Sometimes depending on the network architecture you find your traffic inside a tunnel encapsulated inside another and maybe also inside another tunnel. So double to tripple encryption without that much of a security benefit. When the clients already establishing a VPN connection there is no need for the S2S encryption tunneling. We only getting smaller and smaller packets through the pipe because of the overhead of each IPsec tunnel reducing the MTU further.

The following image illustrate how the traffic would flow if we don’t adjust the routing for already encrypted traffic and what would happen if we re-route it.

In this example we configure Policy Based Routing to bypass a S2S IPsec tunnel for already encrypted traffic. What we now do with the configuration is to re-route the traffic towards the ip address of the second GRE tunnel instead. Depending on your setup even a GRE tunnel might not be needed if the IP addresses are routed publicly but here I assume we don’t have those and NAT is not an option.

The key is to identify the already encrypted traffic. In this example we want IPsec traffic to be bypassed from the S2S tunnel from R1 to R2. The ACL detects all IPsec traffic which is IP protocol 50 (ESP) and the IPsec NAT-T port (UDP/4500) and IKE (UDP/500).

!
ip route 0.0.0.0 0.0.0.0 172.16.1.2
!
interface Tunnel10
 description *** IPSEC Overlay ***
 ip address 172.16.1.1 255.255.255.252
 ip mtu 1400
 ip tcp adjust-mss 1360
 tunnel source 203.0.113.1
 tunnel destination 203.0.113.2
 tunnel protection ipsec profile IPSec-Profile
!
interface Tunnel20
 description *** IPSEC BYPASS ***
 ip address 172.16.2.1 255.255.255.252
 tunnel source 203.0.113.1
 tunnel destination 203.0.113.2
!
ip access-list extended IPsec_ACL
 10 permit udp 192.168.150.0 0.0.0.255 192.168.200.0 0.0.0.255 eq 4500
 20 permit udp 192.168.150.0 0.0.0.255 192.168.200.0 0.0.0.255 eq 500
 30 permit esp 192.168.150.0 0.0.0.255 192.168.200.0 0.0.0.255
!
interface Gi0/0/1
 ip address 203.0.113.1 255.255.255.252
 ip policy route-map IPsec_RM
 no cdp enable
!
route-map IPsec_RM permit 10
 match ip address IPsec_ACL
 set ip next-hop 172.16.2.2
!

Since the policy based routing configuration is applied on a per-packet basis we would need also configure the return traffic with a reversed ACL on router R2. So the configuration is basically the same but in reverse in terms of IP addresses and traffic flow.

!
ip route 0.0.0.0 0.0.0.0 172.16.1.1
!
interface Tunnel10
 description *** IPSEC Overlay ***
 ip address 172.16.1.2 255.255.255.252
 ip mtu 1400
 ip tcp adjust-mss 1360
 tunnel source 203.0.113.2
 tunnel destination 203.0.113.1
 tunnel protection ipsec profile IPSec-Profile
!
interface Tunnel20
 description *** IPSEC BYPASS ***
 ip address 172.16.2.2 255.255.255.252
 tunnel source 203.0.113.2
 tunnel destination 203.0.113.1
!
ip access-list extended IPsec_ACL
 10 permit udp 192.168.200.0 0.0.0.255 192.168.150.0 0.0.0.255 eq 4500
 20 permit udp 192.168.200.0 0.0.0.255 192.168.150.0 0.0.0.255 eq 500
 30 permit esp 192.168.200.0 0.0.0.255 192.168.150.0 0.0.0.255
!
interface Gi0/0/1
 ip address 203.0.113.2 255.255.255.252
 ip policy route-map IPsec_RM
 no cdp enable
!
route-map IPsec_RM permit 10
 match ip address IPsec_ACL
 set ip next-hop 172.16.2.1
!