CLI Script vpn ipsec phase1-interface

[FloBEAUG]

Hello,

I'm trying to upload a script via the web interface but the script keeps on failing and i don't know why.

Here is the script :

config vdom
edit Hub

config vpn ipsec phase1-interface
edit "0630000X-tun1"
set interface "wan2"
set nattraversal disable
set authmethod psk
set remote-gw <hidden-IP>
set psksecret <somelongpassword>
next
end
end

When I type the same commands line by line under CLI through SSH everything goes well... I have enabled "diagnose debug" and set it to "cli 7", here is the output of the script :

0: config vdom
0: edit Hub
0:
0: config vpn ipsec phase1-interface
0: edit "0630000X-tun1"
0: set interface "wan2"
0: set nattraversal disable
0: set authmethod psk
0: set remote-gw <hidden-IP>
0: set psksecret <somelongpassword>
1: next
0: end
0:
0: end

Do you have any idea please ?

Sincerely,

Hardware: FG200E v5.6.9 build1673

[neonbit · Accepted solution]

When the script fails on the FMG there is a little icon that looks like a magnifying glass. If you click on it it will show you the commands as they're sent through and where it failed.

[FloBEAUG]

I'm not using FMG, I'm connecting directly to the FG Web UI.

But I can try with FMG and see what you told me.

Thanks

[emnoc]

That last end is not required for this script. 

Ken Felix

[ede_pfau]

Your script runs without any error on my FG-60E, FOS v6.0.6.

I thought maybe the name is too long, or some obligatory variable was missing, but no.

Is there something special with "wan2"?

@emnoc: the last "end" closes VDOM edit mode, not strictly required here but won't harm. The error occurs with the preceeding "next".

[FloBEAUG]

@ede_pfau : the "wan2" interface already have 159 phase1-interfaces linked to it (my colleague set those manually over time). We will have to add more distant sites in a short period of time so we are searching for a simple way to add those sites.

We want to delegate the work to another team with some simple workflow such as uploading a script to the device...

[FloBEAUG]

I uploaded the script via FMG : 1 line missing "set peertype"

It's working now !

[emnoc]

interesting , peertype is not a required item in a new setup and should inherit the defaults. Btw script ran with zero issues in my fgts.

Ken Felix