Policy route or VDOM

[btp]

All,

I have a hub-and-spoke setup with FG100E doing dialup IPSEC to a FG1500D cluster. The return route is installed by using local prefixes as SA, and everything works fine. Very simple config. The spokes have 8 VLANs on the inside, each of them results in one phase2 and thus 8 return routes in the hub.

The customer insists that no traffic should go between the VLANs without passing through their internal firewall, which makes sense. Now, if the local admin should connect to one of the other VLANs for, say, management of switches or access points, the traffic should go to the hub and then come back on the other VLAN. 

Since the spoke know both source and destination address, this is not possible without some tricks. All of the customer's config is in one VDOM on all spokes. So I'd rather not create another VDOM since I then also would need another IPSEC tunnel. I also don't want to use one VDOM per VLAN, as there might be more than 9 VLANs on a spoke.

So I installed a policy route on the spoke, forcing <everything> from "ADM" to enter the IPSEC tunnel. This works fine, and the packet is received at the hub, forwarded to the customer firewall and returned on the other interface. The problem starts when the packet is received at the spoke again - since the policy route states that all packets from "ADM" should be forwarded through the IPSEC tunnel.

Anyone got an idea of how to accomplish this without the use of another VDOM on the spoke? Or is it basically impossible?

On 100E, From "ADM":
2017-11-20 13:17:21 id=20085 trace_id=580 func=print_pkt_detail line=4918 msg="vd-VPN received a packet(proto=1, 10.10.1.2:16->192.168.1.2:2048) from ADM. type=8, code=0, id=16, seq=36."
2017-11-20 13:17:21 id=20085 trace_id=580 func=init_ip_session_common line=5062 msg="allocate a new session-00f6204d"
2017-11-20 13:17:21 id=20085 trace_id=580 func=vf_ip_route_input_common line=2573 msg="Match policy routing: to 192.168.1.2 via ifindex-43"
2017-11-20 13:17:21 id=20085 trace_id=580 func=vf_ip_route_input_common line=2583 msg="find a route: flag=04000000 gw-192.168.1.2 via IPSEC"
2017-11-20 13:17:21 id=20085 trace_id=580 func=fw_forward_handler line=711 msg="Allowed by Policy-3:"
2017-11-20 13:17:21 id=20085 trace_id=580 func=ipsecdev_hard_start_xmit line=178 msg="enter IPsec interface-IPSEC"
2017-11-20 13:17:21 id=20085 trace_id=580 func=esp_output4 line=888 msg="IPsec encrypt/auth"
2017-11-20 13:17:21 id=20085 trace_id=580 func=ipsec_output_finish line=514 msg="send to 10.76.0.37 via intf-IPVPN"
answer from hub:
2017-11-20 13:17:21 id=20085 trace_id=581 func=print_pkt_detail line=4918 msg="vd-VPN received a packet(proto=1, 10.10.1.2:16-> 192.168.1.2:2048) from IPSEC. type=8, code=0, id=16, seq=36."
2017-11-20 13:17:21 id=20085 trace_id=581 func=resolve_ip_tuple_fast line=4982 msg="Find an existing session, id-00f6204d, original direction"
2017-11-20 13:17:21 id=20085 trace_id=581 func=vf_ip_route_input_common line=2583 msg="find a route: flag=00000000 gw-192.168.1.2 via IPSEC"
2017-11-20 13:17:21 id=20085 trace_id=581 func=fw_forward_dirty_handler line=353 msg="blocked by forwarding policy (IPSEC->IPSEC), drop"