Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a Cisco IOS router with two DSL connections. One of them is intended for general traffic (ADSL), the other for VPN links (BDSL) and various other traffic.

So the default route is the ADSL link, and we have a combination of static routes for the VPN traffic, and policy routes for other traffic types that should go out the BDSL link.

For site to site traffic, this is fine, we just static route the public IPs and remote networks out of the BDSL line.

The policy based routing works fine for any internal traffic that matches an ACL.

The problem is now that there are remote VPN sites originating from dynamic addresses, so we cannot use static routes. The replies to incoming ISAKMP requests are following the default route out of the ADSL (despite there being no crypto map on that interface).

I want to route the outgoing VPN traffic out of the BDSL. I have tried adding udp/500 and esp to and from the route-map acl that pushes traffic out of the BDSL line, but it doesn't match, presumably because the route-map happen earlier than the IPSec stuff.

Any ideas how I can do this?

IOS ver: 12.4.13T.

share|improve this question

Sounds like you're looking for LOCAL policy routing (a policy routing decision for traffic originated ON the router as opposed to traffic THROUGH the router)

Here's a good write up - I think you'll find it straightforward to implement:

share|improve this answer
Thanks - this is what I was looking for but for some reason, the local policy only applies to the ISAKMP packets. IPSec is not getting policy routed. – Paul Oct 22 '13 at 1:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.