IT Toolbox
Menu
Français
HomeHow to diagnose a Phase 2 IPsec FortiGate
Guide

How to diagnose a Phase 2 IPsec FortiGate

When Phase 1 is up but traffic does not pass, the selectors and Phase 2 parameters are the first items to compare

TopicIT resources → About 1 min read

When Phase 1 is up but traffic does not pass, the selectors and Phase 2 parameters are the first items to compare.

Steps.

  1. Check tunnel. —Consider Phase 1 and 1 status of SAs.
  2. Compare selectors. — Local and remote subnet must correspond on both sides.
  3. Compare proposal. — Encryption, ish, PFS and 2011 must be compatible.
  4. Generate traffic. — Test a flow corresponding to the selectors.

Commands

diagnose vpn tunnel list
diagnose debug application ike -1

Key takeaways

  • Cut the debug after the test.
  • Document the parameters of both peers.

See also:. Phase 2 IPsec FortiGate.

Related resources

Relevant topic How to diagnose IPsec Phase 1 error on FortiGate A Phase 1 error means that IPsec peers fail to properly establish l,IKE before even negotiating the Phase 2 selecto... Relevant topic FortiGate IPsec Phase 2 does not go up Phase 1 is established but no usable Phase 2 SA is created Relevant topic Diagnose an IPsec tunnel on FortiGate Identify a Phase 1, Phase 2, routing or political failure on a site-to-site tunnel Relevant topic Modify a FortiGate IPsec tunnel with a rollback plan Controlled change method of a site-to-site tunnel Relevant topic IPsec Phase 1 The first step in an IP-sec tunnel where peers negotiate the secure channel.
Support the development of BAOI Hosting, domains and new IT resources.
❤️ Support BAOI

My favorites