Routing Traffic over IPsec Using Static Routing

Traffic can be routed over an IPsec tunnel by configuring a static route.
To steer traffic over an IPsec tunnel by configuring a static route, complete the following task.
  1. From privileged EXEC mode, enter global configuration mode. 
    device# configure terminal
  2. Define a static route. 
    device(config)# ip route 10.157.23.0/24 10.4.4.4
    This example defines a static route with destination IP address 10.157.23.0/24 and where the next-hop address 10.4.4.4 is reachable through the IPsec tunnel.
    Alternatively, you can define the static route by specifying the tunnel itself as the outgoing interface. 
    device(config)# ip route 10.157.23.0/24 tunnel 2
    This example defines a static route with destination IP address 10.157.23.0/24 and specifies tunnel 2 as the outgoing interface.

The following example shows how to configure an IPsec VTI and how to steer traffic over the tunnel by configuring a static route. 

device# interface tunnel 2
device(config-tnif-2)# vrf forwarding blue
device(config-tnif-2)# tunnel source ethernet 1/1/2
device(config-tnif-2)# tunnel destination 10.2.2.1
device(config-tnif-2)# tunnel mode ipsec ipv4
device(config-tnif-2)# tunnel protection ipsec profile prof-blue
device(config-tnif-2)# ip address 10.4.4.4/24
device(config-tnif-2)# exit

device(config)# ip route vrf blue 10.157.23.0/24 tunnel 2
Parent topic: IPsec