The default gateway is the Internet interface.

VPN policy is configured on the Internet interface egress as follows: Traffic from the local GRE tunnel endpoint to the remote GRE tunnel endpoint > encrypt, using IPSec tunnel mode, with the remote peer being the Main Office.

An access control list (ACL) is configured on the Internet interface to allow only the VPN tunnel and ICMP traffic. See Configuring hub-and-spoke with VPN for data and VoIP control backup for configuration settings.

Policy Based Routing (PBR) is configured as follows on VoIP VLAN and loopback interfaces:

The VPN policy portion for the branch is configured as a mirror image of the branch

The ACL portion for the branch is a mirror image of the branch, with some minor modifications

Static routing is configured as follows:

Branch subnets > Internet interface

The PBR portion for the branch is configured as follows, on most interfaces:

ACM is configured to route voice calls through PSTN when the main VoIP trunk is down.