site-to-site: exclude single IP

[michaely360]

Hi,

I inherited a setup with an ASA 5505 (running 9.1) at the remote site (Site B) connected via a site-to-site VPN to a firewall in our main site (Site A). This is the first Cisco device I have managed so I'm using the ADSM interface.

Under Site-to-Site VPN > ACL Manager I see rules for permitting all traffic from Site B to Site A.

In Site A we host a web service which is available via a public IP. This service is sensitive to network connectivity but because the VPN isn't very stable (due to a poor internet connection at Site B) I'd rather send requests for that service over the internet, rather than through the VPN tunnel. How can I do this?

Lastly, the internal DNS at Site B will resolve our web service to an internal IP (eg 192.168.0.10). So I presume I also need to do some NAT translation to get it to target the public IP?

Any help greatly appreciated.

Michael.

[Pawan Raut · Accepted solution]

First if you want access site A web service host from site B over VPN then you have to do the NAT for web service host with Public IP.

Also you want o exclude that IP  (eg 192.168.0.10) from VPN then use deny statement at top in vpn acl for IP that IP  (eg 192.168.0.10)

[michaely360]

Thanks. I'll create the NAT rule first, then add the 'exclude' rule to the VPN.

Is there a way to test or check logs to see whether its working from within ADSM?

[Pawan Raut · Accepted solution]

Apart from ASDM logs You can test it with packet tracer on Firewall as well.

Kindly rate for useful post please.