IT Toolbox
Guide

How to diagnose a Phase 2 IPsec FortiGate

When Phase 1 is up but traffic does not pass, the selectors and Phase 2 parameters are the first items to compare.

TopicFortiGate →
⌚ About 2 min read
View my favorites
FortiGate. Advanced. 25 min.

When Phase 1 is up but traffic does not pass, the selectors and Phase 2 parameters are the first items to compare.

Avant de commencer : adaptez toujours les commandes et manipulations à votre environnement. Sur un système de production, prévoyez une backup ou un retour arrière lorsque l’action peut modifier la configuration.

Étapes à suivre

  1. 1

    Check tunnel.

    Follow Phase 1 and I, SAs status.

  2. 2

    Compare selectors.

    Local and remote subnet must match both sides.

  3. 3

    Compare proposal.

    Encryption, ish, PFS and 2007 must be compatible.

  4. 4

    Generate traffic.

    Test a flow that matches the selectors exactly.

Commands utiles

The Vpn tunnel list.
Diagnostic debug application ike -1

À retenir

  • Cut the debug after the test.
  • Document the parameters of both peers.
← All les guides
Technical deep dive

FortiGate IPsec: Phase 1, Phase 2 and traffic are three separate validations

Technical checkpoints

  • Phase 1 validates IKE/peer/authentication; Phase 2 validates IPsec SAs/selectors. An “up” tunnel can still carry no traffic.
  • NAT-T uses UDP/4500 when NAT
  • Routes, policies, NAT and selectors must match the real traffic in both directions.

Targeted CLI

Read gateways/SAs then filter debug on the peer instead of enabling unbounded global IKE debug.

get vpn ipsec tunnel summary
diagnose vpn ike gateway list
diagnose vpn tunnel list

Topic-specific pitfalls

  • A FortiGate ping without a source can use a different interface than user traffic.
  • Phase 2 can be down because of selectors/proposals while Phase 1 is completely healthy.

How to validate

  • Expected SAs are up and RX/TX counters increase during the real traffic test.
  • Policy, route and session show the expected path without unintended NAT.
♡ 0