Конфиг + дебаг смотрите может где то я туплю ! скажыте где ! ;)

Current configuration : 6195 bytes
!
! No configuration change since last restart
!
upgrade fpd auto
version 12.2
service exec-callback
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname c7201-core1-1
!
boot-start-marker
boot-end-marker
!
enable secret *****************
!
aaa new-model
!
!
aaa group server radius SERVER_GROUP1
server xx.xx.152.43 auth-port 1812 acct-port 1813
!
aaa authentication login default local
aaa authentication login AUTHEN_LIST1 group SERVER_GROUP1
aaa authorization exec default local
aaa authorization network default group SERVER_GROUP1
aaa authorization network AUTHOR_LIST1 group SERVER_GROUP1
aaa authorization subscriber-service default group SERVER_GROUP1
aaa accounting delay-start all
aaa accounting update periodic 1
aaa accounting network default start-stop group SERVER_GROUP1
aaa accounting network BH_ACCNT_LIST1 start-stop group SERVER_GROUP1
!
!
!
!
aaa server radius dynamic-author
client xx.yy.152.43
server-key cisco555
!
aaa session-id common
ip subnet-zero
no ip rcmd domain-lookup
!
!
ip dhcp smart-relay
ip dhcp relay information option
ip dhcp relay information policy keep
no ip dhcp relay information check
ip dhcp relay information trust-all
no ip dhcp use vrf connected
!
ip dhcp pool yy.xx.96.0
   import all
   network yy.xx.96.0 255.255.255.0
   default-router yy.xx.96.1
   dns-server yy.xx.152.9
   lease 0 0 30
   class yy.xx.96.0
!
!
ip dhcp class xx.yy.96.0
!
ip cef
ip name-server yy.xx.152.9
!
!
subscriber service password servicecisco
redirect server-group REDIRECT_SERVER_GROUP1
server ip ss.xx.152.43 port 9443
!
multilink bundle-name authenticated
call rsvp-sync
!
!
!
!
!
!
!
username sysadmin secret *******************
!
class-map type control match-all IP_UNAUTH_COND
match timer IP_UNAUTH_TIMER
match authen-status unauthenticated
!
policy-map type control RULE_406a
class type control IP_UNAUTH_COND event timed-policy-expiry
  1 service disconnect
!
class type control always event session-start
  10 service-policy type service name PBHK_SERVICE
  20 authorize aaa list AUTHOR_LIST1 password cisco123 identifier mac-address
  30 service-policy type service name SERVICE_406_L4R
  40 set-timer IP_UNAUTH_TIMER 5
!
class type control always event session-restart
  10 service-policy type service name PBHK_SERVICE
  20 service-policy type service name SERVICE_406_L4R
  30 set-timer IP_UNAUTH_TIMER 5
!
class type control always event account-logon
  10 authenticate aaa list AUTHEN_LIST1
  20 service-policy type service unapply name SERVICE_406_L4R
!
class type control always event account-logoff
  10 service disconnect delay 10
!
!
!
interface FastEthernet0/0
no ip address
shutdown
speed auto
duplex auto
!
interface GigabitEthernet0/0
no ip address
media-type rj45
speed auto
duplex auto
negotiation auto
!
interface GigabitEthernet0/0.5
encapsulation dot1Q 5
ip address yy.xx.152.66 255.255.255.224
!
interface GigabitEthernet0/1
no ip address
media-type rj45
speed auto
duplex auto
negotiation auto
!
interface GigabitEthernet0/1.1789
encapsulation dot1Q 1789
ip dhcp relay information trusted
ip dhcp relay information option-insert
ip address 172.5.5.2 255.255.255.252
!
interface GigabitEthernet0/2
no ip address
speed auto
duplex auto
negotiation auto
!
interface GigabitEthernet0/2.39
encapsulation dot1Q 39
ip address yy.xx.96.1 255.255.255.0
service-policy type control RULE_406a
ip subscriber routed
initiator dhcp class-aware
!
