I use Cisco ASA in branches of our organization. Each device has an IPsec tunnel that connects to the main office. To access the global network each device also has a NAT. Recently, a task arose to forward all branch traffic into the tunnel to the main office and access Internet through the main office device.

So I have to create some kind of set of rules that will switch Internet connection from tunnel to local NAT if we have an accident in main office. Is exist some kind of mechanism on Cisco ASA looks like a SLA Monitor that can shutdown NAT rules? Can I use PBR for this task?

Thank you in advance.

  • 3
    Why do you want to NAT? You should not use NAT for intra-company networks. Simply use routing and avoid all the problems and limitations of NAT. NAT is not a substitute for routing.
    – Ron Maupin
    Jan 18, 2022 at 16:58
  • @RonMaupin I left the answer below. We need a backup connection in case the HQ device suddenly stops working.
    – Ruslan
    Jan 18, 2022 at 20:33
  • You should use a dynamic routing protocol to automatically switch your routing to a different tunnel when the first tunnel goes down. This all seems to be Routing 101.
    – Ron Maupin
    Jan 18, 2022 at 21:19
  • You can use a "tracked" route to change the default GW when the tunnel is down. (i.e. apply a lower metric route)
    – Ricky
    Jan 19, 2022 at 5:06
  • Yes use policy based routing (PBR) configuration on traffic routing from any one of tunnel .. so we can have control over traffic among both tunnel.. Jan 27, 2022 at 19:00

1 Answer 1


I have to create some kind of set of rules that will switch Internet connection from tunnel to local NAT

Don't use NAT with the tunnel interface. Your local, private IP addresses make perfect sense to the main office routers, so there's absolutely no reason to use NAT. NAT is a kludge, an ugly hack that is required to connect private networks to public ones. All NAT happens in the main office, so there's no sense in translating before the tunnel.

You need to point your router's default route into the tunnel (interface). For it to still be able to connect to the HQ router, create a specific route to that destination with your former default gateway.

Before: -> ISP gateway


HQ public address/32 -> ISP gateway -> VPN tunnel

The main office router requires policies to allow your branch office address range to connect to the Internet, using NAT. Done.

  • Yes, it is rules to forward branch traffic through tunnel. I have already created these rules in some branches. But imagine the situation that the device in the central office does not work, and users in branches lose the way to Internet. So the NAT must be configured on branch device but only as backup configuration which is triggered if the IP of HQ has stopped pinging. I'm looking for a solution to implement auto-switching.
    – Ruslan
    Jan 18, 2022 at 20:25
  • 2
    You could create a second default route to the local ISP gateway with a high cost/metric.
    – Zac67
    Jan 18, 2022 at 21:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.