Народ ! Помогите - что-то туплю не по-детски, а где? - понять не могу. Есть Cisco 877, но порт ADSL сейчас не использую. На interface FastEthernet3 подключен провайдер, на interface FastEthernet0 основная локалка, а на FastEthernet2 включил дополнительную сеть. Так вот: ping с копьютера основной сети не идет на ком.дополнительной сети. Что не так сделал?
Конфиг циски:
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Br877
!
boot-start-marker
boot system flash c870-advipservicesk9-mz.124-9.T.bin
boot-end-marker
!
logging buffered 51200 warnings
!
no aaa new-model
!
resource policy
!
ip cef
!
!
!
!
ip domain name XXXXXXXX
ip name-server XX.XX.XX.XXX
ip name-server YYY.YY.Y.YY
ip inspect name srv ssh
ip inspect name srv telnet
!
!
username xxxx privilege 15 secret 5 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
archive
log config
  hidekeys
!
!
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
lifetime 1800
crypto isakmp key 6 xxxxxxxKey address PROVIDER_IP PROVIDER_MASK no-xauth
crypto isakmp invalid-spi-recovery
crypto isakmp keepalive 1800 periodic
!
crypto ipsec security-association lifetime seconds 28800
!
crypto ipsec transform-set BNK esp-3des esp-sha-hmac
!
crypto map IPSec_Policy 20 ipsec-isakmp
set peer PROVIDER_IP
set transform-set BNK
set pfs group2
match address ipsec_acc
!
!
interface ATM0
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip virtual-reassembly
ip route-cache flow
shutdown
no atm ilmi-keepalive
dsl operating-mode auto
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
switchport access vlan 2
!
interface FastEthernet3
switchport access vlan 3
!
interface Vlan1
description Link to LAN
ip address 10.16.0.1 255.255.255.0
ip tcp adjust-mss 1452
!
interface Vlan3
description Link to Provider
ip address dhcp
ip access-group Tun_IN in
ip access-group Tun_OUT out
ip tcp adjust-mss 1452
crypto map IPSec_Policy
!
interface Vlan2
description local network 2
ip address 172.25.0.253 255.255.255.0
!
ip route 0.0.0.0 0.0.0.0 DEF_GATE_PROVIDER
!
!
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip access-list extended Tun_IN
permit icmp any any
permit ip host INTERNET_IP host MY_OUT_IP
permit udp any any eq bootpc
deny   ip any any
ip access-list extended Tun_OUT
permit icmp any any
permit ip host MY_OUT_IP host INTERNET_IP
permit udp any any eq bootpc
deny   ip any any
ip access-list extended ipsec_BNK
permit ip XX.XX.X.X 0.0.0.255 XX.0.0.0 0.255.255.255
permit ip host YYY.YY.Y.Y XX.0.0.0 0.255.255.255
!
access-list 23 permit INTERNET_IP
access-list 23 permit XX.X.X.X 0.0.0.255
access-list 23 permit 10.16.0.0 0.0.0.255
access-list 23 permit 172.25.0.0 0.0.0.255
no cdp run
!
!
!
!
control-plane
!
!
line con 0
login local
no modem enable
line aux 0
line vty 0 4
access-class 23 in
privilege level 15
login local
transport input telnet ssh
!
scheduler max-task-time 5000
end