I'm having some difficulty with this scenario. I have an "Internet Edge" whereby all of my regular traffic is firewalled, NATed and sent on it's way. I also have a "Wan Aggregation" layer where a router connects via various WAN technologies to other branch offices.
One of these branches happens to be a floating branch, whose public ip address changes periodically, and is connected via IPSEC VTI. The trouble lies in that, while the tunnel comes up, the wan aggregation router is actually sending it's ISAKMP and ESP packets out it's default route, instead of out it's configured public ip address. I can't change the default route because then all branch traffic would exit on that ip address as well (and not be filtered/firewalled/etc).
The default (and all other) routes are propagated through OSPF.
I considered doing something with VRF, but I want to add TEST-MDF's networks OSPF, and it looks to be a huge pain to leak routes into the global routing table.
I also played around with policy based routing by creating an access list permitting esp, isakmp, and non500-isakmp from any to any and applying it to just about every interface.
Here's the relevant config:
TEST-MDF:
crypto isakmp policy 1
encr aes
authentication pre-share
group 2
crypto isakmp key cisco address 0.0.0.0 0.0.0.0
!
crypto ipsec transform-set TSET esp-aes esp-sha-hmac
!
crypto ipsec profile VTI
set transform-set TSET
!
interface Loopback0
ip address 10.9.8.1 255.255.255.0
ip ospf network point-to-point
ip ospf 1 area 9
!
interface Tunnel0
ip unnumbered Loopback0
ip ospf 1 area 9
tunnel source FastEthernet0/0
tunnel destination 1.1.1.5
tunnel mode ipsec ipv4
tunnel protection ipsec profile VTI
!
interface FastEthernet0/0
ip address 1.2.1.2 255.255.255.0
!
router ospf 1
log-adjacency-changes
!
ip route 0.0.0.0 0.0.0.0 1.2.1.1
CNT-MDF-WANAGG#
crypto isakmp policy 1
encr aes
authentication pre-share
group 2
crypto isakmp key cisco address 0.0.0.0 0.0.0.0
crypto isakmp profile IKE-DEFAULT
keyring default
match identity address 0.0.0.0
virtual-template 1
!
!
crypto ipsec transform-set TSET esp-aes esp-sha-hmac
!
crypto ipsec profile VTI
set transform-set TSET
set isakmp-profile IKE-DEFAULT
!
interface Loopback0
ip address 10.0.0.5 255.255.255.255
ip policy route-map RM-VPN
ip ospf network point-to-point
ip ospf 1 area 0
!
interface Loopback100
ip address 10.4.8.1 255.255.255.0
ip ospf network point-to-point
ip ospf 1 area 4
!
interface FastEthernet0/0
ip address 10.255.0.1 255.255.255.254
ip policy route-map RM-VPN
ip ospf 1 area 0
!
interface FastEthernet0/1
ip address 1.1.1.5 255.255.255.0
ip policy route-map RM-VPN
!
interface Virtual-Template1 type tunnel
ip unnumbered Loopback0
ip virtual-reassembly
ip policy route-map RM-VPN
ip ospf 1 area 9
tunnel source FastEthernet0/1
tunnel mode ipsec ipv4
tunnel protection ipsec profile VTI
!
router ospf 1
log-adjacency-changes
!
ip local policy route-map RM-VPN
!
ip access-list extended VPN
permit esp any any
permit gre any any
permit udp any any eq isakmp
permit udp any any eq non500-isakmp
!
route-map RM-VPN permit 1
match ip address VPN
set ip default next-hop 1.1.1.1