cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
113
Views
5
Helpful
4
Replies

Cisco ASA VTI VPN route specific IP to outside

chrisbuchner
Beginner
Beginner

Hi Experts,

I would like to know what would be the right config to reroute specific IP addresses to the outside for a subnet on the inside whilst having the rest of the traffic go over the VTI tunnel.

Currently all traffic is going over the VTI tunnel but there could come a day where a specific IP needs to break out directly over the local outside interface which is a static IP.

Currently I am using no ACL's etc as all traffic is just routed over the Ikev2 VTI tunnel.

My best guess is to have possibly ACL's to allow the local Subnet to go to the Outside Public IP's + Set the routes for the Public IP's/websites to the outside interface, and maybe a NAT? But I am not too sure what that would look like all together?

object network LAN

subnet 10.0.0.0 255.255.255.0

object-group network Websites

network-object 8.8.8.8 255.255.255.255

network-object 123.123.123.123 255.255.255.255

network-object 123.123.123.132 255.255.255.255

access-list inside_in extended permit tcp object LAN object-group Websites eq https

access-list inside_in extended permit tcp object LAN object-group Websites eq www

access-list inside_in extended permit icmp object LAN object-group Websites

access-list from_outside extended permit tcp object-group Websites object LAN eq https

access-list From_outside extended permit tcp object-group Websites object LAN eq www

access-list From_outside extended permit icmp object-group Websites object LAN

Nat????

Thanks for your assistance!

 

4 REPLIES 4

MHM Cisco World
Advisor
Advisor

Use pbr here.

Only specific traffic will pass through vti.

Excellent, Thanks for the pointer. 

Might be a dumb question but without NAT how would the local subnet be allowed to reach the websites or do I add a general NAT since it will only be used for the specific IPs going over Inside to outside and the rest will be unnatted over the VTI?

Traffic pass through vti will not nat.

Only traffic go directly will be nat.

Last question, Do I have to add NAT or because of policy map it will automatically be natted based on INSIDE subnet in policy going to outside public IP?

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: