FortiGate VPNs — IPsec Phase 1+2, SSL VPN, and the CVE-2024-21762 Hardening Every L2 Must Know

Why this matters — the visa interview analogy

Picture a visa interview at the Indian consulate in Frankfurt. Phase 1 is the identity check — the officer verifies your passport, fingerprints, and that you are who you claim. Phase 1 is not about the visa; it is about trust. Phase 2 is the actual visa stamp negotiation — which countries, how many entries, how long. Phase 2 only happens after Phase 1 succeeds. Fail the identity check, and the visa conversation never starts.

FortiGate's IPsec works exactly the same. IKE Phase 1 authenticates the two peers and builds a secure control channel. IKE Phase 2 then negotiates the actual data SAs that will encrypt your user packets via ESP. Phase 2 cannot start until Phase 1 finishes. Get this single mental model right and the next 10 minutes of the interview belong to you.

Two phases every interviewer will test

PSK auth in Phase 1 is fastest to set up — two FortiGates, one shared secret, done. Certificate auth scales further: each peer uses an X.509 cert signed by your internal CA. The trade-off is operational: PSK = one secret to rotate per tunnel; cert = a PKI to run. DH group 14 is the floor everyone should hit in 2026; 19 or 20 (ECDH P-256/P-384) for fresh deployments. PFS on Phase 2 is non-negotiable in 2026.

IKE negotiation — see the 6-step handshake

The first time Suhail's the Pune branch FortiGate talks to Bangalore HQ, six discrete messages fly over UDP. Get the order right and you can debug any "tunnel won't come up" in under 90 seconds.

Real config — IKEv2 site-to-site, both sides

Here is the minimum viable config for Suhail's tunnel. Both FortiGates need a Phase 1 (peer + auth + DH), a Phase 2 (selectors), and a static route pointing the partner subnet at the tunnel interface.

config vpn ipsec phase1-interface
    edit "the enterprise-BLR-HQ"
        set interface "wan1"
        set ike-version 2
        set peertype any
        set proposal aes256gcm-prfsha256
        set dhgrp 14
        set remote-gw 203.0.113.10
        set psksecret "Hcl@Br@nch2HQ#2026"
        set dpd on-idle
        set dpd-retryinterval 20
    next
end

config vpn ipsec phase2-interface
    edit "the enterprise-BLR-HQ-P2"
        set phase1name "the enterprise-BLR-HQ"
        set proposal aes256gcm
        set pfs enable
        set dhgrp 14
        set keylifeseconds 1800
        set src-subnet 10.20.10.0 255.255.255.0
        set dst-subnet 10.10.0.0 255.255.0.0
    next
end

config router static
    edit 0
        set dst 10.10.0.0 255.255.0.0
        set device "the enterprise-BLR-HQ"
    next
end

name           peer            status  uptime    p1/p2
the enterprise-BLR-HQ     203.0.113.10    up      00:00:17  1/1

SSL VPN — tunnel vs portal, and why DTLS matters

Suhail's second project — 200 work-from-home users on FortiClient. SSL VPN has two flavours, and confusing them in an interview is an instant fail.

Tunnel mode gives the user a real Layer-3 VPN. FortiClient on the laptop creates a virtual adapter, gets a virtual IP from the SSL VPN pool, and the FortiGate pushes split-tunnel routes (e.g. 10.10.0.0/16 via tunnel). Every corporate-bound packet rides DTLS (UDP 443 by default for speed) or TLS (TCP 443 fallback). Browser-only apps, RDP, SSH, file shares — all of it works.

Portal mode is clientless — the user opens a browser, logs into the FortiGate's SSL VPN portal page, and clicks bookmarks: pre-defined RDP, SSH, HTTP/HTTPS shortcuts that the FortiGate proxies on the user's behalf. No virtual IP. No real routing. Useful for unmanaged BYOD laptops where you do not want to install FortiClient. Limited because anything not bookmarked is unreachable.

DTLS matters because tunnel-mode SSL VPN over TLS (TCP) suffers from "TCP-over-TCP" — when a user's RDP session inside the tunnel hits packet loss, both the inner TCP and the outer TCP retransmit, killing throughput. DTLS rides UDP so only the inner stream retransmits. FortiGate prefers DTLS on UDP 443; falls back to TLS on TCP 443 if UDP is blocked (think hotel WiFi, corporate proxies).

The CVE-2024-21762 era — patched is not clean

2024 changed how every L2 thinks about FortiGate SSL VPN. Three incidents you must be able to talk through in any interview after Feb 2024.

Debug a dead tunnel — settle Phase 1/2 in 90 seconds

Rishabh, an L3 at an Indian security firm Bangalore, does not argue about tunnels. He runs three commands.

diagnose vpn ike gateway list name the enterprise-BLR-HQ
diagnose vpn tunnel list name the enterprise-BLR-HQ
get vpn ipsec tunnel summary

vd: root/0
name: the enterprise-BLR-HQ
version: 2
interface: wan1 9
addr: 203.0.113.45:500 -> 203.0.113.10:500
created: 17s ago
IKE SA: created 1/1  established 1/1  time 17ms
auth: psk
DH group: 14
encryption: aes-256-gcm
state: established