You do not need VTI to solve that problem! Simple GRE/IPsec tunnels and automatic routing will do it. That assumes you control both ends, and the other end supports GRE as well (lots of platforms don't). Also, having to configure thousands of GRE tunnels instead of just support VTI and route-based ...

@amirdeadline2,

We you able to figure this out? I'm in more or less the same boat. I'm trying to run L2TP over IPSec, with the Internet-facing interface in a VRF. I can make plain L2TP work, but obviously that's unencrypted and not much use.

I suspect I already know the answer, and after performing some web and forum searches I've not yet found the answer, so I assume it's not possible, but I'll describe what I'd like to do here anyways. I'd like to end up with 2 (or more) WAN interfaces, each inside their own VRF. These would be Intern...

I'm seeing the same issue with 5.16 and 5.17. I'll eventually end up with more than 10 sessions connected when there should only be 3 (2 links + bundle).