Route specific traffic to Security Stack

hello fellow redditers, i have situation where i need your opinion.

​

for example:

Total customers = 100

Subscribed customers = 50

I am looking to route traffic for the subscribed customers to router through a security stack to inspect all outgoing/incoming traffic only for those.

​

Any idea how to best do that without being inline? I am looking to get away from GRE option but also our network team is not willing to use VRF as an option as well.

Does IPSec or some other form of routing work that would get me the results i want?

​

Normal Traffic ------ Internet-->Peering Edge --> CRAN --> Customer Edge Gateway--> Customer (back the same path to the internet)

Subscribed Traffic -------Intern--> Peering Edge-->CRAN --> (Security Stack of UTM, IDS etc. ) --> Customer Edge Gateway --> Customer(back the same path to the internet)