Troubleshooting Tip: IPv4-split-include setting disappears when editing Address Group in IPsec VPN

When an address group is assigned to the IPv4-split-include setting in an IPsec Phase1-interface, adding a new address object to the group causes the setting to vanish from the GUI.

In the IPsec Phase1-interface configuration, split tunneling is implemented by defining the address group 'VPN_SplitGrp' in the ipv4-split-include parameter:

config vpn ipsec phase1-interface
    edit "Client_VPN"
        set type dynamic
        set interface "port1"
        set mode aggressive
        set peertype any
        set net-device enable
        set mode-cfg enable
        set ipv4-dns-server1 192.20.10.10
        set ipv4-dns-server2 192.20.10.11
        set ipv4-dns-server3 8.8.8.8
        set proposal aes128-sha256 aes256-sha256 3des-sha256 aes128-sha1 aes256-sha1 3des-sha1
        set dpd on-idle
        set comments "VPN: MobileVPN (Created by VPN wizard)"
        set xauthtype auto
        set authusrgrp "Admin_GRP"
        set ipv4-start-ip 192.168.42.10
        set ipv4-end-ip 192.168.42.200
        set ipv4-netmask 255.255.255.0
        set ipv4-split-include "VPN_SplitGrp"
        set save-password enable
        set psksecret ENC 6PzRNssKVoMyTzQNjz889alQF7yVvhgCek59q9NZG/NJwfa4kOHrmwxHJTh7ul4P064SVC

5H2aCe2KdoXiEVJdsxXeFrPOvHEKbTveD8uln3oyyyhXYhvVioWxdCmZwyyjgNv7tlZaON7X9rZJXMA44lKRC+recez

QPE7SbinhORb7hc8VDrtm/3E77S84yz+F6VsllmMjY3dkVA
        set dpd-retryinterval 60
    next
end

Firewall address group:

When the address object 'servers' is added to the 'VPN_SplitGrp' address group, the associated address group configured in the accessible network section of the GUI disappears.

config firewall addrgrp
    edit "VPN_SplitGrp"
        set uuid 78382660-2336-51f0-5c59-503b3c38bdef
        set member "192.168.2.0-NW" "192.168.4.0/24" "servers"
    next
end

Upon checking through the CLI, the 'VPN_SplitGrp' address group remains listed under ipv4-split-include. However, after a system reboot, the IPv4-split-include configuration is cleared, as illustrated below:

config vpn ipsec phase1-interface
    edit "Client_VPN"
        set type dynamic
        set interface "port1"
        set mode aggressive
        set peertype any
        set net-device enable
        set mode-cfg enable
        set ipv4-dns-server1 192.20.10.10
        set ipv4-dns-server2 192.20.10.11
        set ipv4-dns-server3 8.8.8.8
        set proposal aes128-sha256 aes256-sha256 3des-sha256 aes128-sha1 aes256-sha1 3des-sha1
        set dpd on-idle
        set comments "VPN: MobileVPN (Created by VPN wizard)"
        set xauthtype auto
        set authusrgrp "Admin_GRP"
        set ipv4-start-ip 192.168.42.10
        set ipv4-end-ip 192.168.42.200
        set ipv4-netmask 255.255.255.0
        set save-password enable
        set psksecret ENC CXSTQ4c+5Z84jCBWatKdUQkdrV69dgrXhUxvevslWPaTTLnR0Wrk799RREgEueZJc5iPot8UKyaAJwTDm/

piBuSf/G7mnpceqT1S/qn6EtosqXAVQEeJhdFp9qF8szO6pXgQeZXKMWZmRoFbvTZBzqAiY+rLOTwU9llX0SGUxe6

aXLXmFuoNTUN2yqxSFaA87xuyUFlmMjY3dkVA
        set dpd-retryinterval 60
    next
end

This issue is triggered only when an FQDN-type address object is added to the address group defined in the IPv4-split-include configuration. If the address or address group contains an FQDN entry, it will not be able to add under IPv4-split-include, as it does not support an FQDN address object.

This issue has been resolved in v7.4.8.