set nat cgnat log-allocation
set nat cgnat pool external ext-01 external-port-range '1024-65535'
set nat cgnat pool external ext-01 per-user-limit port '2000'
set nat cgnat pool external ext-01 range 192.168.122.222/32
set nat cgnat pool internal int-01 range '100.64.0.0/28'
set nat cgnat rule 10 source pool 'int-01'
set nat cgnat rule 10 translation pool 'ext-01'

Jun 10 14:10:02 r4 sudo[9057]:     vyos : TTY=pts/0 ; PWD=/home/vyos ; USER=root ; COMMAND=/usr/bin/sh -c ' /usr/libexec/vyos/conf_mode/nat_cgnat.py'
Jun 10 14:10:02 r4 sudo[9057]: pam_unix(sudo:session): session opened for user root(uid=0) by vyos(uid=1003)
Jun 10 14:10:03 r4 cgnat[9059]: Internal host: 100.64.0.0, external host: 192.168.122.222, Port range: 1024-3023
Jun 10 14:10:03 r4 cgnat[9059]: Internal host: 100.64.0.1, external host: 192.168.122.222, Port range: 3024-5023
Jun 10 14:10:03 r4 cgnat[9059]: Internal host: 100.64.0.2, external host: 192.168.122.222, Port range: 5024-7023
Jun 10 14:10:03 r4 cgnat[9059]: Internal host: 100.64.0.3, external host: 192.168.122.222, Port range: 7024-9023
Jun 10 14:10:03 r4 cgnat[9059]: Internal host: 100.64.0.4, external host: 192.168.122.222, Port range: 9024-11023
Jun 10 14:10:03 r4 cgnat[9059]: Internal host: 100.64.0.5, external host: 192.168.122.222, Port range: 11024-13023
Jun 10 14:10:03 r4 cgnat[9059]: Internal host: 100.64.0.6, external host: 192.168.122.222, Port range: 13024-15023
Jun 10 14:10:03 r4 cgnat[9059]: Internal host: 100.64.0.7, external host: 192.168.122.222, Port range: 15024-17023
Jun 10 14:10:03 r4 cgnat[9059]: Internal host: 100.64.0.8, external host: 192.168.122.222, Port range: 17024-19023
Jun 10 14:10:03 r4 cgnat[9059]: Internal host: 100.64.0.9, external host: 192.168.122.222, Port range: 19024-21023
Jun 10 14:10:03 r4 cgnat[9059]: Internal host: 100.64.0.10, external host: 192.168.122.222, Port range: 21024-23023
Jun 10 14:10:03 r4 cgnat[9059]: Internal host: 100.64.0.11, external host: 192.168.122.222, Port range: 23024-25023
Jun 10 14:10:03 r4 cgnat[9059]: Internal host: 100.64.0.12, external host: 192.168.122.222, Port range: 25024-27023
Jun 10 14:10:03 r4 cgnat[9059]: Internal host: 100.64.0.13, external host: 192.168.122.222, Port range: 27024-29023
Jun 10 14:10:03 r4 cgnat[9059]: Internal host: 100.64.0.14, external host: 192.168.122.222, Port range: 29024-31023
Jun 10 14:10:03 r4 cgnat[9059]: Internal host: 100.64.0.15, external host: 192.168.122.222, Port range: 31024-33023
Jun 10 14:10:03 r4 sudo[9057]: pam_unix(sudo:session): session closed for user root

vyos@vyos:~$ dpkg -l | grep vyos-1x
ii  vyos-1x                              1.5dev0-1669-g77cb661d8          amd64        VyOS configuration scripts and data
ii  vyos-1x-vmware                       1.5dev0-1669-g77cb661d8          amd64        VyOS configuration scripts and data for VMware
vyos@vyos:~$

vyos@vyos# show vpn ipsec | commands 
set esp-group vpn lifetime '3600'
set esp-group vpn pfs 'enable'
set esp-group vpn proposal 10 encryption 'aes128gcm128'
set esp-group vpn proposal 10 hash 'sha256'
set ike-group vpn key-exchange 'ikev2'
set ike-group vpn lifetime '7200'
set ike-group vpn proposal 10 dh-group '14'
set ike-group vpn proposal 10 encryption 'aes128gcm128'
set ike-group vpn proposal 10 hash 'sha256'
set interface 'eth0'
set options virtual-ip
set remote-access connection support authentication client-mode 'eap-mschapv2'
set remote-access connection support authentication local-id 'ipsec.somedomain'
set remote-access connection support authentication local-users username test password 'test'
set remote-access connection support authentication server-mode 'x509'
set remote-access connection support authentication x509 ca-certificate 'isrgrootx1'
set remote-access connection support authentication x509 ca-certificate 'lets-encrypt-r3'
set remote-access connection support authentication x509 certificate 'vpn2'
set remote-access connection support description 'support remote access'
set remote-access connection support esp-group 'vpn'
set remote-access connection support ike-group 'vpn'
set remote-access connection support local-address 'ip on eth0'
set remote-access connection support pool 'support'
set remote-access pool support name-server '1.1.1.1'
set remote-access pool support name-server '9.9.9.9'
set remote-access pool support prefix '192.168.120.64/27'
[edit]
vyos@vyos#

vyos@vyos:~$ generate ipsec profile windows-remote-access support remote ipsec.somedomain 
Traceback (most recent call last):
  File "/usr/libexec/vyos/op_mode/ikev2_profile_generator.py", line 154, in <module>
    cert = load_certificate(pki['certificate'][cert_name]['certificate'])
                            ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^
KeyError: 'certificate'
vyos@vyos:~$ show ver
Version:          VyOS 1.5-rolling-202406060020
Release train:    current
Release flavor:   generic