Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to do split tunnelling with a site to site VPN connection using Cisco ASAs?

We have a Cisco ASA 5510 at head office, and Cisco 5505 in our branch office, currently connected via a Site-To-Site VPN. I'd like to give direct access to the internet for hosts in the branch office. Is it possible. I know it can be done for Remote Access VPN connections (Easy VPN), but can't find any documentation on Site-To-Site, so wondering if it is missing, or isn't there because it can't be done.

share|improve this question
up vote 1 down vote accepted

Your standard site-to-site IPSec tunnel is only going to match "interesting" traffic: that is, your destination and source IP address matches the encrypt ACL setup.

Unless you set something up like in your encrypt acl (or are using a proxy at head office), it should already be split-tunneled.


You should be able to do a traceroute to Google, etc. to verify that your packets are leaving your 5505.

share|improve this answer
Thanks. That's a nice answer. My searching is fruitless, but I can do what I need anyway :-) – dunxd Feb 3 '11 at 13:40
Why'd you unmark this as the correct answer? – gravyface Feb 4 '11 at 21:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.