Description

We would like to be able to add the ip address to the existing loopback and configure the ipsec policy based vpns and 1 route based vpn to use the external interface lo.0, but to use the ip address that they have currently configred at the other device.

Solution

It is possible to configure multiple IP addresses on lo0 and bind specific VPNs to a chosen IP using local-address.

 

Syntax sample:

set interfaces lo0 unit 0 family inet address 10.0.0.1/30

set interfaces lo0 unit 0 family inet address 192.168.0.1/30

 

Then per VPN:

set security ike gateway GW1 external-interface lo0.0

set security ike gateway GW1 local-address 10.0.0.1

 

set security ike gateway GW2 external-interface lo0.0

set security ike gateway GW2 local-address 192.168.0.1

 

This allows different VPNs to terminate on different loopback IPs.

 

 

You must make sure that:

Security policies allow IKE/IPsec (UDP 500/4500, ESP)

Proper routing toward those loopback IPs

If NAT is involved → it must preserve destination IP

Modification History

2026-04-01 : Article Created

2026-04-06 : Updated the example to use RFC address reserved for private use