How to aggregate many IKEv1 and IKEv2 dial-in peers in one Firewall policy ruleset?

Hi, Martin!
To combine multiple IKEv1 and IKEv2 peer networks into a single set of firewall policy rules, you can use address or object groups in your firewall. Instead of creating a separate rule for each IPSec remote access tunnel, you can create one general rule and define an address or object group that includes IP pools for all IPSec clients.

Hello@CatInHat 

thank You for Your reply. The solution was, to activate multiple source interfaces first by

Uh-oh, just be aware that "multiple interface policy" is opening Pandora's box if you are not very, very careful.

Imagine you allow this, and create an access policy to some internal resource.

Now, months later, you create an additional VPN. Traffic from this (unrelated) interface will automatically be included in this policy. This is called a side-effect, with potential to create a security breach.

Besides, you will lose the "interface pair" view in the policy table. Annoying at first, troublesome when the table grows later.

Try to go with a zone, a container for interfaces which can only be used in policies. That should do the trick.

Besides, I think you could set up your dial-in VPN such that many users could share the same VPN. Issue a unique PSK and username to each user, and differentiate access rules by adding user groups in the policies. Who wants to handle 80 dial-in VPNs?