IPSec tunnel for AD authentication traffic.

I realize I didn't supply full information. The authentication is needed from within an APM policy. The APM AAA selector allows for creation of a single DC, or for a defined pool of DCs. I've got the pool defined. However, I need to tunnelize the traffic that originates from that pool. I'm in the process of building tunnels in DEV/TEST. I think the tunnels will come up fine, I just can't see how to steer the "interesting" traffic down them--since they both originate from the same float address.