Здравствуйте уважаемые.
Помогите новичку пожалуйста.

Как при такой конфигурации:

version 15.1
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
no service dhcp
!
hostname CISCO-881
!
boot-start-marker
boot-end-marker
!
!
logging buffered 100000
logging monitor errors
!
no aaa new-model
!
memory-size iomem 10
no ip source-route
!
!
!
ip vrf extnet
!
!
!
ip cef
no ip bootp server
no ip domain lookup
ip domain name xxxxxx.ru
ip name-server 192.168.200.1
ip name-server 192.168.200.11
no ipv6 cef
!
!
multilink bundle-name authenticated
crypto pki token default removal timeout 0
!
crypto pki trustpoint TP-self-signed-458237257
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-458237257
revocation-check none
!
!
crypto pki certificate chain TP-self-signed-458237257
certificate self-signed 01 nvram:IOS-Self-Sig#4.cer
license udi pid CISCO881-SEC-K9 sn FCZ151492SD
!
!
!
no spanning-tree vlan 1
no spanning-tree vlan 2
username root privilege 15 secret 5
!
!
!
!
!
!
interface Loopback1
ip vrf forwarding extnet
ip address 10.0.0.250 255.255.255.255
!
interface Tunnel1
description extnet
bandwidth 10000
ip vrf forwarding extnet
ip address 192.168.20.2 255.255.255.252
ip mtu 1400
tunnel source FastEthernet4
tunnel destination xxx.xx.x.xxx
!
interface FastEthernet0
!
interface FastEthernet1
switchport access vlan 2
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
description $ES_WAN$
ip address yy.yyy.yyy.yy 255.255.255.248
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$
ip address 192.168.200.230 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip virtual-reassembly in
ip tcp adjust-mss 1452
!
interface Vlan2
description extnet2
ip address 192.168.23.111 255.255.255.224
no ip redirects
no ip unreachables
no ip proxy-arp
ip tcp adjust-mss 1452
!
ip local pool extnet 10.0.0.1 10.0.0.250 group extnet
no ip forward-protocol nd
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
!
ip nat inside source route-map provider interface FastEthernet4 overload
ip route 0.0.0.0 0.0.0.0 yy.yyy.yyy.y
ip route 172.20.200.21 255.255.255.255 Vlan2
ip route 172.20.200.25 255.255.255.255 Vlan2
ip route vrf extnet 0.0.0.0 0.0.0.0 Tunnel1
!
ip access-list extended LAN_IN
permit ip any any
!
logging esm config
logging trap debugging
logging 192.168.200.100
access-list 23 permit 192.168.200.100
access-list 23 permit 192.168.200.65
no cdp run

!
!        
!
!
route-map provider permit 10
match ip address nat-traffic LAN_IN
match interface FastEthernet4
!
!
control-plane
!
!
line con 0
login local
no modem enable
line aux 0
line vty 0 4
access-class 23 in
privilege level 15
login local
transport input telnet ssh
!
end

Что бы была доступна сеть extnet2 из сети extnet? И было бы совсем замечательно если бы еще и локальную сеть видела та что на Vlan1.
Все что смог сделать, это на Vlan2 так же сделать NAT но все равно сеть exnet не видит exnet2 =(