add dst-address=0.0.0.0/0 level=unique sa-dst-address=...87 sa-src-address=0.0.0.0 src-address=172...72/29 tunnel=yes
becomes:
add dst-address=...87/0 level=unique sa-dst-address=...87 sa-src-address=0.0.0.0 src-address=172..*.72/29 tunnel=yes
The tunnel won’t be set-up any more.
Via the web interface the dst-address is handled correctly. This looks like a cli issue.