IT Toolbox
Guide

How to check the state of an IPsec FortiGate tunnel

Quickly check the state of the IPsec tunnels since the FortiGate LTC….

TopicFortiGate →
⌚ About 2 min read
View my favorites
FortiGate & VPN Advanced. 8 min.8 min.8 min.8 min.8 min.8 min.8 min.8 min.8 min. 8 min.8 min.8 min.8 min.8.8 min.8 min.8 min.8 min.8 min.8.8 min.8 min.8.8 min.8 min.8 min.8 min.8 min.8 min.8 min.8.8.8.8.8.8.8.8.8.8.8.8 min.8 min.8.

Quickly check the state of the IPsec tunnels since the FortiGate LTC.

Avant de commencer : adaptez toujours les commandes et manipulations à votre environnement. Sur un système de production, prévoyez une backup ou un retour arrière lorsque l’action peut modifier la configuration.

Étapes à suivre

  1. 1

    Connect to the CLI.

    Use secure of administration access.

  2. 2

    Show VPN Summary.

    Use the ipsec tunnel summary.

  3. 3

    Control a specific tunnel.

    Use the name of the tunnel.

  4. 4

    Check roads and policies.

    A mounted tunnel does not guarantee that traffic is permitted.

  5. 5

    Watch the logs if necessary

    Analyze VPN andGamber events before you activate a deep debug.

Commands utiles

ip sec tunnel
The name of the tunnel list name

À retenir

  • The exact commands can vary according to the FortiOS version.
  • Disable debug after use to avoid unnecessary load and volume of logs.
← All les guides
Technical deep dive

FortiGate IPsec: Phase 1, Phase 2 and traffic are three separate validations

Technical checkpoints

  • Phase 1 validates IKE/peer/authentication; Phase 2 validates IPsec SAs/selectors. An “up” tunnel can still carry no traffic.
  • NAT-T uses UDP/4500 when NAT
  • Routes, policies, NAT and selectors must match the real traffic in both directions.

Targeted CLI

Read gateways/SAs then filter debug on the peer instead of enabling unbounded global IKE debug.

get vpn ipsec tunnel summary
diagnose vpn ike gateway list
diagnose vpn tunnel list

Topic-specific pitfalls

  • A FortiGate ping without a source can use a different interface than user traffic.
  • Phase 2 can be down because of selectors/proposals while Phase 1 is completely healthy.

How to validate

  • Expected SAs are up and RX/TX counters increase during the real traffic test.
  • Policy, route and session show the expected path without unintended NAT.
♡ 0