We are trying to implement an IPsec tunnel to send HTTP and HTTPS traffic to the umbrella cloud for DLP. We have been struggling with TAC for over a month now so I thought I'd see if anyone on here has any experience with this. We currently have one workstation that is on our inside network that we are testing. As of right now we have followed the documentation and set up the Site - to - Site route based VTI and confirmed that the tunnel has been established on the Umbrella side. However, when running a packet tracer on the FTD it is always taking the default route through our internet interface, even though i have specifically configured a PBR defining the interesting traffic (the test workstation) and telling it to go through the VTI interface. Please let me know if I can provide any more information.