interface GigabitEthernet0/2.40
encapsulation dot1Q 40
ip address xx.yy.97.1 255.255.255.0
ip subscriber interface
!
interface GigabitEthernet0/2.41
encapsulation dot1Q 41
ip address yy.xx.98.1 255.255.255.0
!
interface GigabitEthernet0/2.42
encapsulation dot1Q 42
ip address xx.yy.99.1 255.255.255.0
shutdown
!
interface GigabitEthernet0/2.43
encapsulation dot1Q 43
ip address yy.xx.100.1 255.255.255.0
shutdown
!
interface GigabitEthernet0/2.300
encapsulation dot1Q 300
ip dhcp relay information trusted
ip dhcp relay information option-insert
ip address 192.168.0.1 255.255.255.252
!
interface GigabitEthernet0/3
no ip address
shutdown
speed auto
duplex auto
negotiation auto
!
router ospf 1
log-adjacency-changes
network yy.xx.152.64 0.0.0.15 area 0.0.0.0
network yy.xx.96.0 0.0.0.255 area 0.0.0.0
network 172.5.5.0 0.0.0.3 area 0.0.0.0
network 192.168.0.0 0.0.0.3 area 0.0.0.0
!
ip classless
ip route 0.0.0.0 0.0.0.0 xx.yy.152.65
!
!
no ip http server
no ip http secure-server
!
ip access-list extended ACL_IN_BOD1M_406
permit ip any any
ip access-list extended ACL_IN_INTERNET_406
permit ip any any
ip access-list extended ACL_IN_VPN_406_1001
permit ip any any
ip access-list extended ACL_OUT_BOD1M_406
permit ip any any
ip access-list extended ACL_OUT_INTERNET_406
permit ip any any
ip access-list extended ACL_OUT_VPN_406_1001
permit ip any any
!
logging trap debugging
logging facility local2
logging xx.yy.152.43
no ip http server
no ip http secure-server
!
ip access-list extended ACL_IN_BOD1M_406
permit ip any any
ip access-list extended ACL_IN_INTERNET_406
permit ip any any
ip access-list extended ACL_IN_VPN_406_1001
permit ip any any
ip access-list extended ACL_OUT_BOD1M_406
permit ip any any
ip access-list extended ACL_OUT_INTERNET_406
permit ip any any
ip access-list extended ACL_OUT_VPN_406_1001
permit ip any any
!
logging trap debugging
logging facility local2
logging 172.5.5.3
access-list 199 deny   ip any host xx.yy.152.43
access-list 199 permit tcp any any eq www
access-list 199 permit tcp any any eq 9443
!
!
radius-server attribute 44 include-in-access-req vrf default
radius-server attribute 6 on-for-login-auth
radius-server attribute 8 include-in-access-req
radius-server attribute 32 include-in-access-req
radius-server attribute 32 include-in-accounting-req
radius-server attribute 55 include-in-acct-req
radius-server attribute 55 access-request include
radius-server attribute 25 access-request include
radius-server host xx.xx.152.43 auth-port 1812 acct-port 1813 key aaacisco
radius-server vsa send accounting
radius-server vsa send authentication
!
control-plane
!
!
!
dial-peer cor custom
!
!
!
!
gatekeeper
shutdown
!
!
line con 0
stopbits 1
line aux 0
stopbits 1
line vty 0 4
!
