I have these two nets connected over the public internet with ASA 5510s. < -- ASA1 ---> Internet <--- ASA2 -->

Each net does either a simple dynamic or static nat for outbound access over it's local ASA. Easy peezy stuff.

The IPSEC tunnel is pretty straightforward. ACL allows all traffic inbetween. Net to Net NONAT rules.

What I want to do is take a single host ( and redirect its public outgoing traffic out through the ASA2 WAN gateway, as opposed to the usual ASA1.

I believe it's possible but having trouble figuring it out. I've read about a few solutions, some of which require creating a dummy interface to NAT through? Can anyone lend a hand? Thanks.

closed as too broad by Ron Maupin Dec 10 '18 at 0:25

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • You need to edit your question to give us more information. At least the ASA model and software versions, and the (sanitized) ASA configurations. – Ron Maupin Sep 1 '18 at 23:06
  • As both ASA's have a default route to the internet, it will be very difficult to force a single host's traffic to ignore that and cross the tunnel to the remote end. The second issue is getting "all" traffic to cross an ASA tunnel -- without messing with any other traffic. – Ricky Beam Sep 2 '18 at 1:40

You should be able to use policy based routing (PBR) to get traffic from your single inside host to use the tunnel as its next hop rather than going to the default route of the ASA. At that point you'll probably have to adjust some of the policies on ASA2 to allow and NAT the traffic out to the internet, but that should be similar to setting up any other VPN-to-Internet traversal.

Not the answer you're looking for? Browse other questions tagged or ask your own question.