Вот мой конфиг, с "косметическими правками".
У меня 3 прова, ISP1 и ISP2 - соседи по BGP, третий пока "висит".
IP адреса моей AS 1.3.4...

version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec localtime show-timezone
service password-encryption
!
hostname main-gw
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
!
aaa new-model
!
!
aaa group server radius MEDTEK
server-private 10.11.12.11 auth-port 1812 acct-port 1813 key 7 122D242533292D360B7A767B
!
aaa authentication login default local
aaa authentication ppp default group MEDTEK
aaa authorization exec default local
aaa authorization network pptp group MEDTEK
!
!
aaa session-id common
clock timezone NOVST 7
clock calendar-valid
!
dot11 syslog
ip source-route
ip cef
!
!
!
!
ip domain name xxxxx.ru
ip name-server 8.8.8.8
ip name-server 8.8.4.4
login on-failure log
login on-success log
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
vpdn enable
!
vpdn-group K_VPN
! Default PPTP VPDN group
accept-dialin
  protocol pptp
  virtual-template 1
ip mtu adjust
!
!
voice-card 0
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
username user privilege 15 secret 5 XxxxXXXXXXXXXXXXXXXXxxXXXXXXxXXXX
archive
log config
  logging enable
  notify syslog contenttype plaintext
  hidekeys
path tftp://10.11.12.5/config/cisco/3825/$h
write-memory
!
!
!
!
!
ip ssh port 3215 rotary 1
ip ssh version 2
!
!
!
!
interface GigabitEthernet0/0
no ip address
duplex auto
speed auto
media-type rj45
!
interface GigabitEthernet0/0.20
description Link_for_AS_1.2.3.0/22
encapsulation dot1Q 20
ip address 1.2.3.162 255.255.255.252
no ip redirects
no ip proxy-arp
no cdp enable
!
interface GigabitEthernet0/0.25
description AS_DMZ
encapsulation dot1Q 25
ip address 1.3.4.1 255.255.255.0
ip access-group port22dis in
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip virtual-reassembly
no cdp enable
!
interface GigabitEthernet0/0.55
description ISP1
encapsulation dot1Q 55
ip address 1.4.5.146 255.255.255.252 secondary
ip address 1.5.6.162 255.255.255.252
ip nat outside
ip virtual-reassembly
no cdp enable
!
interface GigabitEthernet0/0.60
description ISP2
encapsulation dot1Q 60
ip address 1.6.7.70 255.255.255.252
ip access-group port22dis in
no ip redirects
no ip unreachables
ip virtual-reassembly
no cdp enable
!
interface GigabitEthernet0/0.77
description ISP3
encapsulation dot1Q 77
ip address 1.7.8.147 255.255.255.0
ip access-group port22dis in
ip nat outside
ip virtual-reassembly
no cdp enable
!
interface GigabitEthernet0/1
no ip address
duplex auto
speed auto
media-type rj45
!
interface GigabitEthernet0/1.1
description LAN
encapsulation dot1Q 1 native
ip address 10.11.12.120 255.255.255.0
ip flow ingress
ip flow egress
ip nat inside
ip virtual-reassembly
!
interface Virtual-Template1
ip unnumbered GigabitEthernet0/0.25
peer default ip address pool VPN_POOL
ppp encrypt mppe auto required
ppp authentication ms-chap-v2
ppp authorization pptp
ppp eap refuse
ppp chap refuse
ppp pap refuse
ppp ipcp dns 10.11.12.20 8.8.8.8
!
router bgp 62036
bgp router-id 1.3.4.1
bgp log-neighbor-changes
neighbor 1.4.5.145 remote-as 35018
neighbor 1.4.5.145 description IPS1_fullview
neighbor 1.5.6.161 remote-as 35018
neighbor 1.5.6.161 description ISP1
neighbor 1.2.3.161 remote-as 43552
neighbor 1.2.3.161 description AS_freind
neighbor 1.6.7.69 remote-as 25549
neighbor 1.6.7.69 description ISP2_fullview
!
address-family ipv4
  neighbor 1.4.5.145 activate
  neighbor 1.4.5.145 next-hop-self
  neighbor 1.4.5.145 soft-reconfiguration inbound
  neighbor 1.4.5.145 prefix-list BGP_ADVERT out
  neighbor 1.5.6.161 activate
  neighbor 1.5.6.161 next-hop-self
  neighbor 1.5.6.161 soft-reconfiguration inbound
  neighbor 1.5.6.161 prefix-list BGP_ADVERT out
  neighbor 1.2.3.161 activate
  neighbor 1.2.3.161 next-hop-self
  neighbor 1.2.3.161 soft-reconfiguration inbound
  neighbor 1.2.3.161 prefix-list BGP_ADVERT out
  neighbor 1.6.7.69 activate
  neighbor 1.6.7.69 next-hop-self
  neighbor 1.6.7.69 soft-reconfiguration inbound
  neighbor 1.6.7.69 prefix-list BGP_ADVERT out
  no auto-summary
  no synchronization
  network 1.3.4.0 mask 255.255.255.0
exit-address-family
!
ip local pool VPN_POOL 10.11.12.101 10.11.12.110
ip forward-protocol nd
ip route 1.3.4.0 255.255.255.0 Null0
ip route 172.16.0.0 255.240.0.0 Null0
ip route 192.168.0.0 255.255.0.0 Null0
no ip http server
no ip http secure-server
!
!
ip nat pool NATPOOL 1.3.4.1 1.3.4.1 prefix-length 24
ip nat inside source list LAN_TO_INET pool NATPOOL overload
!
ip access-list extended LAN_TO_INET
permit ip 10.11.12.0 0.0.0.255 any
ip access-list extended port22dis
deny   tcp any host 1.3.4.1 eq 22
deny   tcp any host 1.2.3.14 eq 22
deny   tcp any host 1.4.5.146 eq 22
deny   tcp any host 1.6.7.70 eq 22
deny   tcp any host 1.7.8.147 eq 22
deny   tcp any host 1.5.6.162 eq 22
permit ip any any
!
!
ip prefix-list BGP_ADVERT seq 10 permit 1.3.4.0/24
ip radius source-interface GigabitEthernet0/1.1
logging trap debugging
logging 10.11.12.127
access-list 101 permit icmp any any
access-list 101 deny   ip any any
access-list 110 permit tcp any host 1.2.3.17
access-list 110 deny   ip any host 1.2.3.17
!
!
!
!
!
control-plane
!
!
!
!
!
!
!
!
!
!
line con 0
line aux 0
line vty 0 4
exec-timeout 20 0
privilege level 15
logging synchronous
rotary 1
transport input ssh
line vty 5 15
exec-timeout 5 0
privilege level 15
logging synchronous
rotary 1
transport input ssh
!
scheduler allocate 20000 1000
end