2 added 1038 characters in body
source | link

How does the order of operations work for VPN interesting traffic versus NAT overload?

In this link you haveQuoting from the order of operations unorder of IPSec operations in Cisco IOS, including both IPSec and NAT.

http://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/6209-5.html

  • Inside to outside traffic:

    • If IPSec then check input access list decryption - for CET (Cisco Encryption Technology) or IPSec
    • check input access list
    • check input rate limits
    • input accounting
    • redirect to web cache
    • policy routing
    • routing
    • NAT inside to outside (local to global translation)
    • crypto (check map and mark for encryption)
    • check output access list
    • inspect (Context-based Access Control (CBAC))
    • TCP intercept
    • encryption
    • Queueing
  • Outside to Inside traffic:

    • If IPSec then check input access list
    • decryption - for CET or IPSec
    • check input access list
    • check input rate limits
    • input accounting
    • redirect to web cache
    • NAT outside to inside (global to local translation)
    • policy routing
    • routing
    • crypto (check map and mark for encryption)
    • check output access list
    • inspect CBAC
    • TCP intercept
    • encryption
    • Queueing

Regarding how to split traffic from a single host between the tunnel and the internet connection: you will need to include the destination at the other end of the tunnel in the ACL for interesting traffic and also make sure you have a route toto this destination vía the interface where the crypto map is applied.

In this link you have the order of operations un IOS, including both IPSec and NAT.

http://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/6209-5.html

Regarding how to split traffic from a single host between the tunnel and the internet connection: you will need to include the destination at the other end of the tunnel in the ACL for interesting traffic and also make sure you have a route to this destination vía the interface where the crypto map is applied.

How does the order of operations work for VPN interesting traffic versus NAT overload?

Quoting from the order of IPSec operations in Cisco IOS, including both IPSec and NAT.

  • Inside to outside traffic:

    • If IPSec then check input access list decryption - for CET (Cisco Encryption Technology) or IPSec
    • check input access list
    • check input rate limits
    • input accounting
    • redirect to web cache
    • policy routing
    • routing
    • NAT inside to outside (local to global translation)
    • crypto (check map and mark for encryption)
    • check output access list
    • inspect (Context-based Access Control (CBAC))
    • TCP intercept
    • encryption
    • Queueing
  • Outside to Inside traffic:

    • If IPSec then check input access list
    • decryption - for CET or IPSec
    • check input access list
    • check input rate limits
    • input accounting
    • redirect to web cache
    • NAT outside to inside (global to local translation)
    • policy routing
    • routing
    • crypto (check map and mark for encryption)
    • check output access list
    • inspect CBAC
    • TCP intercept
    • encryption
    • Queueing

Regarding how to split traffic from a single host between the tunnel and the internet connection: you will need to include the destination at the other end of the tunnel in the ACL for interesting traffic and also make sure you have a route to this destination vía the interface where the crypto map is applied.

1
source | link

In this link you have the order of operations un IOS, including both IPSec and NAT.

http://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/6209-5.html

Regarding how to split traffic from a single host between the tunnel and the internet connection: you will need to include the destination at the other end of the tunnel in the ACL for interesting traffic and also make sure you have a route to this destination vía the interface where the crypto map is applied.