Only traffic included on the ACL will be candidate for NAT.

If you don't want some flows to be NAT'd, don't include them on the NAT ACL.

NAT 0 is FW is for NAT exception. Not needed on Cisco IOS as traffic not included on the NAT ACL has an exception by default.

Regards,

Edison

In the acl that you're using for natting, deny the subnets that you're pushing across the vpn.

Suppose you have 192.168.1.0/24 and 192.168.2.0/24 on the other side. You want to nat 192.168.1.0 when it goes to the internet, but you don't want to nat across the tunnel.

ip nat insid source route-map NAT inte s0/0

access-list 100 deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255

access-list 100 permit ip any any

route-map NAT permit 5

match ip address 100

HTH,

John