Hoping for some assistance on this issue, been racking my brain on it but find myself going in circles at this point.
We have implemented a hub and spoke IPSEC flexvpn design with redundant hubs using certificate based auth. Loopback0 int used in a virtual template for creating virtual access instances for the spokes. I can supply configurations if necessary, but I feel I'm missing something fundamental that someone may be able to point out without configs. We are also in the process of migrating to Eigrp, which I have running on the Hub and spoke.
The tunnel configuration is up and working, but intranet only, I'm unable to get internet traffic to route over the tunnel on the spoke router. When sourcing from our local lan on the spoke I can get to everything on our network, but nothing outside that. Yes I can NAT the WAN interface on the spoke, which will allow internet access not sourced from our network, but then traffic destined for the internet is not routed over the tunnel, and we are not wanting to do split tunneling.
From the HUB, I am able to get out to the internet, even from the lo0 interface, but from the client I don't seem to be getting anywhere. Traceroute from lan source to internet on the spoke shows immediate timeout.
Again, aside from not having internet access from the spoke via the IPSEC tunnel, there are no other issues, that is why I feel it's something simple I'm missing.
I'm guessing it is because the default route is to the local router interface, not tunnel0, but if I try to make the default route tunnel0 I end up with the tunnel bouncing due to a routing loop. So all intranet bound traffic has a route via eigrp via tunnel0, but the default route goes directly out the WAN interface, and I don't know how to correct that without recursive routing.
