Как я и говорил, попробовал забить конфиг на стенд.
В качестве "подопытной" 1861
В конфиге ни используется дополнительный Lo.
На сервере настроен Split Tunnel.

Конфиг:

ip dhcp pool data
   network 10.128.90.0 255.255.255.0
   default-router 10.128.90.1
   dns-server 10.128.90.1
!
!
crypto isakmp policy 71
encr 3des
hash md5
authentication pre-share
group 2
lifetime 3600
!        

!
crypto ipsec client ezvpn VPN-MTSBU
connect auto
group GROUP key KEY
mode client
peer XXX.XXX.XXX.20
xauth userid mode interactive
!

interface FastEthernet0/0
ip address dhcp
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
no cdp enable
crypto ipsec client ezvpn VPN-MTSBU
!
!
interface FastEthernet0/1/2
switchport access vlan 3
spanning-tree portfast
!

!
interface Vlan3
description DATA INT
ip address 10.128.90.1 255.255.255.0
ip nat inside
ip virtual-reassembly
crypto ipsec client ezvpn VPN-MTSBU inside
!        
ip nat inside source list TONAT interface FastEthernet0/0 overload
!
ip access-list extended TONAT
permit ip 10.128.90.0 0.0.0.255 any

___________________________________________________________________________

Ввиду того, что стоит запрет сохранения пароля, даем команду:

Router#crypto ipsec client ezvpn xaut
Username: VASYA
Password:
Router#
Jun 27 11:27:42.067: %CRYPTO-6-EZVPN_CONNECTION_UP: (Client)  User=  Group=vpn_group1  Client_public_addr=192.168.1.2  Server_public_addr=XXX.XXX.XXX.20  Assigned_client_addr=172.30.0.8  
Router#
Jun 27 11:27:42.975: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback10000, changed state to up

Router#sh crypto ipsec client ezvpn
Easy VPN Remote Phase: 8

Tunnel name : VPN-MTSBU
Inside interface list: Vlan3
Outside interface: FastEthernet0/0
Current State: IPSEC_ACTIVE
Last Event: MTU_CHANGED
Address: 172.30.0.8 (applied on Loopback10000)
Mask: 255.255.255.255
Save Password: Disallowed
Split Tunnel List: 1
       Address    : 10.128.0.0
       Mask       : 255.255.0.0
       Protocol   : 0x0
       Source Port: 0
       Dest Port  : 0
      
      
Router#sh crypto session
Crypto session current status

Interface: FastEthernet0/0
Session status: UP-ACTIVE    
Peer: XXX.XXX.XXX.20 port 4500
  IKE SA: local 192.168.1.2/4500 remote XXX.XXX.XXX.20/4500 Active
  IPSEC FLOW: permit ip host 172.30.0.8 0.0.0.0/0.0.0.0
        Active SAs: 2, origin: crypto map
        
        
Router#sh ip route

Gateway of last resort is 192.168.1.1 to network 0.0.0.0

     172.30.0.0/32 is subnetted, 1 subnets
C       172.30.0.8 is directly connected, Loopback10000
C       10.128.90.0 is directly connected, Vlan3
C    192.168.1.0/24 is directly connected, FastEthernet0/0
S*   0.0.0.0/0 [254/0] via 192.168.1.1
      
      
Проверяем:      
C клиентской машины:
ping www.ru
ping 10.128.0.54 (комп за "головной" кошкой)      
      
Router#sh ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
icmp 172.30.0.8:512    10.128.90.2:512    10.128.0.54:512    10.128.0.54:512
icmp 192.168.1.2:512   10.128.90.2:512    194.87.0.50:512    194.87.0.50:512

Как то так....