The prefer way of directing traffic to/from IPsec is not via the route table.
As explained in strongswan's documentation, when using IPsec the kernel also uses a Security Policy Database (SPD) to then generate a Security Associations (SA) database. These databases are use by the kernel in addition to the routing table.
The ipsec-tools package for Ubuntu supplies a setkey command which can be used to show and manually manipulate these databases. However, the way you really should get entries added to the SPD is via the ipsec.conf in which you put the left/right (or leftsubnet/rightsubnet) of the connections.
To see the SPD, try running:
setkey spddump
If you really want to do it via route-based, I linked previously to the documentation on how to do that.
Take note that Ubuntu 18.04 supplies strongswan version 5.6.2 and iproute2 4.15.0.
To use XFRM interfaces you need to be on strongswan 5.8.0 or higher. To work with XFRM interfaces via iproute2 requires the iproute2 to be 5.1.0 or higher.
So, despite the version of the kernel azure supplies, for the versions of strongswan/iproute2 supplied by 18.04, you are going to want to focus on the documentation for VTI devices.
I looked over my own use of IPsec and I have never actually done route-based IPsec (with either VTI or XFRM) before. Instead I have always configured it via the ipsec.conf.
As far as I know, route-based IPsec doesn't replace the SPD and you still need to make sure your ipsec.conf and SPD is configured to permit the traffic.
I again recommend using the Strongswan support options to get further help with Strongswan IPsec. You could also look into contacting Canonical support.
OpenVPN AS does not prohibit you from doing what you are trying to do. Your issues seem to largely be with use of Strongswan.
