Имею 7204vxr. Из железяки делаю NAS для абонентов PPPoE: VLAN219, кучка пользователей, aaa работает нормально. Если абоненту атрибутом присваивается реальный адрес, то вопросов не возникает. Но если назначается серый, например, из сети 10.99.1.0/24 то пингуются все адреса в VLAN184 (интерфейс fa0/0.184), но выше пакеты не уходят (не происходит маршрутизации по правилу ip route 0.0.0.0 0.0.0.0 XXX.XXX.XXX.14).
Маршрутизация статических адресов из class-c (блок 256 реальных адресов) сети происходит нормально, через адрес на fa0/0.184 и далее уходит по выше обозначеному правилу.

Подскажите, где в конфиге допущена ошибка?

7204_XXXXX_NAS#sh run
Building configuration...

Current configuration : 6063 bytes
!
! Last configuration change at 07:59:56 YSD Sun May 15 2011 by aerounit
! NVRAM config last updated at 22:14:04 YSD Wed May 11 2011 by aerounit
!
version 12.3
service timestamps debug datetime localtime
service timestamps log datetime localtime
service password-encryption
!
hostname 7204_XXXXX_NAS
!
boot-start-marker
boot system flash disk0:c7200-is-mz.123-26.bin
boot-end-marker
!
enable secret 5 $1$K7hB$OIQLs1RSPdv37Tbu9WA/p.
!
clock timezone XXXXX 9
clock summer-time YSD recurring last Sun Mar 2:00 last Sun Oct 2:00
clock calendar-valid
aaa new-model
aaa session-mib disconnect
!
!
aaa group server radius xxxxxxx
server XXX.XXX.XXX.XXX auth-port XXXXX acct-port XXXXX
!
aaa authentication username-prompt Login:
aaa authentication login default local
aaa authentication ppp xxxxxxx group xxxxxxx
aaa authorization network xxxxxxx group xxxxxxx
aaa accounting delay-start
aaa accounting update periodic 5
aaa accounting network xxxxxxx start-stop group xxxxxxx
aaa nas port extended
aaa pod server port XXXX auth-type any server-key xxxxxxxxxxxxx
aaa session-id common
ip subnet-zero
!
!
no ip cef
ip name-server xxxxxxxxxxxx
ip name-server xxxxxxxxxxxx
ip name-server xxxxxxxxxxxx
!
virtual-profile virtual-template 2
vpdn enable
!
vpdn-template 1
!
vpdn-group 1
! Default PPTP VPDN group
accept-dialin
  protocol pptp
  virtual-template 1
!
!
!
!
!
!
!
!
!
!
!
!
username xxxxxxxxxxxx privilege 15 password 7 xxxxxxxxxxxx
username xxxxxxxxxxxx password 7 xxxxxxxxxxxx
!
!
!
class-map match-any Best-Effort
  match protocol http
  match protocol secure-http
  match protocol pptp
  match protocol telnet
  match protocol ssh
  match protocol pop3
  match protocol smtp
  match protocol imap
  match protocol dns
  match protocol ntp
class-map match-any Real-Time
  match protocol rtp
!
!
policy-map QoS
  class Real-Time
   priority percent 25
   set ip precedence 5
  class Best-Effort
   bandwidth percent 40
   set ip precedence 1
  class class-default
   fair-queue
!
!
!
bba-group pppoe global
virtual-template 2
ac name XXXXX_nas1
!
!
interface Loopback0
ip address 10.0.0.1 255.255.255.255
!
interface FastEthernet0/0
no ip address
no ip mroute-cache
duplex auto
speed auto
max-reserved-bandwidth 90
service-policy output QoS
!
interface FastEthernet0/0.184
description *** class-c ***
encapsulation dot1Q 184
ip address XXX.XXX.xxx.1 255.255.255.240
ip nat outside
!
interface FastEthernet0/0.201
description *** management ***
encapsulation dot1Q 201
ip address 192.168.254.200 255.255.255.0
!
interface FastEthernet0/0.210
description *** PPPoE access ***
encapsulation dot1Q 210
ip address 192.168.4.1 255.255.255.0
!
!
interface FastEthernet0/0.219
description *** test ***
encapsulation dot1Q 219
ip address 172.16.1.1 255.255.255.0
pppoe enable group global
no cdp enable
!
interface FastEthernet0/0.300
description *** PPPoE access ***
encapsulation dot1Q 300
shutdown
pppoe enable
!
interface FastEthernet0/0.470
description *** TTK-XXXXX ***
encapsulation dot1Q 470
ip address XXX.XXX.XXX.14 255.255.255.252
no ip mroute-cache
!
interface FastEthernet0/1
description ttk Public Inet internal
no ip address
ip route-cache policy
ip route-cache flow
duplex full
speed 100
!
interface Virtual-Template1
ip unnumbered FastEthernet0/0.201
peer default ip address pool mgmnt
no keepalive
!
interface Virtual-Template2
ip unnumbered Loopback0
ip nat inside
no peer default ip address
ppp authentication chap callin xxxxxxx
ppp authorization xxxxxxx
ppp accounting xxxxxxx
ppp ipcp dns XXX.XXX.XXX.6 XXX.XXX.XXX.2
max-reserved-bandwidth 90
!
ip local pool mgmnt 192.168.254.250 192.168.254.254
ip nat inside source list NAT interface FastEthernet0/0.184 overload
ip classless
ip route 0.0.0.0 0.0.0.0 XXX.XXX.XXX.14
no ip http server
!
!
!
ip access-list extended NAT
permit ip 10.99.0.0 0.0.255.255 any
ip radius source-interface FastEthernet0/0.184
!
!
!
radius-server attribute 44 include-in-access-req
radius-server attribute 44 extend-with-addr
radius-server attribute 6 on-for-login-auth
radius-server attribute 8 include-in-access-req
radius-server attribute 32 include-in-access-req
radius-server attribute nas-port format e UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
radius-server attribute 31 mac format ietf
radius-server configure-nas
radius-server host XXX.XXX.XXX.XXX auth-port XXXXX acct-port XXXXX non-standard key 7 XXXXxxxxxxXXXXXx
radius-server timeout 30
radius-server vsa send accounting
radius-server vsa send authentication
!
!
dial-peer cor custom
!
!
!
!
gatekeeper
shutdown
!
!
line con 0
exec-timeout 0 0
password 7 XXXXxxxxxxXXXXXx
login authentication CONSOLE
stopbits 1
line aux 0
stopbits 1
line vty 0 4
exec-timeout 20 0
!
ntp clock-period 17179953
ntp master
ntp server 93.185.187.89
ntp server 195.200.216.144 prefer
ntp server 212.192.253.178
ntp server 84.52.68.212
!
end

7204_XXXXX_NAS#