Cisco ASA VTI VPN route specific IP to outside

[chrisbuchner]

Hi Experts,

I would like to know what would be the right config to reroute specific IP addresses to the outside for a subnet on the inside whilst having the rest of the traffic go over the VTI tunnel.

Currently all traffic is going over the VTI tunnel but there could come a day where a specific IP needs to break out directly over the local outside interface which is a static IP.

Currently I am using no ACL's etc as all traffic is just routed over the Ikev2 VTI tunnel.

My best guess is to have possibly ACL's to allow the local Subnet to go to the Outside Public IP's + Set the routes for the Public IP's/websites to the outside interface, and maybe a NAT? But I am not too sure what that would look like all together?

object network LAN

subnet 10.0.0.0 255.255.255.0

object-group network Websites

network-object 8.8.8.8 255.255.255.255

network-object 123.123.123.123 255.255.255.255

network-object 123.123.123.132 255.255.255.255

access-list inside_in extended permit tcp object LAN object-group Websites eq https

access-list inside_in extended permit tcp object LAN object-group Websites eq www

access-list inside_in extended permit icmp object LAN object-group Websites

access-list from_outside extended permit tcp object-group Websites object LAN eq https

access-list From_outside extended permit tcp object-group Websites object LAN eq www

access-list From_outside extended permit icmp object-group Websites object LAN

Nat????

Thanks for your assistance!

[MHM Cisco World]

Use pbr here.

Only specific traffic will pass through vti.

[chrisbuchner]

Excellent, Thanks for the pointer. 

Might be a dumb question but without NAT how would the local subnet be allowed to reach the websites or do I add a general NAT since it will only be used for the specific IPs going over Inside to outside and the rest will be unnatted over the VTI?

[MHM Cisco World]

Traffic pass through vti will not nat.

Only traffic go directly will be nat.

[chrisbuchner]

Last question, Do I have to add NAT or because of policy map it will automatically be natted based on INSIDE subnet in policy going to outside public IP?