Adding tunnel interfaces to the VPN

To create an address for the Edge tunnel interface, connect to Edge, go to Policy & Objects > Addresses, and create a new address.
Set Category to Address and set Subnet/IP Range to the IP address for the Edge tunnel interface (10.10.10.1/32).
Create a second address for the Branch tunnel interface. For this address, enable Static Route Configuration.
To allow VPN traffic between the Edge tunnel interface and the Branch tunnel interface, go to VPN > IPsec Tunnels, and edit the VPN tunnel. Select Convert To Custom Tunnel.
Under Phase 2 Selectors, create a new Phase 2. Set Local Address to use a Named Address and select the address for the Edge tunnel interface. Set Remote Address to use a Named Address, and select the address for the Branch tunnel interface.
To route traffic to the Branch tunnel interface, go to Network > Static Routes, and create a new route.
Set Destination to Named Address, and select the address for the Branch tunnel interface. Set Device to the tunnel interface.
To allow traffic between the tunnel interfaces, go to Policy & Objects > IPv4 Policy and edit the policy allowing local VPN traffic.
Set Source to include the Edge tunnel interface and Destination to include the Branch tunnel interface. To configure this, you must have Multiple Interface Policies enabled. If you have not done this already, go to System > Feature Visibility.
Edit the policy allowing remote VPN traffic to include the tunnel interfaces.
On Branch, repeat steps 1 to 10 to include the following:
- Addresses for both tunnel interfaces (enable Static Route Configuration for the Edge tunnel interface address)
- A Phase 2 that allows traffic between the Branch tunnel interface and the Edge tunnel interface
- A static route to the Edge tunnel interface
- Edited policies that allow traffic to flow between the tunnel interfaces
To allow the new phase 2 to take effect, go to Monitor > IPsec Monitor, and restart the VPN tunnel.

To create an address for the Edge tunnel interface, connect to Edge, go to Policy & Objects > Addresses, and create a new address.

Set Category to Address and set Subnet/IP Range to the IP address for the Edge tunnel interface (10.10.10.1/32).

Create a second address for the Branch tunnel interface. For this address, enable Static Route Configuration.

To allow VPN traffic between the Edge tunnel interface and the Branch tunnel interface, go to VPN > IPsec Tunnels, and edit the VPN tunnel. Select Convert To Custom Tunnel.

Under Phase 2 Selectors, create a new Phase 2. Set Local Address to use a Named Address and select the address for the Edge tunnel interface. Set Remote Address to use a Named Address, and select the address for the Branch tunnel interface.

To route traffic to the Branch tunnel interface, go to Network > Static Routes, and create a new route.

Set Destination to Named Address, and select the address for the Branch tunnel interface. Set Device to the tunnel interface.

To allow traffic between the tunnel interfaces, go to Policy & Objects > IPv4 Policy and edit the policy allowing local VPN traffic.

Set Source to include the Edge tunnel interface and Destination to include the Branch tunnel interface. To configure this, you must have Multiple Interface Policies enabled. If you have not done this already, go to System > Feature Visibility.

Edit the policy allowing remote VPN traffic to include the tunnel interfaces.

On Branch, repeat steps 1 to 10 to include the following:

Addresses for both tunnel interfaces (enable Static Route Configuration for the Edge tunnel interface address)
A Phase 2 that allows traffic between the Branch tunnel interface and the Edge tunnel interface
A static route to the Edge tunnel interface

Edited policies that allow traffic to flow between the tunnel interfaces

To allow the new phase 2 to take effect, go to Monitor > IPsec Monitor, and restart the VPN tunnel.

Cookbook

Adding tunnel interfaces to the VPN

Adding tunnel interfaces to the VPN

Adding tunnel interfaces to the VPN