Skip to main content
Maerre
Maerre
Explorer III
June 18, 2025
Solved

Unable to delete Ipsec Dialup Vpn neither in CLI nor in GUI

  • June 18, 2025
  • 1 reply
  • 1410 views

Hello,

 

i need to delete a test ipsec dialup vpn, this vpn has no reference but i'm unable to delete neither in cli nor in gui.

It was firstly created via the vpn wizard and then changed to custom vpn.
I also create a loopback and associated it instead of the wan1 interface but nothing changed.

How can i fix it? Following the configuration:

 

FW-VPN-A (ipsec_dialup_vpn) # show
config vpn ipsec phase1-interface
edit "ipsec_dialup_vpn"
set type dynamic
set interface "wan1"
set mode aggressive
set peertype any
set net-device disable
set proposal aes256-sha1
set add-route disable
set dpd disable
set nattraversal disable
set psksecret ENC jd2XioYxP9J8q0kk2kkqW11BE3YteLWRNpehZ1k6B0Ccmn1lmMjY3dkVA
next
end

FW-VPN-A # config vpn ipsec phase1-interface
FW-VPN-A (phase1-interface) # delete ipsec_dialup_vpn
This phase1-interface is currently used
command_cli_delete:6989 delete table entry ipsec_dialup_vpn unset oper error ret=-23
Command fail. Return code -23

Thank you

Regards

Best answer by Toshi_Esumi

You might have some zombie sessions related to the phase1. Then you might need to reboot the FGT.

Toshi

1 reply

Toshi_Esumi
SuperUser
Toshi_Esumi
SuperUser
June 18, 2025

In CLI you always need to remove the phase2 first. Then you can remove the phase1.
For loopback, if the IP is a routable public IP, you just need a set of policies wan1<->loopback to allow at least UDP500&4500. If not routable IP, you need VIPs (inbound) and a NATed policy (outbound).

 

Toshi 

Maerre
MaerreAuthor
Explorer III
June 18, 2025

Hi @Toshi_Esumi ,

i've nothing under phase2, this is the problem.

under config vpn ipsec phase2 it's empty and under config vpn ipsec phase2-interface i just have the phase2 settings of all the order vpns (but nothing for "ipsec_dialup_vpn")

Toshi_Esumi
SuperUser
Toshi_Esumi
SuperUser
June 18, 2025

Then just do "show | grep -f ipsec_dialup_vpn" at the top of the CLI hierarchy.

    Terms & ConditionsAccessibility statement