IPSec Remote Access

[ehsangha]

Hi everyone.

I need to create two phase2  interfaces for IPSec Remote access to allow users to connect to two different subnets. I have created phase 1 and phase 2 interfaces, but the VPN connection failed.

config vpn ipsec phase1-interface
edit "IPsec_Clients"
set type dynamic
set interface "wan1"
set mode aggressive
set peertype any
set net-device enable
set mode-cfg enable
set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
set xauthtype auto
set authusrgrp "DC-VPN"
set ipv4-start-ip 172.16.17.129
set ipv4-end-ip 172.16.17.254
set ipv4-netmask 255.255.255.128
set dns-mode auto
set ipv4-split-include "IPsec_Clients_split"
set save-password enable
set psksecret ENC 2kvF93dFz+5UvJw0S50Bor9tCqr6vYz7pPR2fvGbrWd4W3cblxHIHxhyLTYFOYGM0l+bq65DpcnqU4ij5S3C0jKgglRrnnRbK1gLljGNYeR1C1OgVmJ3xuJMDxPBifR2FjFeZ8I8WzdaEuIg5Zx60CYvbuUCak80vyBcpzauEUyURIq56C7kguCO5AFJN/f4l8lffw==
next
end

config vpn ipsec phase2-interface
edit "IPsec_Clients"
set phase1name "IPsec_Clients"
set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
set src-subnet 172.16.17.128 255.255.255.128
set dst-subnet 192.168.10.0 255.255.255.0
next
edit "IPsec_Clients1"
set phase1name "IPsec_Clients"
set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
set src-subnet 172.16.17.128 255.255.255.128
set dst-subnet 192.168.9.0 255.255.255.0
next
end

[ehsangha]

I removed set ipv4-split-include  from Phase1-Interface, and now everything is OK. Would you please tell me what the reason is?

This is my Configuration: 

config vpn ipsec phase1-interface
edit "IPSec_Clients"
set type dynamic
set interface "wan1"
set local-gw xxx.xxx.xxx.xxx
set mode aggressive
set peertype any
set net-device disable
set mode-cfg enable
set ipv4-dns-server1 xxx.xxx.xxx.14
set proposal aes128-sha256
set dpd on-idle
set xauthtype auto
set authusrgrp "dara-vpn"
set nattraversal disable
set ipv4-start-ip 172.16.17.10
set ipv4-end-ip 172.16.17.254
set ipv4-netmask 255.255.255.0
set dpd-retryinterval 60
next

config vpn ipsec phase2-interface

edit "IPSec_Clients"
set phase1name "IPSec_Clients"
set proposal aes128-sha1
next
edit "IPSec_Clients1"
set phase1name "IPSec_Clients"
set proposal aes128-sha1
next

[AEK]

I'm not sure but probably you didn't create the firewall rules that allow traffic from your IPsec tunnel towards the "IPsec_Clients_split" addresses.

[ehsangha]

Thanks for responding

when I enabled ipv4-split-include I could ping just one subnet address

I created a policy from the  VPN connection toward IPsec_Clients_split.