@ScotC I should have mentioned that it was a LAN-to-LAN (aka site-to-site) VPN. I want the remote LAN to be able to access all of my subnets.

I want to create an IPSec VPN that can reach more than one local subnet. Each subnet is on a separate VLAN. What would be the correct way to do this? Do I need to create a separate policy for each...

On my ER605, the IPsec VPN IKE Phase 1 DH Group maxes out at 5. Are there plans to support more secure DH Groups such as 14?