I have written this config on a 1811 where two vlans are natted to the internet while protecting one from the other. Basically the 10 network will be considered private or administrative and the 172 ...