Exclude 1 host (IP Address) from VPN Tunnel

Question

Hi Experts,
May I ask your help on this?
Current setup:
L2L VPN between site1 and site2
[site1]--------------------[internet]-------------------[site2]
10.0.100.0/24-----------------------------10.0.1.0/24
Planned setup:
L2L VPN between site1 and site2
[site1]--------------------[internet]-------------------[site2]
10.0.100.0/24-----------------------------10.0.1.0/24
with 1 host (10.0.100.50) excluded on the NAT Process for Site-to-site VPN thus NATting him directly to the internet.
Has someone done this before?
I'm planning to add 10.0.100.50 to be denied on the access-list from the VPN Traffic.
Dunno if that will work though.
Hope someone could give their thoughts on this.
Thank you.
Regards,
Jem

Answer 1

Hi,
I would imagine that it would be the easiest to simply block this hosts traffic towards the remote site in the interface ACL of this hosts local firewall/vpn device rather than doing this with NAT.
I am not sure what software level you are running and what devices you are using.
If I dont remember wrong, I think you could use "deny" statements in the 8.2 (and below) software levels which would essentially ignore the NAT0 for some hosts while do it for others.
Something like
access-list INSIDE-NAT0 deny ip host 10.0.100.50 10.0.1.0 255.255.255.0
access-list INSIDE-NAT0 permit ip 10.0.100.0 255.255.255.0 10.0.1.0 255.255.255.0
nat (inside) 0 access-list INSIDE-NAT0
The above is just an example.
I dont think this is even possible in the newer 8.3 (and above) software levels as they dont use ACLs for NAT rules anymore.
But again, if limiting access is your aim I would suggest using interface ACL
- Jouni