Hello.
I have an IPsec tunnel acting as a backup path for an internal (EIGRP) link on ASA. It will be triggered only if the internal link goes down and since traffic does not find any EIGRP route then it will be matched with the default route and brings up the tunnel. On the tunnel we PAT all traffic behind a single IP address.
The problem is that the traffic ignores route-lookup (phase 2) and match the PAT (UN-NAT Lookup) and triggers the tunnel. So the tunnel always handles the traffic. There is no option to enable the proxy-arp on dynamic NAT. Is there any solution or I should move the tunnel to a different device?
