Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
New Member

force split tunneling when go to selected website

i have a remote branch that connects to HQ (one subnet only) via site to site vpn with split tunneling enable. the tunnel is set up and is working. my vendor support website allows only known ip to connect. my branch office does not have static ip but the HQ has. my goal is force branch office to go thru the tunnel when it goes to support website.

the branch has 871 router and HQ has ASA5510

here is a section of the router config

! is branch
! is HQ subnet it can connect
! a.b.c.d is support vendor website

ip nat inside source route-map NoNAT interface FastEthernet4 overload
ip access-list extended S2Svpn
 permit ip
 permit ip host a.b.c.d

access-list 100 remark set up for S2S vpn tunnel
access-list 100 deny   ip
access-list 100 deny   ip host
access-list 100 permit ip any
access-list 100 deny   ip any
access-list 100 deny   ip any host a.b.c.d

route-map NoNAT permit 10

the problem is branch cannot access the support website. i did a trace route from branch. it seems it is going thru the tunnle but show xlate on asa does not show a translation. i have a NAT for the branch on the asa.

what do i miss

Everyone's tags (2)
VIP Purple

Something goes wrong with

Something goes wrong with your ACL 100. what are the last two deny-lines for and is that the ACL that you reference in the NoNAT route-map?

Have you enabled same-security-traffic permit intra-interface on the ASA?


Don't stop after you've improved your network! Improve the world by lending money to the working poor:
New Member

Solve the problem!the NAT was

Solve the problem!

the NAT was incorrect set on the ASA. should have set it to the outside interface.

CreatePlease to create content