Topology All contents are Copyright Cisco Systems, Inc. Once traffic coming in from a remote site is decrypted and ready to go out to the Internet, that traffic would first need to go through the internal firewall/corporate router for Network Address Translation (NAT) and firewall inspection. The tunnel default gateway gives customers the flexibility to control how they handle IPsec tunneled traffic. In this type of implementation, the Cisco IOS routers use the default gateway to route all packets toward the Internet that do not have a more specific route. Today, after a Cisco IOS EasyVPN Client connects to a Cisco IOS EasyVPN Server, there is no simple way for the client to send the tunnel traffic to the internal corporate network (other than to have the entire routing table on the IPsec gateway). Problem Description The tunnel default gateway is needed to let the internal firewall and router handle the routing for all decrypted IPsec packets. This requirement is common and this paper discusses the best ways to implement this on most Cisco IP Security (IPsec) VPN devices, primarily routers.

Currently, there is no easy way for customers to have traffic that terminates on VPN tunnels go through one default gateway, while all other traffic (Internet Key Exchange, for example) uses a different default gateway. 1 Configuring Tunnel Default Gateway on Cisco IOS EasyVPN/DMVPN Server to Route Tunneled Traffic Introduction This document discusses Cisco tunnel default gateway implementations that are available as part of a Cisco EasyVPN/DMVPN solution.

Easyvpn overlapping subnets