IPsec site-to-site VPN vs WAN

[Tanma29]

I'm new and trying to understand how the traffic decision would be made if following were the scenario,

Currently the client is connected through a MPLS ciruit + router, this circuit is set to decommission after 3 months due to low bandwidth utilization and they want us to setup a site to site IPsec VPN on our ASA which is facing the internet. This traffic would be only Inbound from their side IPs to ours, hence we will be using their public PAT as interesting traffic with many of our subnets.

Now if I deploy this tunnel, would the traffic still route through the dedicated WAN or would it switch to VPN right away and drop all connections coming from WAN circuit?

[Rob Ingram]

@Tanma29 without knowing your environment, I can only guess.

I imagine your traffic would still go via your MPLS, if you are using a dynamic routing protocol for routing traffic over the MPLS? If you do, only when the MPLS is decommissioned will those dynamically learned routes be removed from the routing table. All traffic would then normally be routed via the default route, which if that's your ASA then a VPN tunnel would be established (assuming the configuration is correct).

If that assumption is incorrect, please let us know more information about your environment.

[Tanma29]

@Rob Ingram  Thanks for the reply, Sorry let me explain little more about the current setup
The IPs (interesting client traffic) coming from VPN ASA are NATed internally and this NAT IPs are learned to our Datacenter through BGP. And yes WAN circuit routes are learnt via BGP from client facing edge router to our Datacenter.

So client side IPs(real IPs) are learnt directly through client edge router.

Their PAT from VPN is then internally Static NATed and this is learnt through BGP.

So if they initiate traffic towards one of our servers after I setup the IPsec tunnel, would it still prefer MPLS routes and come as real IPs or would they get PATed and reach us through VPN

[MHM Cisco World]

Hi, depend on
if you receive Default route from the MPLS SP and you use default route in ASA 
then sure you will face some incorrect routing,