Unable to delete Ipsec Dialup Vpn neither in CLI nor in GUI

[Maerre]

Hello,

i need to delete a test ipsec dialup vpn, this vpn has no reference but i'm unable to delete neither in cli nor in gui.

It was firstly created via the vpn wizard and then changed to custom vpn.
I also create a loopback and associated it instead of the wan1 interface but nothing changed.

How can i fix it? Following the configuration:

FW-VPN-A (ipsec_dialup_vpn) # show
config vpn ipsec phase1-interface
edit "ipsec_dialup_vpn"
set type dynamic
set interface "wan1"
set mode aggressive
set peertype any
set net-device disable
set proposal aes256-sha1
set add-route disable
set dpd disable
set nattraversal disable
set psksecret ENC jd2XioYxP9J8q0kk2kkqW11BE3YteLWRNpehZ1k6B0Ccmn1lmMjY3dkVA
next
end

FW-VPN-A # config vpn ipsec phase1-interface
FW-VPN-A (phase1-interface) # delete ipsec_dialup_vpn
This phase1-interface is currently used
command_cli_delete:6989 delete table entry ipsec_dialup_vpn unset oper error ret=-23
Command fail. Return code -23

Thank you

Regards

[Toshi_Esumi]

In CLI you always need to remove the phase2 first. Then you can remove the phase1.
For loopback, if the IP is a routable public IP, you just need a set of policies wan1<->loopback to allow at least UDP500&4500. If not routable IP, you need VIPs (inbound) and a NATed policy (outbound).

Toshi 

[Maerre]

Hi @Toshi_Esumi ,

i've nothing under phase2, this is the problem.

under config vpn ipsec phase2 it's empty and under config vpn ipsec phase2-interface i just have the phase2 settings of all the order vpns (but nothing for "ipsec_dialup_vpn")

[Toshi_Esumi]

Then just do "show | grep -f ipsec_dialup_vpn" at the top of the CLI hierarchy.

[Maerre]

it brings me back here:

FW-VPN-A # show | grep -f ipsec_dialup

config vpn ipsec phase1-interface
edit "ipsec_dialup_vpn" <---
set type dynamic
set interface "wan1"
set mode aggressive
set peertype any
set net-device disable
set proposal aes256-sha1
set add-route disable
set dpd disable
set nattraversal disable
set psksecret ENC jd2XioYxP9J8q0kk2kkqW11BE3YteLWRNpehZ1k6B0Ccmn1lmMjY3dkVA

what am i supposed to do now?

Thank you

[Toshi_Esumi · Accepted solution]

You might have some zombie sessions related to the phase1. Then you might need to reboot the FGT.

Toshi

[Maerre]

At the end i had to reboot the primary fw, delete the interface, reboot the secondary fw and reboot it too.

This solved the issue, thank you for the tips!

[Toshi_Esumi]

You didn't tell us it's in HA environment. This happens more often in HA.

Toshi