Forum Discussion
M__Moffatt
Dec 22, 2020Employee
Answering this comically late. The tunnel local address MUST be a self IP.
You can configure a non-existent self IP as the tunnel local IP in the IPsec configuration but the tunnel won't work properly until you configure a matching self IP.
Floating self IPs are preferred because with mirroring it also provided HA failover of the tunnels. For HA failover of IPsec tunnels, a floating self IP must be used and the tunnel must be IKEv2.