I have a Cisco router with Site to Site IPSec. I am wondering if you're able to split tunnel a single host inside, out to the internet, that is also referenced in the interesting traffic ACL?
How does the order of operations work for VPN interesting traffic versus NAT overload?
Interesting Traffic ACL: 10.1.1.0/24 PAT Host : 10.1.1.20
If the 10.1.1.20 sends traffic, will it hit the crypto ACL and transport across the ipsec tunnel, or will it PAT across the WAN using the NAT overload? It has just a single default static route out to the internet.
If it doesn't, do you have to break apart your interesting ACL to exclude the host, or dney it across the tunnel in the VPN interesting traffic ACL?