ntp clock-period 17180279
ntp server 81.171.98.5
ntp server 80.190.251.105
ntp server 82.133.58.132
end

+ дебаг

c7201-core1-1#term mon
c7201-core1-1#
.Jul 22 15:30:17.596: DHCPD: Sending notification of DISCOVER:
.Jul 22 15:30:17.596:   DHCPD: htype 1 chaddr 001b.248e.39a0
.Jul 22 15:30:17.596: DHCPD: Sending notification of DISCOVER:
.Jul 22 15:30:17.596:   DHCPD: htype 1 chaddr 001b.248e.39a0
.Jul 22 15:30:17.596: DHCPD: Seeing if there is an internally specified pool class:
.Jul 22 15:30:17.596:   DHCPD: htype 1 chaddr 001b.248e.39a0
.Jul 22 15:30:17.604: RADIUS/ENCODE(0000000D):Orig. component type = IEDGE_IP_SIP
.Jul 22 15:30:17.604: RADIUS(0000000D): Config NAS IP: 0.0.0.0
.Jul 22 15:30:17.604: RADIUS/ENCODE(0000000D): acct_session_id: 3
.Jul 22 15:30:17.604: RADIUS(0000000D): Config NAS IP: 0.0.0.0
.Jul 22 15:30:17.604: RADIUS(0000000D): sending
.Jul 22 15:30:17.604: RADIUS/ENCODE: Best Local IP-Address xx.xx.152.66 for Radius-Server xx.xx.152.43
.Jul 22 15:30:17.604: RADIUS(0000000D): Send Access-Request to xx.xx.152.43:1812 id 1645/1, len 117
.Jul 22 15:30:17.604: RADIUS:  authenticator 1B 4B F7 69 AA CC 5E F1 - ED 8E F9 AC B4 1F CC 28
.Jul 22 15:30:17.604: RADIUS:  User-Name           [1]   14  "PBHK_SERVICE"
.Jul 22 15:30:17.604: RADIUS:  User-Password       [2]   18  *
.Jul 22 15:30:17.604: RADIUS:  NAS-Port-Type       [61]  6   Virtual                   [5]
.Jul 22 15:30:17.604: RADIUS:  NAS-Port            [5]   6   0                  
.Jul 22 15:30:17.604: RADIUS:  NAS-Port-Id         [87]  10  "0/0/2/39"
.Jul 22 15:30:17.604: RADIUS:  Service-Type        [6]   6   Outbound                  [5]
.Jul 22 15:30:17.604: RADIUS:  NAS-IP-Address      [4]   6   xx.xx.152.66      
.Jul 22 15:30:17.604: RADIUS:  Acct-Session-Id     [44]  10  "00000003"
.Jul 22 15:30:17.604: RADIUS:  Nas-Identifier      [32]  15  "c7201-core1-1"
.Jul 22 15:30:17.604: RADIUS:  Event-Timestamp     [55]  6   1216740617        
.Jul 22 15:30:17.604: RADIUS: Received from id 1645/1 xx.xx.152.43:1812, Access-Accept, len 48
.Jul 22 15:30:17.604: RADIUS:  authenticator 5A 98 47 9E FE BF 81 4B - 7E E2 25 72 41 07 B9 86
.Jul 22 15:30:17.604: RADIUS:  Vendor, Cisco       [26]  28
.Jul 22 15:30:17.604: RADIUS:   Cisco AVpair       [1]   22  "ip:portbundle=enable"
.Jul 22 15:30:17.604: RADIUS(0000000D): Received from id 1645/1
.Jul 22 15:30:17.608: RADIUS/ENCODE(0000000D):Orig. component type = IEDGE_IP_SIP
.Jul 22 15:30:17.608: RADIUS(0000000D): Config NAS IP: 0.0.0.0
.Jul 22 15:30:17.608: RADIUS/ENCODE(0000000D): acct_session_id: 3
.Jul 22 15:30:17.608: RADIUS(0000000D): Config NAS IP: 0.0.0.0
.Jul 22 15:30:17.608: RADIUS(0000000D): sending
.Jul 22 15:30:17.608: RADIUS/ENCODE: Best Local IP-Address xx.xx.152.66 for Radius-Server xx.xx.152.43
