.@awscloud + CSR1000V rookie mistake #1 - "Source / Destination checking" - disable that guy on *ALL* interfaces. Allows it to route.