The ticket
New tunnel vpn-branch to 198.51.100.10. IPsec monitor: down. Junior already flipped Phase-2 to 0.0.0.0/0. diagnose vpn ike gateway list is empty. Phase-2 never had a chance.
Phase-1 is the IKE SA (IKEv2: IKE_SA_INIT + IKE_AUTH in RFC 7296). It authenticates the two gateways. Must match: IKE version, PSK or cert, remote-gw IP, encryption/integrity/DH proposal, and the path for UDP 500 plus NAT-T UDP 4500. FortiOS: diagnose vpn ike gateway list then diagnose debug application ike -1. No IKE SA means do not debug proxy IDs yet.
FortiGate fgt-hq mgmt 10.10.10.1 · WAN 203.0.113.10 · LAN 10.20.30.0/24 · FortiManager 10.10.10.5 · FortiAnalyzer 10.10.10.6 · Priya 10.20.30.80 · branch peer WAN 198.51.100.10 · Azure VPN GW public 203.0.113.50 · AWS VGW public 203.0.113.60. RFC 5737. Not a customer.
Mental model
| Must match | This lab | If it does not |
|---|---|---|
| Peer IP / local WAN | 203.0.113.10 ↔ 198.51.100.10 | IKE never leaves, or hits the wrong box |
| IKE version | IKEv2 both sides (RFC 7296) | No proposal accepted |
| PSK or cert | Same PSK, no trailing space | AUTH fail after SA_INIT |
| IKE proposal (enc / auth / DH) | AES256 / SHA256 / DH14 or 19 both sides | NO_PROPOSAL_CHOSEN |
| UDP 500 and NAT-T 4500 | WAN allow, NAT-T enable if a NAT sits in front | Init, no response |
Priya 10.20.30.80 is not a hop. IKE is WAN to WAN.
vpn-branch Phase-1
How to choose
New build: IKEv2. IKEv1 only if the peer cannot do v2. NAT in front of either WAN: leave NAT Traversal enabled (FortiOS default on) so ESP rides UDP 4500. Do not disable NAT-T to “simplify” a home-lab peer behind CGNAT.
Runbook
Side A - path
Confirm remote-gw 198.51.100.10 and local WAN 203.0.113.10. ISP/ACL must pass UDP 500 and 4500. Sniffer on WAN: do you see IKE out, and any reply?
Side B - identity
Same IKE version, same PSK (retype both sides), same IKE proposal. Clock/NTP if you use certs. Do not edit Phase-2 yet.
Side C - prove
diagnose vpn ike gateway listshows established. Then stop ike debug. Only then open the Phase-2 lesson.
diagnose vpn ike gateway list # name: vpn-branch IKE version: 2 created: … # IKE SA: established (empty list = Phase-1 is this ticket) diagnose vpn ike log-filter dst-addr4 198.51.100.10 diagnose debug application ike -1 diagnose debug enable # Look for: NO_PROPOSAL_CHOSEN / AUTHENTICATION_FAILED / no response diagnose debug disable diagnose debug reset diagnose sniffer packet port1 "udp port 500 or udp port 4500" 4 20
Four failures
1 · PSK mismatch
IKE_SA_INIT may succeed; IKE_AUTH fails. Retype the key. Hidden space in the GUI field is common.
2 · IKEv1 vs IKEv2
One side set Version 1. No SA. Align on v2 unless the peer is documented IKEv1-only (Azure policy-based Basic is the classic).
3 · Wrong peer IP
Tunnel points at 198.51.100.11 or the Azure public of last week. Debug shows no response or a stranger.
4 · UDP 500/4500 blocked, or NAT-T off behind NAT
ESP in protocol 50 dies on NAT. Enable NAT Traversal. Check the WAN ACL and the ISP.
How to prove it
1) diagnose vpn ike gateway list shows established. 2) You named which of the five mismatches it was. 3) ike debug is off. 4) You did not rewrite proxy IDs to fix IKE.
Traps
| Symptom | First proof | Wrong fix |
|---|---|---|
| Monitor red, ike list empty | Peer IP + UDP 500/4500 + PSK + version | Change Phase-2 to 0.0.0.0/0 |
| No response on sniffer | Path / ACL / wrong WAN IP | New DH group |
| AUTH fail | PSK / cert / local-id | Disable NAT-T |
Knowledge check
Judgment items. One best answer. Reasons send you back to the matching section.
VPN scenario class series: S2S vs RA vs ZTNA · Phase-1 down · Phase-2 / proxy ID · Route vs policy · SSL split tunnel · FGT → Azure · FGT → AWS · VPN interview
Sources
- FortiOS 7.4 Administration Guide - IPsec VPN.
- RFC 7296 - Internet Key Exchange Protocol Version 2 (IKEv2).
- FortiOS 7.4 - IPsec VPN (IKE / Phase-1 debug is on this page).
Related: FortiGate IPsec · Azure hub-spoke · AWS TGW.