# Phase-1 down: the gateways never authenticated Source: https://ai.techclick.in/blog_vpn_ike_phase1_never_up Markdown: https://ai.techclick.in/blog_vpn_ike_phase1_never_up.md Publisher: Techclick Infosec Pvt Ltd Phase-1 down: PSK, IKEv1/v2, NAT-T UDP 500/4500, peer IP, proposals. diagnose vpn ike. Dummy WAN 203.0.113.10. ## The ticket New tunnel vpn-branch to 198.51.100.10. IPsec monitor: down. Junior already flipped Phase-2 to 0.0.0.0/0. diagnose vpn ike gateway list is empty. Phase-2 never had a chance. Quick interview answer Phase-1 is the IKE SA (IKEv2: IKE_SA_INIT + IKE_AUTH in RFC 7296). It authenticates the two gateways. Must match: IKE version, PSK or cert, remote-gw IP, encryption/integrity/DH proposal, and the path for UDP 500 plus NAT-T UDP 4500. FortiOS: diagnose vpn ike gateway list then diagnose debug application ike -1 . No IKE SA means do not debug proxy IDs yet. Hero · IKE door No IKE SA. The LAN is not in this ticket yet. Lab data · dummy only FortiGate fgt-hq mgmt 10.10.10.1 · WAN 203.0.113.10 · LAN 10.20.30.0/24 · FortiManager 10.10.10.5 · FortiAnalyzer 10.10.10.6 · Priya 10.20.30.80 · branch peer WAN 198.51.100.10 · Azure VPN GW public 203.0.113.50 · AWS VGW public 203.0.113.60 . RFC 5737. Not a customer. ## Mental model Must match This lab If it does not Peer IP / local WAN 203.0.113.10 ↔ 198.51.100.10 IKE never leaves, or hits the wrong box IKE version IKEv2 both sides (RFC 7296) No proposal accepted PSK or cert Same PSK, no trailing space AUTH fail after SA_INIT IKE proposal (enc / auth / DH) AES256 / SHA256 / DH14 or 19 both sides NO_PROPOSAL_CHOSEN UDP 500 and NAT-T 4500 WAN allow, NAT-T enable if a NAT sits in front Init, no response IKE path before any LAN packet UDP 500 and 4500 between WAN IPs fgt-hq WAN 203.0.113.10 - UDP 500 NAT-T 4500 Branch peer 198.51.100.10 IKE SA then Phase-2 Priya 10.20.30.80 is not a hop. IKE is WAN to WAN. https://fgt-hq.techclick-lab.in Training mock · not live FortiOS Dashboard Network VPN Policy VPN → IPsec Tunnels ### vpn-branch Phase-1 Name vpn-branch Remote Gateway Static IP Address 198.51.100.10 Interface port1 (WAN) NAT Traversal Enable IKE Version 2 Pre-shared Key (same string both sides) IKE Proposal AES256 / SHA256 / DH group as peer Cancel Save FortiOS 7.4 VPN → IPsec Tunnels, Phase-1. Training mock. ## How to choose New build: IKEv2 . IKEv1 only if the peer cannot do v2. NAT in front of either WAN: leave NAT Traversal enabled (FortiOS default on) so ESP rides UDP 4500. Do not disable NAT-T to “simplify” a home-lab peer behind CGNAT. ## Runbook #### Side A - path Confirm remote-gw 198.51.100.10 and local WAN 203.0.113.10. ISP/ACL must pass UDP 500 and 4500. Sniffer on WAN: do you see IKE out, and any reply? - #### Side B - identity Same IKE version, same PSK (retype both sides), same IKE proposal. Clock/NTP if you use certs. Do not edit Phase-2 yet. - #### Side C - prove diagnose vpn ike gateway list shows established. Then stop ike debug. Only then open the Phase-2 lesson. fgt-hq · IKE proof diagnose vpn ike gateway list # name: vpn-branch IKE version: 2 created: … # IKE SA: established (empty list = Phase-1 is this ticket) diagnose vpn ike log-filter dst-addr4 198.51.100.10 diagnose debug application ike -1 diagnose debug enable # Look for: NO_PROPOSAL_CHOSEN / AUTHENTICATION_FAILED / no response diagnose debug disable diagnose debug reset diagnose sniffer packet port1 "udp port 500 or udp port 4500" 4 20 ## Four failures ### 1 · PSK mismatch IKE_SA_INIT may succeed; IKE_AUTH fails. Retype the key. Hidden space in the GUI field is common. ### 2 · IKEv1 vs IKEv2 One side set Version 1. No SA. Align on v2 unless the peer is documented IKEv1-only (Azure policy-based Basic is the classic). ### 3 · Wrong peer IP Tunnel points at 198.51.100.11 or the Azure public of last week. Debug shows no response or a stranger. ### 4 · UDP 500/4500 blocked, or NAT-T off behind NAT ESP in protocol 50 dies on NAT. Enable NAT Traversal. Check the WAN ACL and the ISP. ## How to prove it Close Phase-1 only when 1) diagnose vpn ike gateway list shows established. 2) You named which of the five mismatches it was. 3) ike debug is off. 4) You did not rewrite proxy IDs to fix IKE. ## Traps Symptom First proof Wrong fix Monitor red, ike list empty Peer IP + UDP 500/4500 + PSK + version Change Phase-2 to 0.0.0.0/0 No response on sniffer Path / ACL / wrong WAN IP New DH group AUTH fail PSK / cert / local-id Disable NAT-T ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 Phase-1 authenticates… The two LAN subnets The two VPN gateways ssl.root users Azure GatewaySubnet Correct: b . IKE SA is gateway to gateway. Q2 diagnose vpn ike gateway list is empty. First move? Widen Phase-2 to 0.0.0.0/0 Fix IKE version, PSK, peer IP, proposals, UDP 500/4500 Add an SSL-VPN portal Enable split tunnel Correct: b . No IKE SA = Phase-1 ticket. Q3 NAT in front of the WAN. What must stay on? NAT Traversal so IKE/ESP can use UDP 4500 Central SNAT into the tunnel Policy-based VPN only IKEv1 only Correct: a . NAT-T. Q4 IKEv2 is specified in… RFC 7296 RFC 1918 RFC 5737 RFC 1912 Correct: a . Official IKE. Q5 NO_PROPOSAL_CHOSEN on ike debug means… PSK is wrong IKE enc/auth/DH proposals do not overlap Phase-2 selectors only DNS is down Correct: b . Proposal mismatch. Q6 Best Phase-1 proof command on FortiOS? get vpn ssl monitor diagnose vpn ike gateway list get system ha status diagnose hardware testsuite Correct: b . Runbook. Check answers Reset VPN scenario class series: S2S vs RA vs ZTNA · Phase-1 down · Phase-2 / proxy ID · Route vs policy · SSL split tunnel · FGT → Azure · FGT → AWS · VPN interview ## Sources - FortiOS 7.4 Administration Guide - IPsec VPN . - RFC 7296 - Internet Key Exchange Protocol Version 2 (IKEv2) . - FortiOS 7.4 - IPsec VPN (IKE / Phase-1 debug is on this page) . Related: FortiGate IPsec · Azure hub-spoke · AWS TGW . --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt