我在这种情况下遇到了一些困难。我有一个“互联网边缘”，我的所有常规流量都经过防火墙、NAT 处理并在途中发送。我还有一个“WAN 聚合”层，其中路由器通过各种 WAN 技术连接到其他分支机构。

其中一个分支恰好是一个浮动分支，其公共IP地址会定期更改，并通过IPSEC VTI连接。问题在于，当隧道出现时，WAN 聚合路由器实际上是将它的 ISAKMP 和 ESP 数据包发送到它的默认路由，而不是它配置的公共 IP 地址。我无法更改默认路由，因为所有分支流量也会在该 IP 地址上退出（并且不会被过滤/防火墙/等）。

默认（和所有其他）路由通过 OSPF 传播。

我考虑过用 VRF 做点什么，但我想添加 TEST-MDF 的网络 OSPF，并且将路由泄漏到全局路由表中看起来是一个巨大的痛苦。

我还通过创建一个允许从任意到任意的 esp、isakmp 和 non500-isakmp 并将其应用于几乎每个接口的访问列表来尝试基于策略的路由。

这是相关的配置：

TEST-MDF:
    crypto isakmp policy 1
     encr aes
     authentication pre-share
     group 2
    crypto isakmp key cisco address 0.0.0.0 0.0.0.0
    !
    crypto ipsec transform-set TSET esp-aes esp-sha-hmac 
    !
    crypto ipsec profile VTI
     set transform-set TSET 
    !
    interface Loopback0
     ip address 10.9.8.1 255.255.255.0
     ip ospf network point-to-point
     ip ospf 1 area 9
    !
    interface Tunnel0
     ip unnumbered Loopback0
     ip ospf 1 area 9
     tunnel source FastEthernet0/0
     tunnel destination 1.1.1.5
     tunnel mode ipsec ipv4
     tunnel protection ipsec profile VTI
    !
    interface FastEthernet0/0
     ip address 1.2.1.2 255.255.255.0
    !
    router ospf 1
     log-adjacency-changes
    !
    ip route 0.0.0.0 0.0.0.0 1.2.1.1

CNT-MDF-WANAGG#
    crypto isakmp policy 1
     encr aes
     authentication pre-share
     group 2
    crypto isakmp key cisco address 0.0.0.0 0.0.0.0
    crypto isakmp profile IKE-DEFAULT
       keyring default
       match identity address 0.0.0.0 
       virtual-template 1
    !
    !
    crypto ipsec transform-set TSET esp-aes esp-sha-hmac 
    !
    crypto ipsec profile VTI
     set transform-set TSET 
     set isakmp-profile IKE-DEFAULT
    !
    interface Loopback0
     ip address 10.0.0.5 255.255.255.255
     ip policy route-map RM-VPN
     ip ospf network point-to-point
     ip ospf 1 area 0
    !
    interface Loopback100
     ip address 10.4.8.1 255.255.255.0
     ip ospf network point-to-point
     ip ospf 1 area 4
    !
    interface FastEthernet0/0
     ip address 10.255.0.1 255.255.255.254
     ip policy route-map RM-VPN
     ip ospf 1 area 0
    !
    interface FastEthernet0/1
     ip address 1.1.1.5 255.255.255.0
     ip policy route-map RM-VPN
    !         
    interface Virtual-Template1 type tunnel
     ip unnumbered Loopback0
     ip virtual-reassembly
     ip policy route-map RM-VPN
     ip ospf 1 area 9
     tunnel source FastEthernet0/1
     tunnel mode ipsec ipv4
     tunnel protection ipsec profile VTI
    !
    router ospf 1
     log-adjacency-changes
    !
    ip local policy route-map RM-VPN
    !
    ip access-list extended VPN
     permit esp any any
     permit gre any any
     permit udp any any eq isakmp
     permit udp any any eq non500-isakmp
    !
    route-map RM-VPN permit 1
     match ip address VPN
     set ip default next-hop 1.1.1.1