IT Toolbox
Guide

How to diagnose IPsec Phase 1 error on FortiGate

A Phase 1 error means that IPsec peers fail to properly establish the IKE before even negotiating the Phase 2 selectors.

TopicFortiGate →
⌚ About 2 min read
View my favorites
FortiGate / VPN Advanced. 20 min

A Phase 1 error means that IPsec peers fail to properly establish the IKE before even negotiating the Phase 2 selectors.

Avant de commencer : adaptez toujours les commandes et manipulations à votre environnement. Sur un système de production, prévoyez une backup ou un retour arrière lorsque l’action peut modifier la configuration.

Étapes à suivre

  1. 1

    To support public IPs

    Check the source, IP and destination actually used.

  2. 2

    Compare IKE settings

    Mode, IKE version, proposals, DH group and shared key must be compatible.

  3. 3

    Check WAN routing

    Ensure that traffic starts with the right interface.

  4. 4

    Observer the debug

    Activate a IKE debug targeted on the peer for a short window.

  5. 5

    Correlate both sides

    Compare the exact time and message on the twoGartans.

Commands utiles

The FIGURE VPN ike(56).
Diagnostic debug application ike -1
D.D.D.F.

À retenir

  • Disable the debug after the test.
  • A Phase 1 error does not resolve by modifying the Phase 2 selectors.
  • Also check for operator, NAT upstream and public IP changes.
← All les guides
Technical deep dive

FortiGate IPsec: Phase 1, Phase 2 and traffic are three separate validations

Technical checkpoints

  • Phase 1 validates IKE/peer/authentication; Phase 2 validates IPsec SAs/selectors. An “up” tunnel can still carry no traffic.
  • NAT-T uses UDP/4500 when NAT is detected; otherwise IKE typically starts on UDP/500.
  • Routes, policies, NAT and selectors must match the real traffic in both directions.

Targeted CLI

Read gateways/SAs then filter debug on the peer instead of enabling unbounded global IKE debug.

get vpn ipsec tunnel summary
diagnose vpn ike gateway list
diagnose vpn tunnel list

Topic-specific pitfalls

  • A FortiGate ping
  • Phase 2 can be down because of selectors/proposals while Phase 1 is completely healthy.

How to validate

  • Expected SAs are up and RX/TX counters increase during the real traffic test.
  • Policy, route and session show the expected path without unintended NAT.
♡ 0