We have a number of remote sites connecting to headends via IPSec encrypted GRE tunnels over the public internet.
Our current configuration works, but we would like to see if there is a better way of handling the no-split tunnel rule.
At the headend site, we have static routes on the VPN Headend router for each of the remote VPN site routers, via the public interface next hop (Outer VPN FW). The default route on the VPN headend router is via the private interface next hop (Inner VPN FW).
At the remote site, we have a static route to the VPN headend router public interface via the remote VPN router public interface next hop (ISP gateway). The default route on the remote VPN router is via the GRE tunnel interface next hop.
This works ok, but requires static IP addressing on the Remote VPN router (which is not always possible). We'd also like to move towards dynamic routing to allow for automatic failover between headends.
I know on the ASA anyconnect product there is the option of having two default routes (with interface specified) and the "tunneled" command to direct tunneled traffic out that default route, but I'm not aware of anything in IOS to achieve that.
Appreciate any suggestions you have!