.Jul 22 15:30:17.608: RADIUS(0000000D): Send Access-Request to xx.xx.152.43:1812 id 1645/2, len 119
.Jul 22 15:30:17.608: RADIUS:  authenticator 8E 92 0A 3E 94 4D E2 33 - 78 C6 80 78 94 AA ED 15
.Jul 22 15:30:17.608: RADIUS:  User-Name           [1]   16  "001b.248e.39a0"
.Jul 22 15:30:17.608: RADIUS:  User-Password       [2]   18  *
.Jul 22 15:30:17.608: RADIUS:  NAS-Port-Type       [61]  6   Virtual                   [5]
.Jul 22 15:30:17.608: RADIUS:  NAS-Port            [5]   6   0                  
.Jul 22 15:30:17.608: RADIUS:  NAS-Port-Id         [87]  10  "0/0/2/39"
.Jul 22 15:30:17.608: RADIUS:  Service-Type        [6]   6   Outbound                  [5]
.Jul 22 15:30:17.608: RADIUS:  NAS-IP-Address      [4]   6   xx.xx.152.66      
.Jul 22 15:30:17.608: RADIUS:  Acct-Session-Id     [44]  10  "00000003"
.Jul 22 15:30:17.608: RADIUS:  Nas-Identifier      [32]  15  "c7201-core1-1"
.Jul 22 15:30:17.608: RADIUS:  Event-Timestamp     [55]  6   1216740617        
.Jul 22 15:30:17.868: RADIUS: Received from id 1645/2 xx.xx.152.43:1812, Access-Accept, len 236
.Jul 22 15:30:17.868: RADIUS:  authenticator FA 9C 7E C0 80 FD 3A B9 - 98 97 7A ED E6 4E 3E 4A
.Jul 22 15:30:17.868: RADIUS:  Vendor, Cisco       [26]  49
.Jul 22 15:30:17.868: RADIUS:   Cisco AVpair       [1]   43  "subscriber:accounting-list=BH_ACCNT_LIST1"
.Jul 22 15:30:17.868: RADIUS:  Vendor, Cisco       [26]  31
.Jul 22 15:30:17.868: RADIUS:   ssg-account-info   [250] 25  "ABasic_Internet_Service"
.Jul 22 15:30:17.868: RADIUS:  Vendor, Cisco       [26]  27
.Jul 22 15:30:17.868: RADIUS:   ssg-account-info   [250] 21  "NSERVICE_406_BOD1Mc"
.Jul 22 15:30:17.868: RADIUS:  Vendor, Cisco       [26]  30
.Jul 22 15:30:17.868: RADIUS:   ssg-account-info   [250] 24  "NSERVICE_406_VPN_1001c"
.Jul 22 15:30:17.868: RADIUS:  Idle-Timeout        [28]  6   1800              
.Jul 22 15:30:17.868: RADIUS:  User-Name           [1]   6   "test"
.Jul 22 15:30:17.868: RADIUS:  Vendor, Cisco       [26]  67
.Jul 22 15:30:17.868: RADIUS:   ssg-service-info   [251] 61  "Service_0,QU;1024000;128000;256000;D;1024000;128000;256000;"
.Jul 22 15:30:17.868: RADIUS(0000000D): Received from id 1645/2
.Jul 22 15:30:17.872: RADIUS/ENCODE(0000000D):Orig. component type = IEDGE_IP_SIP
.Jul 22 15:30:17.872: RADIUS(0000000D): Config NAS IP: 0.0.0.0
.Jul 22 15:30:17.872: RADIUS/ENCODE(0000000D): acct_session_id: 3
.Jul 22 15:30:17.872: RADIUS(0000000D): Config NAS IP: 0.0.0.0
.Jul 22 15:30:17.872: RADIUS(0000000D): sending
.Jul 22 15:30:17.872: RADIUS/ENCODE: Best Local IP-Address xx.xx.152.66 for Radius-Server xx.xx.152.43
.Jul 22 15:30:17.872: RADIUS(0000000D): Send Access-Request to xx.xx.152.43:1812 id 1645/3, len 127
