Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

How can I make protected traffic go over the VPN and the internet not?

Hi,

I have a VPN on a DSL line on a remote office which connects to a Cisco ASA where our HQ is. The VPN works fine but any internet page request go over the VPN to the HQ. I would prefer if possiblt to use the routers DSL/ISP to do the internet page request freeing up the tunnel, like splitting the traffic.

Is this possible?

7 REPLIES
Green

Re: How can I make protected traffic go over the VPN and the int

The following line describes traffic you want to go over the tunnel. Currently it is set to any.

access-list 101 permit ip 172.19.12.0 0.0.0.255 any

Change that to reflect the remote network only.

access-list 101 permit ip 172.19.12.0 0.0.0.255

New Member

Re: How can I make protected traffic go over the VPN and the int

I see, this defines this ACL allowed Crypto traffic. Will I have to add any routes or amend the current default route?

Re: How can I make protected traffic go over the VPN and the int

The crypto map associates a crypto ACL with a peer (crypto endpoint).

If the crypto ACL specifies the specific address space that is behind a peer (i.e.: not using keyword "any"), then your endpoint knows which peer to forward traffic to, in order to reach that address space.

New Member

Re: How can I make protected traffic go over the VPN and the int

I tried:

access-list 101 permit ip 172.19.12.0 0.0.0.255 any

Change that to reflect the remote network only.

access-list 101 permit ip 172.19.12.0 0.0.0.255 192.168.21.0 0.0.0.255

Now I can still access the servers, but nolonger get internet access.

Re: How can I make protected traffic go over the VPN and the int

conf t

interface Vlan1

ip nat inside

interface Dialer1

ip nat outside

ip access-list ext NAT

deny ip host 172.19.12.1 any

deny ip 172.19.12.0 0.0.0.255 remote-vpn-nets

permit ip 172.19.12.0 0.0.0.255 any

ip nat inside source list NAT interface Dialer1 overload

ip address 172.19.12.1 255.255.255.0

New Member

Re: How can I make protected traffic go over the VPN and the int

Thanks, do I have to reference "remote-vpn-nets" or list every subnet somewhere?

eg:

deny ip 172.19.12.0 0.0.0.255 192.168.30.0 0.0.0.255

deny ip 172.19.12.0 0.0.0.255 192.168.40.0 0.0.0.255

etc?

Plus do I need anything else with "ip address 172.19.12.1 255.255.255.0" as this is already under VLAN 1?

Cheers

Re: How can I make protected traffic go over the VPN and the int

you have crypto acl

access-list 101 permit ip 172.19.12.0 0.0.0.255 192.168.21.0 0.0.0.255

you should exclude you vpn traffic from the NAT

conf t

interface Vlan1

ip nat inside

interface Dialer1

ip nat outside

ip access-list ext NAT

deny ip host 172.19.12.1 any

deny ip 172.19.12.0 0.0.0.255 192.168.21.0 0.0.0.255

permit ip 172.19.12.0 0.0.0.255 any

ip nat inside source list NAT interface Dialer1 overload

112
Views
0
Helpful
7
Replies
CreatePlease to create content