IPsec dial-up connection to a Loopback Interface using Virtual IP does not work

Description

Issues with using a loopback interface linked to a Virtual IP (VIP) for IPSec dial-up connections.

Scope

FortiGate.

Solution

Note: 

IPsec VPN remote access does not support loopback using a virtual IP at the moment.
The connection may go up, but it will not allow traffic to pass at all. It will also show esp_errors in the VPN event logs.

The reason is that on FortiOS, the inbound IPsec SA lookup happens before destination NAT (VIP translation).
This is explained in Technical Tip: IPsec VPN tunnel termination on the VIP address (DNAT), limitations and alternatives

This article formerly described steps on how to configure a setup with IPSec VPN and a loopback interface accessible via Virtual IP.
This setup does not work, and the steps were removed accordingly.

Working IPSec VPN examples with loopback interfaces (and no virtual IP) can be found here:

Technical Tip: Best practice when IPSec VPN is bound to loopback interface

Technical Tip: IPsec between 2 FortiGates using a loopback interface