.Jul 22 15:30:17.872: RADIUS:  authenticator 1C FB E2 AE 43 52 29 6A - 80 16 83 2C 64 54 36 06
.Jul 22 15:30:17.872: RADIUS:  User-Name           [1]   24  "Basic_Internet_Service"
.Jul 22 15:30:17.872: RADIUS:  User-Password       [2]   18  *
.Jul 22 15:30:17.872: RADIUS:  NAS-Port-Type       [61]  6   Virtual                   [5]
.Jul 22 15:30:17.872: RADIUS:  NAS-Port            [5]   6   0                  
.Jul 22 15:30:17.872: RADIUS:  NAS-Port-Id         [87]  10  "0/0/2/39"
.Jul 22 15:30:17.872: RADIUS:  Service-Type        [6]   6   Outbound                  [5]
.Jul 22 15:30:17.872: RADIUS:  NAS-IP-Address      [4]   6   xx.xx.152.66      
.Jul 22 15:30:17.872: RADIUS:  Acct-Session-Id     [44]  10  "00000003"
.Jul 22 15:30:17.872: RADIUS:  Nas-Identifier      [32]  15  "c7201-core1-1"
.Jul 22 15:30:17.872: RADIUS:  Event-Timestamp     [55]  6   1216740617        
.Jul 22 15:30:17.872: RADIUS: Received from id 1645/3 xx.xx.152.43:1812, Access-Accept, len 395
.Jul 22 15:30:17.872: RADIUS:  authenticator A1 CA 91 D2 37 BA E8 E9 - 4A 96 23 5B DF A3 C5 20
.Jul 22 15:30:17.872: RADIUS:  Vendor, Cisco       [26]  26
.Jul 22 15:30:17.872: RADIUS:   ssg-service-info   [251] 20  "SERVICE_406_BOD1Mc"
.Jul 22 15:30:17.872: RADIUS:  Vendor, Cisco       [26]  50
.Jul 22 15:30:17.872: RADIUS:   ssg-service-info   [251] 44  "QU;256000;32000;64000;D;256000;32000;64000"
.Jul 22 15:30:17.872: RADIUS:  Vendor, Cisco       [26]  80
.Jul 22 15:30:17.872: RADIUS:   Cisco AVpair       [1]   74  "ip:traffic-class=input access-group name ACL_IN_INTERNET_406 priority 30"
.Jul 22 15:30:17.872: RADIUS:  Vendor, Cisco       [26]  82
.Jul 22 15:30:17.872: RADIUS:   Cisco AVpair       [1]   76  "ip:traffic-class=output access-group name ACL_OUT_INTERNET_406 priority 30"
.Jul 22 15:30:17.872: RADIUS:  Vendor, Cisco       [26]  41
.Jul 22 15:30:17.872: RADIUS:   Cisco AVpair       [1]   35  "ip:traffic-class=out default drop"
.Jul 22 15:30:17.872: RADIUS:  Vendor, Cisco       [26]  40
.Jul 22 15:30:17.872: RADIUS:   Cisco AVpair       [1]   34  "ip:traffic-class=in default drop"
.Jul 22 15:30:17.872: RADIUS:  Framed-IP-Address   [8]   6   10.1.1.4          
.Jul 22 15:30:17.872: RADIUS:  Vendor, Cisco       [26]  50
.Jul 22 15:30:17.872: RADIUS:   Cisco AVpair       [1]   44  "subscriber:accounting-list=BH_ACCNT_LIST1 "
.Jul 22 15:30:17.872: RADIUS(0000000D): Received from id 1645/3
.Jul 22 15:30:17.876: DHCPD: Callback for workspace (ID=0x35000001)
.Jul 22 15:30:17.876: DHCPD: Callback: class '' now specified for client 0100.1b24.8e39.a0
.Jul 22 15:30:17.876: DHCPD: Sending notification of DISCOVER:
.Jul 22 15:30:17.876:   DHCPD: htype 1 chaddr 001b.248e.39a0
.Jul 22 15:30:17.876: DHCPD: requested address 169.254.233.7 is not on subnet xx.xx.96.0.
