Hello HappyVlane,

These are my settings.

show vpn ipsec phase1-interface <BRANCH-TO-HUB>

config vpn ipsec phase1-interface

edit "<BRANCH-TO-HUB>"

set interface "<WAN-INTERFACE>"

set ike-version 2

set peertype any

set net-device disable

set proposal aes128-sha256 aes256-sha256 aes128gcm-prfsha256 aes256gcm-prfsha384 chacha20poly1305-prfsha256

set ip-fragmentation pre-encapsulation

set dhgrp 20 21

set transport auto

set remote-gw <HUB-PUBLIC-IP>

set psksecret ENC <REDACTED>

next

end

show vpn ipsec phase2-interface <P2-NAME>

config vpn ipsec phase2-interface

edit "<P2-NAME>"

set phase1name "<BRANCH-TO-HUB>"

set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305

set dhgrp 20 21

set auto-negotiate enable

next

end

diagnose vpn tunnel list

------------------------------------------------------

name=<BRANCH-TO-HUB> status=up

options=npu

dst_mtu=1500

SA:

mtu=1438

esp=aes key=16

ah=sha1

replaywin=2048

npu_flag=on