Настройка маршрута из vlan в IPSec туннель на Huawei USG6600?

Question

[Виктор]

В наличие такие сети
192.168.2.0/255.255.255.0 - WAN1
192.168.3.0/255.255.255.0 - LAN1
192.168.5.0/255.255.255.0 - WAN2 VlanID 1203
192.168.6.0/255.255.255.0 - LAN2 VlanID 3843
192.168.8.2/32 - Адрес за IPSec тунелем
192.168.7.1 - Адрес IPSec Peer
192.168.3.2 - PC1
192.168.6.2 - PC2

Трафик из LAN1 по умолчанию уходит в WAN1
Трафик из LAN2 по умолчанию уходит в WAN2

Не могу настроить что бы трафик из LAN2 уходил в IPSec туннель
Сам туннель работает нормально если отправить трафик с PC1 на 192.168.8.2

Примерно конфиг выглядит так

Пример конфига

#
ip vpn-instance cloud
ipv4-family
route-distinguisher 200:1
vpn-target 111:1 export-extcommunity
vpn-target 111:1 import-extcommunity
ipv6-family
#
interface GigabitEthernet1/0/0
undo shutdown
ip address 192.168.2.2 255.255.255.0
ip address 192.168.2.3 255.255.255.0
ip address 192.168.2.4 255.255.255.0
gateway 192.168.2.1
#
interface GigabitEthernet1/0/6
undo shutdown
ip address 192.168.3.1 255.255.255.0
#
interface GigabitEthernet1/0/7
undo shutdown
ip binding vpn-instance cloud
#
interface GigabitEthernet1/0/7.1
vlan-type dot1q 1203
ip binding vpn-instance cloud
ip address 192.168.5.1 255.255.255.0
#
interface GigabitEthernet1/0/7.2
vlan-type dot1q 3843
ip binding vpn-instance cloud
ip address 192.168.6.1 255.255.255.0
#
interface Tunnel0
ip address unnumbered interface GigabitEthernet1/0/0
tunnel-protocol ipsec
alias Tunnel ETS
service-manage ping permit
ipsec policy ipsec1621312428
#
vlan batch 1203 3843
#
ip route-static 0.0.0.0 0.0.0.0 GigabitEthernet1/0/0 192.168.2.1
ip route-static 192.168.6.2 255.255.255.0 GigabitEthernet1/0/7.2
ip route-static 192.168.8.2 255.255.255.255 Tunnel0
ip route-static vpn-instance cloud 0.0.0.0 0.0.0.0 GigabitEthernet1/0/7.1 192.168.5.2
ip route-static vpn-instance cloud 192.168.3.243 255.255.255.255 GigabitEthernet1/0/6 preference 100
ip route-static vpn-instance cloud 192.168.8.2 255.255.255.255 Tunnel0 preference 100

#
ipsec policy ipsec1621312428 1 isakmp
security acl 3004
pfs dh-group14
ike-peer ike162131242786
proposal prop16213124278
tunnel local applied-interface
sa duration traffic-based 20971520
sa duration time-based 3600

#
acl number 3004
rule 5 permit ip source 192.168.2.3 0 destination 192.168.8.2 0
#
ike peer ike162131242786
undo version 1
exchange-mode auto
ike-proposal 4
remote-address 192.168.7.1

#
ipsec proposal prop16213124278
esp authentication-algorithm sha2-256
esp encryption-algorithm aes-256

#
nat address-group 192.168.2.3 0
mode pat
section 0 192.168.2.3 192.168.2.3
#
nat-policy
rule name ipsec
egress-interface Tunnel0
source-address 192.168.3.2 mask 255.255.255.255
source-address 192.168.6.2 mask 255.255.255.255
destination-address address-set 192.168.8.2
action nat address-group 192.168.2.3