A network engineer is configuring a route-based IPsec VPN from an on-premises Cisco IOS XE router to a native Azure VPN Gateway over the internet. The design requires that traffic selectors be defined by the routing table rather than by policy-based ACLs, so that additional Azure VNets can be reached later simply by adding routes. Which IOS XE configuration approach meets this requirement?