>>[оверквотинг удален]
> короче нужна более детальная схема, и более полные конфиги.

вот конфиги 3560 и 3825 (немного подрезанные, но самое главное видно)

конфиг 3825:
--------------
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip cef
!
ip flow-egress input-interface
ip flow-cache timeout active 1
no ip domain lookup
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
voice-card 0
no dspfarm
!
!
username xxx
!
interface GigabitEthernet0/0
ip address 91.xxx.xxx.xxx 255.255.255.0
ip nat outside
ip virtual-reassembly
ip route-cache policy
ip policy route-map MAP
duplex auto
speed auto
media-type rj45
arp timeout 600
!
interface GigabitEthernet0/1
no ip address
ip route-cache flow
duplex auto
speed auto
media-type rj45
!
interface GigabitEthernet0/1.2
encapsulation dot1Q 2
ip address 10.1.3.241 255.255.255.252
!
interface GigabitEthernet0/1.50
encapsulation dot1Q 50
ip access-group 100 in
ip flow ingress
ip flow egress
!
interface GigabitEthernet0/1.70
description inet_to_hotel
encapsulation dot1Q 70
ip address 192.168.71.1 255.255.255.0 secondary
ip address 192.168.70.1 255.255.255.0
ip access-group 100 in
ip flow ingress
ip flow egress
ip nat inside
ip virtual-reassembly
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 91.197.xxx.xxxx
!
no ip http server
no ip http secure-server
ip nat pool lan70 91.197.xxx.xxx 91.197.xxx.xxx netmask 255.255.255.0
ip nat inside source list 70 pool lan70 overload
!
logging trap debugging
logging origin-id hostname
logging facility daemon
access-list 2 permit 82.198.164.22
access-list 3 permit 192.168.0.0 0.0.0.255
access-list 4 permit 192.168.1.0 0.0.0.255
access-list 6 permit 192.50.50.0 0.0.0.255
access-list 23 permit 10.10.10.0 0.0.0.7
access-list 70 permit 192.168.70.0 0.0.0.255
access-list 70 permit 192.168.71.0 0.0.0.255
access-list 71 permit 192.168.71.0 0.0.0.255
access-list 100 dynamic NETAMS deny   ip any any
access-list 100 permit ip any any
access-list 170 permit ip any 192.168.70.0 0.0.0.255
access-list 171 permit ip any 192.168.70.0 0.0.0.255!
!
control-plane
!
end
---------------

конфиг 3560 с поднятым DHCP:
---------------
aaa session-id common
regexp optimize
system mtu routing 1500
ip subnet-zero
no ip domain-lookup
ip dhcp excluded-address 192.168.71.1
ip dhcp excluded-address 192.168.71.255
ip dhcp ping packets 0
!
ip dhcp pool DHCP
   network 192.168.71.0 255.255.255.0
   default-router 192.168.71.1
   dns-server 91.197.xxx.xxx
   domain-name dhcp.xxx
!
!
mls qos
!
!
no errdisable detect cause sfp-config-mismatch
no errdisable detect cause gbic-invalid
no file verify auto
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
policy-map pm_test
!
!
interface GigabitEthernet0/1
switchport access vlan 50
switchport mode access
!
interface GigabitEthernet0/2
!
..много интерфейсов..
!
interface Vlan70
ip address 192.168.70.2 255.255.255.0
!
ip default-gateway 10.1.3.241
ip classless
no ip http server
!
!
access-list 2 deny any
!
control-plane
!
!
end
-----

Заранее спасибо!