Phase 1 is established but no usable Phase 2 SA is created.
Probable causes
Frequent errors are inverted or too wide sub-networks, one side, different PFS, non-common proposal, missing route or policy that prevents the expected traffic from being generated. Unplanned network overlap or NAT can also complicate diagnosis. Do not modify several IKE parameters simultaneously: first compare the configuration of the two ends.
Verifications.
Check with. diagnose vpn tunnel list If IP-Secretariat IP-Secretariat Phase 2 exists and which networks are negotiated. local/remote selectors. The two pairs, encryption, the authentication, PFS and lifespans. Finally, generate traffic that really corresponds to the selectors: some tunnels only create SA when an interesting flow appears.
- Read the tunnel condition.
- Compare selectors and proposals on both sides.
- Check road and policy.
- Generate corresponding traffic.
Commands
diagnose vpn tunnel listdiagnose debug application ike -1Solutions.
Line up a single confirmed deviation at a time, then generate the expected traffic again and reread the SAs. If an IKE debug is required, run it for a short window with.diagnose debug application ike -1 and disable the debug immediately after capture. Final validation must include the actual application flow in both directions, not only the « up » state of the tunnel.
When to climb?
Escalader if the peer-save is not administered or if several tunnels overlap.
FAQ — FortiGate IPsec Phase 2.
Why can Phase 1 be up without Phase 2?.
Phase 1 validates the IKE relationship; Phase 2 still has to negotiate the parameters and selectors of the protected traffic.
Do we need traffic to see Phase 2?.
Depending on the configuration, yes: a flow corresponding to the selectors can trigger the creation of the SA.
What should be compared as a priority between the two peers?.
The selectors, proposals, PFS, lifespans and routing///88 allowing interesting traffic to exist.