.Jul 22 15:30:19.876: DHCPD: Adding binding to radix tree (xx.xx.96.2)
.Jul 22 15:30:19.876: DHCPD: Adding binding to hash tree
.Jul 22 15:30:19.876: DHCPD: assigned IP address xx.xx.96.2 to client 0100.1b24.8e39.a0. (4 39)
.Jul 22 15:30:19.876: DHCPD: DHCPOFFER notify setup address xx.xx.96.2 mask 255.255.255.0
.Jul 22 15:30:19.876: RADIUS/ENCODE(0000000D):Orig. component type = IEDGE_IP_SIP
.Jul 22 15:30:19.876: RADIUS(0000000D): Config NAS IP: 0.0.0.0
.Jul 22 15:30:19.876: RADIUS(0000000D): Config NAS IP: 0.0.0.0
.Jul 22 15:30:19.876: RADIUS/ENCODE: Best Local IP-Address xx.xx.152.66 for Radius-Server xx.xx.152.43
.Jul 22 15:30:19.876: DHCPD: Callback for workspace (ID=0x35000001)
.Jul 22 15:30:19.876: DHCPD: Callback: switching path now setup for client 0100.1b24.8e39.a0
.Jul 22 15:30:19.876: DHCPD: Sending notification of DISCOVER:
.Jul 22 15:30:19.876:   DHCPD: htype 1 chaddr 001b.248e.39a0
.Jul 22 15:30:19.876: DHCPD: unicast BOOTREPLY output i/f override GigabitEthernet0/2.39
.Jul 22 15:30:19.876: RADIUS: Received from id 1646/1 xx.xx.152.43:1813, Accounting-response, len 20
.Jul 22 15:30:21.596: DHCPD: input i/f override GigabitEthernet0/2.39 for client
.Jul 22 15:30:21.596: DHCPD: Sending notification of DISCOVER:
.Jul 22 15:30:21.596:   DHCPD: htype 1 chaddr 001b.248e.39a0
.Jul 22 15:30:21.596: DHCPD: Sending notification of DISCOVER:
.Jul 22 15:30:21.596:   DHCPD: htype 1 chaddr 001b.248e.39a0
.Jul 22 15:30:21.596: DHCPD: Seeing if there is an internally specified pool class:
.Jul 22 15:30:21.596:   DHCPD: htype 1 chaddr 001b.248e.39a0
.Jul 22 15:30:21.596: DHCPD: No internally specified class returned
.Jul 22 15:30:21.596: DHCPD: DHCPOFFER notify setup address xx.xx.96.2 mask 255.255.255.0
.Jul 22 15:30:21.596: DHCPD: offer notify return with no delay on intf GigabitEthernet0/2.39
.Jul 22 15:30:21.596: DHCPD: input i/f override GigabitEthernet0/2.39 for client
.Jul 22 15:30:21.596: DHCPD: Sending notification of ASSIGNMENT:
.Jul 22 15:30:21.596:  DHCPD: address xx.xx.96.2 mask 255.255.255.0
.Jul 22 15:30:21.596:   DHCPD: htype 1 chaddr 001b.248e.39a0
.Jul 22 15:30:21.596:   DHCPD: lease time remaining (secs) = 1800
.Jul 22 15:30:28.460: DHCPD: checking for expired leases.
Jul 22 15:31:13.477: RADIUS/ENCODE(0000000D):Orig. component type = IEDGE_IP_SIP
Jul 22 15:31:13.477: RADIUS(0000000D): Config NAS IP: 0.0.0.0
Jul 22 15:31:13.477: RADIUS(0000000D): Config NAS IP: 0.0.0.0
Jul 22 15:31:13.477: RADIUS/ENCODE: Best Local IP-Address xx.xx.152.66 for Radius-Server xx.xx.152.43
Jul 22 15:31:13.477: RADIUS: Received from id 1646/2 xx.xx.152.43:1813, Accounting-response, len 20
c7201-core1-1#sh ip su
c7201-core1-1#sh ip subscriber
Displaying subscribers in the default service vrf:

Type        Subscriber Identifier    Display UID    Status
---------   ----------------------   ------------   ------
routed      xx.xx.96.2/32           [2]            up
c7201-core1-1#