VPN and NAT

[gcook0001]

I am fairly new with the Firepower firewalls.  I was wondering if this is possible.

I want one profile to use split tunneling.  So I have nat(inside,outside) after-auto source static inside inside destination inside inside

I want one profile to send all traffic over the VPN.   So from what I understand I need to add the following nat(outside, outside) after-auto source static outside outside destination outside outside

I don't have a way to test this except on production so I am hoping for some feedback.

Is the second nat correct

Can I have both nats or will they interfere with each other.

[Marius Gunnerud]

Just out of curiosity, is there any reason why you are placing these NAT statements in the after-auto section?  It is more common to see these type of NAT statements in manual NAT section.

If the Firepower device is the only gateway to the internet then yes, you would need to add a NAT statement that references the ingress and egress interfaces as outside outside.

Here is a guide for your reference: https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/215875-configure-anyconnect-vpn-client-on-ftd.pdf

[gcook0001]

I actually didn't create the NAT.  TAC did.  

I am just wondering if the two NATs would conflict with each other.

[Marius Gunnerud · Accepted solution]

I am just wondering if the two NATs would conflict with each other.

Well, no they would not conflict with each other, as long as you are defining the subnets correctly for the inside,outside NAT statement and not using "any" as the inside subnet