Multi-vendor · IPsec / SSL-VPN · Lesson 8 of 8

Interview: name the SA, the selector, the route, and the policy

Interviewers do not want “VPN is encrypted.” They want: which SA is down, which selector pair, which route, which policy. Walk this dummy lab out loud: branch 198.51.100.10, Azure 203.0.113.50, AWS two tunnels, Priya on SSL-VPN 10.20.40.10. Weak: “the VPN is up.” Strong: IKE vs IPsec vs 10.20.30.0/24 ↔ 10.30.0.0/24 vs vpn-branch vs NAT off.

Updated 2026-08-18·18 min read·L2 primary·Quiz at end

After this page you can

Answer with SA + selector + route + policy + a proof command.
Refuse weak lines: reboot, any-any, “Zscaler is a VPN.”
Map each question to a lesson in this series.
Score yourself on the six judgment items.

The ticket

You have 12 minutes. The interviewer draws 203.0.113.10, Priya 10.20.30.80, branch 198.51.100.10, Azure 203.0.113.50, AWS 203.0.113.60. Talk like you closed those tickets.

Strong answer pattern

Name the job (S2S / RA / ZTNA) → name which SA (IKE vs IPsec) → name the selector pair → name the route (which tunnel if) → name the policy (intf pair, NAT) → name the proof command. Weak: “check the VPN.” Strong: “diagnose vpn ike gateway list is established; diagnose vpn tunnel list has no child for 10.20.30.0/24-10.30.0.0/24.”

Interview whiteboard with dummy VPN lab IPs — If you cannot draw IKE vs child SA, you are not ready.

Lab data · dummy only

FortiGate fgt-hq mgmt 10.10.10.1 · WAN 203.0.113.10 · LAN 10.20.30.0/24 · FortiManager 10.10.10.5 · FortiAnalyzer 10.10.10.6 · Priya 10.20.30.80 · branch peer WAN 198.51.100.10 · Azure VPN GW public 203.0.113.50 · AWS VGW public 203.0.113.60. RFC 5737. Not a customer.

Mental model

Layer	Question they are asking	Proof
Job	S2S, RA, or ZTNA?	Object / menu, not the word “VPN”
IKE SA	Did the gateways authenticate?	diagnose vpn ike gateway list
IPsec SA	Does a child cover this flow?	diagnose vpn tunnel list
Route	Does the lookup hit the tunnel if?	get router info routing-table details
Policy	Both directions, NAT as designed?	policyid / debug flow dest-intf

Say the stack in this order

Skipping a layer is how “VPN is up” survives into production.

https://fgt-hq.techclick-lab.in

Training mock · not live

FortiOS

DashboardNetworkVPNPolicy

VPN → IPsec Tunnels / SSL-VPN / Network → Routes

Whiteboard objects

vpn-branch

198.51.100.10 · 10.30.0.0/24 via vpn-branch

vpn-azure

203.0.113.50 · LNG 203.0.113.10 + 10.20.30.0/24

vpn-aws-t1 / t2

CGW 203.0.113.10 · two tunnels · 10.50.0.0/16

SSL-VPN

pool 10.20.40.0/24 · split 10.20.30.0/24 · ssl.root

ZTNA

per-app, no pool IP

Same dummy objects as lessons 1–7. Training mock.

Eighteen questions (say these out loud)

Contractor needs one HR URL. S2S, RA, or ZTNA?
Why is “Zscaler is just a VPN” a fail?
IKE list empty. First five checks?
NAT in front of WAN. Which UDP ports, and why NAT-T?
IKEv1 vs IKEv2 - which RFC, which default for new work?
Phase-1 up, no child SA. What do you print on both peers?
0.0.0.0/0 vs 10.20.30.0/24 - who usually offers /0?
Both SAs up, ping dead. Route or PSK?
Route-based vs policy-based. What steers the packet?
Why is new design route-based, including Azure and AWS?
SNAT on the S2S policy. What does the branch see?
SSL-VPN full tunnel. Who pays for YouTube?
Why is the tunnel-mode policy from ssl.root, not WAN?
Azure LNG fields in this lab?
FortiGate remote-gw for Azure vs for the LNG - which IP?
Where do you get a VpnGw SKU from?
AWS: how many tunnels, and what is the Customer Gateway IP?
Strong close: name SA + selector + route + policy for Priya to 10.30.0.10.

Runbook

Side A - draw
From memory: WAN 203.0.113.10, LAN 10.20.30.0/24, branch 198.51.100.10 / 10.30.0.0/24, Azure 203.0.113.50 / 10.40.0.0/16, AWS 203.0.113.60 / 10.50.0.0/16, pool 10.20.40.0/24.
Side B - answer five with a command each
IKE list, tunnel list, routing-table details, ssl monitor, Azure Connected / AWS two tunnels.
Side C - take the quiz
Misses send you back to that lesson. Do not memorise menu names without the stack.

Say these without opening notes

diagnose vpn ike gateway list
diagnose vpn tunnel list name vpn-branch
get router info routing-table details 10.30.0.0
get vpn ssl monitor
# Azure LNG: 203.0.113.10 + 10.20.30.0/24
# AWS CGW: 203.0.113.10   two tunnels from the download
# Job first: S2S / RA / ZTNA

Four interview fails

1 · “The VPN is up”

Which SA, which selectors, which route, which policy.

2 · Feature dump

They asked for a path through this lab, not a list of FortiOS objects.

3 · ZTNA = SSL-VPN = IPsec S2S

Different jobs, different proof commands.

4 · Invented SKU, ASN, or tunnel inside /30

Say “from the current vendor doc / AWS file.” Guessing a number is a fail.

How to prove it

You are ready when

You can walk questions 1–18 without notes, and every answer names a layer of the stack plus one command or portal object.

Traps

Weak	Strong
Reboot the FortiGate	Which SA is missing, then ike debug filtered
Zscaler is a VPN	ZPA is per-app; IPsec is an encryption domain
Azure LNG is the VpnGw public	LNG = 203.0.113.10 + 10.20.30.0/24
AWS HA is one tunnel	Two tunnels from the download file

VPN scenario class series: S2S vs RA vs ZTNA · Phase-1 down · Phase-2 / proxy ID · Route vs policy · SSL split tunnel · FGT → Azure · FGT → AWS · VPN interview

Sources

This series lessons 1–7 - official pages cited there.
FortiOS 7.4 - IPsec VPN.
FortiOS 7.4 - SSL-VPN.
About Azure VPN Gateway.
AWS Site-to-Site VPN.
RFC 7296 - IKEv2.

Related: FortiGate IPsec · Azure hub-spoke · AWS TGW.