Multi-WAN IPSec Road Warrior

[RalfG]

First of all, big thanks to everyone here!

I'm struggling with a Multi-WAN Setup

WAN1+2, two equal PPPoE Interfaces running in just one Gatewaygroup (WANGWGROUP) Tier 1 Load Balancing.

Outgoing Traffic is all fine, load balancing between those two WANs (Rule in LAN using WANGWGROUP) works as expected.

But when it comes to local services like IPSec, only the first WAN interface marked as active will respond.

Int this case, when WAN2 is marked as active (default route), if I try to connect to IPSec explicitly to WAN1, a packet capture shows incoming packets on WAN1 (in trace and ipsec.log) but they are answered from WAN2 with a source address of WAN1.

If I try to connect to WAN2 everything's fine and fast.

Inbound Rules on WANGWGroup for UDP 500,4500 and ESP are set (gateway "default").

What am I doing wrong?

Ralf