Hi, > Does %dynamic work in net2net? Or only in road-warrior scenarios? If any has been negotiated, %dynamic resolves to the virtual IP for that endpoint. If not, it resolves to the IKE endpoint address. It can be used in either scenario, but has a slightly different behavior. Regards Martin