-list extended port22dis
deny   tcp any host 25.25.25.1 eq 22
deny   tcp any host 40.40.40.14 eq 22
deny   tcp any host 55.55.55.162 eq 22
deny   tcp any host 60.60.60.70 eq 22
deny   tcp any host 77.77.77.147 eq 22
permit ip any any
!
!
ip prefix-list BGP_ADVERT seq 10 permit 25.25.25.0/24
ip radius source-interface GigabitEthernet0/1.1
logging trap debugging
logging 10.11.12.127
!
!
!
!
route-map OURNET_TO_INTERNET permit 10
match ip address LAN_TO_INET
!
!
!
control-plane
!
!
!
line con 0
line aux 0
line vty 0 4
exec-timeout 20 0
privilege level 15
logging synchronous
transport input ssh
scheduler allocate 20000 1000
end