That's not a valid scenario. The whole tunnel traffic will get encrypted if configured so. But you could build two tunnels, one with encryption and one without. With your routing-policy you decide which traffic should flow through the encrypted tunnel and which traffic should flow through the unencrypted tunnel.
Would I do something like that? Never ever!!! Just let flow everything through the encrypted tunnel!
