IPsec dynamic IP address

You should learn how to write your questions in a more organized way. Code formatting is also a thing (useful for displaying a logs).

If you want different policies for specific clients, then you should properly setup remote-id matching as well as specific mode configs and policies. I’ve done similar thing here with 3rd router.

Since you cannot match who is who by IP, try to find other ways to match users. Like some other IDs or certificates. Up to you here. :slight_smile:

As I’ve mentioned, you should create a separate mode config, policy and identity for each peer you would need a specific settings. For everything else, where “static IP of ipsec/ike” does not matter, you can use ip pool for automatic IPs assignment for IPSEC clients.