How to define a static route from LAN device through IPSec endpoint to Peer

Question

From a PC that is attached to a Cisco Catalyst 3850 and Portchanneld to Cisco ISR I do a ping to a destination that is connected with BGP. That works for me.

The trace path looks like:

1: localhost (10.1.1.22)
2: gateway (10.1.1.18)
3: BGP Neigbhour (10.1.2.101)
4: destination IP (10.1.3.205)

On the ISR I configure a subdevice that works as IPSec Endpoint. Phase 1 comes up and the carrier confirm phase 1. Now I need to change my IP Route like that way for encryption:

1: localhost (10.1.1.22/28)
2: gateway (10.1.1.18/28)
3: IPSec subdevice (10.1.1.37/30)
4: BGP Neigbhour (10.1.2.101/30)
5: destination IP (10.1.3.205/27)

How can I reach this goal or anything wrong in my case?

The config of my Catalyst:

sh run int gi1/0/7
!
interface GigabitEthernet1/0/7
 description PC1
 switchport access vlan 30
end

sh run int gi1/0/4
!
interface GigabitEthernet1/0/4
 description carrier1
 switchport trunk allowed vlan 331
 switchport mode trunk
end

sh run int gi1/0/1    
!
interface GigabitEthernet1/0/1
 description PortChannel ISR
 switchport trunk native vlan 10
 switchport mode trunk
 channel-group 1 mode on
end

And this is the config of the ISR

sh run int po1.331
!
interface Port-channel1.331
 description carrier1
 encapsulation dot1Q 331
 ip address 10.1.2.102 255.255.255.252
end

sh run int po1.30 
!
interface Port-channel1.30
 encapsulation dot1Q 30
 ip address 10.1.1.18 255.255.255.240
end

sh run int po1.202
!
interface Port-channel1.202
 description IPsec Interconnect
 encapsulation dot1Q 202
 ip address 10.1.1.37 255.255.255.252
 no ip redirects
 no ip proxy-arp
 crypto map test
end

Maybe I need a static route that says destination Network via IPSec subdevice and then to BGP Neigbhour? How can I do that?

I try to add a static route but doesn't work:

ip route 10.1.3.192 255.255.255.224 10.1.1.37 

But ios told me that is invalid because it's this router. The issue is that the Port where the PC is connected only accept decrypted traffic but one customer wants to use a IPSec Tunnel for encryption. So the ISR should be the endpoint, decrypt the traffic and send it decrypted to the PC1 Port.

For explanation see this Visio chart:

This is the Cryptoconfig from ISR

crypto isakmp policy 1
 encr 3des
 hash md5
 authentication pre-share
 group 2
crypto isakmp key XXpeterpanXX address 10.1.3.238
crypto ipsec security-association lifetime seconds 86400
crypto ipsec transform-set ipcom esp-3des esp-md5-hmac 
 mode tunnel
crypto map test 10 ipsec-isakmp 
 description IPSec peer 
 set peer 10.1.3.238
 set transform-set ipcom 
 set pfs group2
 match address 120
 crypto map test
access-list 120 permit ip 10.1.1.36 0.0.0.3 10.1.3.192 0.0.0.31

Answer 1

What you are asking doesn't make sense to me. Why do you want to see that IP address in your trace? The only thing I can think of is that you want to set up a tunnel interface at each end?

So you could do something like:

Your router:

interface tunnel 0
 ip address 10.1.1.37 255.255.255.252
 tunnel source po1.331
 tunnel destination 10.1.2.101
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile ENCRYPTTUNNEL

Other Router:

interface tunnel 0
 ip address 10.1.1.38 255.255.255.252
 tunnel source g1  !<--or whatever the source interface is on that router
 tunnel destination 10.1.2.102
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile ENCRYPTTUNNEL

Then you could add static routes on the ISR to networks:

ip route 10.1.3.192 255.255.255.224 10.1.1.38

Even with all of that, you will see 10.1.1.38 as a hop in your trace, not 10.1.1.37.

Answer 2

You could try applying NAT.

1. I think you want to first remove the IP address and crypto map from interface po1.202. From what I can tell, you don't need that.

2. Next create a NAT pool which only contains the one IP address you want to use:

   ip nat pool VPN-Accepted-Address 10.1.1.37 10.1.1.37 netmask 255.255.255.252
   

3. Now an ACL to match traffic going to 10.1.3.192/27

   ip access-list extended NAT
    permit ip 10.1.1.16 0.0.0.15 10.1.3.192 0.0.0.31
   

4. Assign NAT outside:

   int po1.331
    ip nat outside
   

5. Assign NAT inside:

   int po1.30
    ip nat inside
   

6. NAT overload all traffic matching the ACL using the NAT pool which only contains 10.1.1.37

   ip nat inside source list NAT pool VPN-Accepted-Address overload
   

7. Apply crypto map to outside interface:

    int po1.331
     crypto map test