Role-Based Access Control (RBAC) governs every IPsec configuration action. Only users with the appropriate role can add, edit, or delete IPsec tunnels.

If the appliance is configured for a Primary Server Group Cluster (PSGC) or another replica-based configuration, an IPsec configuration change on the active node is not automatically applied to the replica. Configure IPsec tunnels on the replica separately, and reconfigure them after a role takeover.

During a platform upgrade maintenance window, IPsec configuration, edit, and delete operations are not available, consistent with other application-instance operations.