Hello,
%dynamic is not allowed in IPSEC General Settings->Local subnet, the UI pretends that the value is invalid. Setting list local_subnet '%dynamic' directly in /etc/config/ipsec gives the desired result ie the SA are built the tunnel works but nothing can be saved from the UI after that.
Edit: found acceptable workaround: removing the local_subnet variable or leaving the field empty in the UI.
Regards,