On the Cisco ASA, for the "interesting traffic" ACL that defines what to tunnel to the remote site, you'd simply open up that "interesting traffic" ACL to include all traffic sourced by your internal LAN(s) destined for anywhere. This would cause all the traffic leaving the ASA's "inside" network to be tunneled over to your 3020. Also make sure you build a NoNAT exception on your ASA, so the ASA doesn't NAT any LAN traffic. You can then do NAT out to the Internet on your PA 3020. If you'd like help with the config on the ASA, you can PM me or post some config here if you're comfortable doing that. At a previous job I managed literally hundreds of IPsec tunnels with ASAs in three different parts of the country.
... View more
