Asav on azure

Try the following on routing VM traffic through the ASAv:

1.    Remove direct public IPs from the VMs
o    Keep only private IPs on your workload VMs.
o    This ensures they can’t bypass the ASAv.
2.    Place the ASAv in a dedicated subnet
o    Typically called a “hub” or “DMZ” subnet.
o    The ASAv has one NIC facing the workload subnet(s) and another NIC facing the Internet/VPN gateway.
3.    Create a User Defined Route (UDR)
o    In the workload subnet, add a route: 
    Destination: 0.0.0.0/0 (or the remote network CIDR if you only want VPN traffic)
    Next hop type: Virtual appliance
    Next hop IP: The ASAv’s inside NIC private IP
o    Associate this route table with your VM subnet.
4.    Configure the ASAv
o    On the ASAv, configure the VPN tunnel to your remote ASA.
o    Ensure NAT and ACLs are set so that traffic from the VM subnet is encrypted and sent through the tunnel.

access-list VPN-INTERESTING-TRAFFIC extended permit ip <VM-subnet> <Remote-subnet>
crypto map OUTSIDE-MAP 10 match address VPN-INTERESTING-TRAFFIC

o    Apply the crypto map to the ASAv’s outside interface.