Technical Tip: Unable to add the Phase-2 Selectors in IPSec tunnel

This issue arises when no Phase-2 selector is configured in the IPSec tunnel. Adding the Phase-2 selector by selecting the edit button shows the error '-56 empty values are not allowed'.

The following Image shows the error:

The following Image shows the example of a configuration with no Phase-2 selector:

Select 'Convert to Custom Tunnel' and try to add Phase-2 selectors as shown in the image below:

Note:
If the encapsulation is set to transport-mode under phase2 setting, the phase2-selector will be unavailable. Switch to tunnel mode, and phase2-selector will be available to configure.

config vpn ipsec phase2-interface
    edit "tunnel_name"
        set encapsulation tunnel-mode
end

Related article: