[mcnallym]

With ISP Redundancy then all Static NAT is sent out via the primary interface if in load balancing mode. Hide Nat is balanceed across both.

If you want to route your VPN tunnels down a line then turn off ISP Redundancy and just use static routes via the 4Mb line. You will need a route for the VPN Gateway, you will also then probably need to add a route for the encryption domains via the 4Mb line.