IPsec manual routing from network NOT present in the IPsec configuration

[Matt_Sharpe]

We have an IPsec configuration with a simple configuration:

1 local subnet = 172.16.48.0/24
1 remote subnet = 172.16.200.0/24
1 ISOLATED remote subnet = 172.16.210.0/24

We have a requirement from a customer to allow RDP from the local subnet, to a machine on the ISOLATED subnet. The original plan is to perform a DNAT on the IPsec interface to the isolated IP address.

This is not working, and the obvious reason in my mind is that the ISOLATED subnet machine, needs a route back to the machine on the local subnet performing the RDP request.

How would we implement this required routing? Is it possible if the ISOLATED subnet is not part of the IPsec configuration?