VPN on multiple WAN IP

Why is my 1st question? The local wan interface is ideal and serves that purpose. 

 

What you could do if you need to src the vpn to a different address

 

set a loopback interface and assign it a /32

set the vpn to terminate on that loopback 

you will need. src/dst rules to allow IKE/ESP/IKE-NAT etc......

 

 

config vpn ipsec phase1-interface

    edit "ubun"

        set interface "loop-strongswan"

        set ike-version 2

        set peertype any

        set net-device disable

        set proposal aes256-sha1

        set dhgrp 5

        set remote-gw 192.168.1.115

        set psksecret ENC wtRFBB3TsiWgHrBsv6vxbd5rLALgU0xpcHZVtawR7fCR5xFI5yexJhn+ZKwikAYt7DGmi2q1Li4X8TCfcEs2/By6TYGsrvr5QXd7NwYdOVNoy4Ow9+bZTsOEEijJYwM2bVQByxVxu5dGGnthLRZPIE1YPFWpHWcwie6QFakVVrObY/IiLGs6PrcEo++oJyxEbovI4w==

    next

end

 

config firewall policy

    edit 8

        set name "vpnstrngswan-in"

        set uuid ea93ca2e-8287-51eb-067b-2e67980578f1

        set srcintf "internal"

        set dstintf "loop-strongswan"

        set srcaddr "all"

        set dstaddr "all"

        set action accept

        set schedule "always"

        set service "IKE" "ESP"

    next

       

config firewall policy

    edit 7

        set name "vpnstrngswan-out"

        set uuid b4f30d8a-8287-51eb-ddd4-e2f75cacfece

        set srcintf "loop-strongswan"

        set dstintf "internal"

        set srcaddr "all"

        set dstaddr "all"

        set action accept

        set schedule "always"

        set service "IKE" "ESP"

    next

end

 

But I question why you need a different address to begin with and specially when you have limited addresses to start with ?

 

Ken