BIG-IP Sourced Traffic Over IPSec

In your config there should be a VLAN assocated with the tunnel and you should have a self-ip associated with it.  For example let's assume you have a VLAN named TUNNEL_VLAN and you have an address range of 172.16.1.0/30 and have assinged 172.16.1.1 to the BIG-IP you are logged in as and you have assinged 172.16.1.2 to the remote end.  The traffic selector you have configured at least encompasses that range:

net ipsec traffic-selector selector-vpn-a5294dfd-0 {

    destination-address 172.16.1.0/30

    ipsec-policy ipsec-policy-vpn-a5294dfd-0

    partition LOCAL_ONLY

    source-address 172.16.1.0/30

And asssuming the rest of you BIG-IP VPN config looks correct (this is an example of a BIG-IP in AWS setting up an IPSEC tunnel), and you are allowing ICMP on your self-IPs.

net ipsec ike-peer peer-vpn-a5294dfd-0 {

    lifetime 480

    nat-traversal on

    phase1-auth-method pre-shared-key

    phase1-encrypt-algorithm aes128

    preshared-key-encrypted $M$uF$m+crQ1tis.....

    remote-address X.X.X.X

    version { v1 }

}

net ipsec ipsec-policy ipsec-policy-vpn-a5294dfd-0 {

    ike-phase2-auth-algorithm sha1

    ike-phase2-encrypt-algorithm aes128

    ike-phase2-lifetime 60

    ike-phase2-perfect-forward-secrecy modp1024

    mode interface

    partition LOCAL_ONLY

}

Then the following command should put traffic from your BIG-IP onto the tunnel matching the selector -

PING -I TUNNEL_VLAN 172.16.1.2

You can do this but but first I would recommend two things:

1. Use IKEv2
2. Use Route-based tunnels only with a traffic selector of 0.0.0.0/0 for both the source and destination.

I have yet to come across a piece of equipment where we are unable to successfully build a IKEv2 route-based tunnel. Do take note of https://support.f5.com/csp/article/K31553030

There are two ways to route traffic into the tunnel:

1. Routes are created on the Big-IP to funnel traffic into the appropriate tunnel. One issue with this solution is that if you have multiple tunnels terminating on the same Big-IP then traffic can flow from one tunnel to the other based on these routes. This may be good or bad depending on your requirement.

2. A virtual server is created for each of the individual routes that must be reached through the tunnel on the remote network. This virtual server will have a pool with one member which points to the far end of the transport tunnel. The virtual server will also listen only to the source IP and/or vlan you choose. Use this option if you want to ensure that traffic cannot flow between tunnels.