Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible to do split tunnelling with a site to site VPN connection using Cisco ASAs?

We have a Cisco ASA 5510 at head office, and Cisco 5505 in our branch office, currently connected via a Site-To-Site VPN. I'd like to give direct access to the internet for hosts in the branch office. Is it possible. I know it can be done for Remote Access VPN connections (Easy VPN), but can't find any documentation on Site-To-Site, so wondering if it is missing, or isn't there because it can't be done.

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Your standard site-to-site IPSec tunnel is only going to match "interesting" traffic: that is, your destination and source IP address matches the encrypt ACL setup.

Unless you set something up like 0.0.0.0 in your encrypt acl (or are using a proxy at head office), it should already be split-tunneled.

EDIT

You should be able to do a traceroute to Google, etc. to verify that your packets are leaving your 5505.

share|improve this answer
    
Thanks. That's a nice answer. My searching is fruitless, but I can do what I need anyway :-) –  dunxd Feb 3 '11 at 13:40
    
Why'd you unmark this as the correct answer? –  gravyface Feb 4 '11 at 21:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.