Restrictions and limitations
The virtual tunnel interface has the following restrictions and limitations:
IPsec injects tunnel related routes into the Linux kernel. You can also configure static routes for the same prefixes. For example, on a non-vti interface with a remote prefix of 30.1.1.0/24, you can configure a static route for 30.1.1.0/24 pointing to any interface of your choice.
Note: You can configure static routes for backup purposes by using the same address prefixes. To configure a static route, it must point to a backup path of that prefix which is also encrypted. If the IPsec tunnel goes down, the static route becomes active.