# Interview: name the SA, the selector, the route, and the policy Source: https://ai.techclick.in/blog_vpn_interview_scenarios Markdown: https://ai.techclick.in/blog_vpn_interview_scenarios.md Publisher: Techclick Infosec Pvt Ltd Eighteen VPN interview scenarios: IKE SA, selectors, route, policy. Dummy fgt-hq 203.0.113.10 to branch and cloud. ## The ticket You have 12 minutes. The interviewer draws 203.0.113.10, Priya 10.20.30.80, branch 198.51.100.10, Azure 203.0.113.50, AWS 203.0.113.60. Talk like you closed those tickets. Strong answer pattern Name the job (S2S / RA / ZTNA) → name which SA (IKE vs IPsec) → name the selector pair → name the route (which tunnel if) → name the policy (intf pair, NAT) → name the proof command . Weak: “check the VPN.” Strong: “ diagnose vpn ike gateway list is established; diagnose vpn tunnel list has no child for 10.20.30.0/24-10.30.0.0/24.” Hero · whiteboard If you cannot draw IKE vs child SA, you are not ready. Lab data · dummy only FortiGate fgt-hq mgmt 10.10.10.1 · WAN 203.0.113.10 · LAN 10.20.30.0/24 · FortiManager 10.10.10.5 · FortiAnalyzer 10.10.10.6 · Priya 10.20.30.80 · branch peer WAN 198.51.100.10 · Azure VPN GW public 203.0.113.50 · AWS VGW public 203.0.113.60 . RFC 5737. Not a customer. ## Mental model Layer Question they are asking Proof Job S2S, RA, or ZTNA? Object / menu, not the word “VPN” IKE SA Did the gateways authenticate? diagnose vpn ike gateway list IPsec SA Does a child cover this flow? diagnose vpn tunnel list Route Does the lookup hit the tunnel if? get router info routing-table details Policy Both directions, NAT as designed? policyid / debug flow dest-intf Say the stack in this order Job then IKE then selectors then route then policy 1 Job 2 IKE SA - 3 Selector 4 Route 5 Policy Skipping a layer is how “VPN is up” survives into production. https://fgt-hq.techclick-lab.in Training mock · not live FortiOS Dashboard Network VPN Policy VPN → IPsec Tunnels / SSL-VPN / Network → Routes ### Whiteboard objects vpn-branch 198.51.100.10 · 10.30.0.0/24 via vpn-branch vpn-azure 203.0.113.50 · LNG 203.0.113.10 + 10.20.30.0/24 vpn-aws-t1 / t2 CGW 203.0.113.10 · two tunnels · 10.50.0.0/16 SSL-VPN pool 10.20.40.0/24 · split 10.20.30.0/24 · ssl.root ZTNA per-app, no pool IP Cancel Save Same dummy objects as lessons 1–7. Training mock. ## Eighteen questions (say these out loud) Contractor needs one HR URL. S2S, RA, or ZTNA? - Why is “Zscaler is just a VPN” a fail? - IKE list empty. First five checks? - NAT in front of WAN. Which UDP ports, and why NAT-T? - IKEv1 vs IKEv2 - which RFC, which default for new work? - Phase-1 up, no child SA. What do you print on both peers? - 0.0.0.0/0 vs 10.20.30.0/24 - who usually offers /0? - Both SAs up, ping dead. Route or PSK? - Route-based vs policy-based. What steers the packet? - Why is new design route-based, including Azure and AWS? - SNAT on the S2S policy. What does the branch see? - SSL-VPN full tunnel. Who pays for YouTube? - Why is the tunnel-mode policy from ssl.root, not WAN? - Azure LNG fields in this lab? - FortiGate remote-gw for Azure vs for the LNG - which IP? - Where do you get a VpnGw SKU from? - AWS: how many tunnels, and what is the Customer Gateway IP? - Strong close: name SA + selector + route + policy for Priya to 10.30.0.10. ## Runbook - #### Side A - draw From memory: WAN 203.0.113.10, LAN 10.20.30.0/24, branch 198.51.100.10 / 10.30.0.0/24, Azure 203.0.113.50 / 10.40.0.0/16, AWS 203.0.113.60 / 10.50.0.0/16, pool 10.20.40.0/24. - #### Side B - answer five with a command each IKE list, tunnel list, routing-table details, ssl monitor, Azure Connected / AWS two tunnels. - #### Side C - take the quiz Misses send you back to that lesson. Do not memorise menu names without the stack. Say these without opening notes diagnose vpn ike gateway list diagnose vpn tunnel list name vpn-branch get router info routing-table details 10.30.0.0 get vpn ssl monitor # Azure LNG: 203.0.113.10 + 10.20.30.0/24 # AWS CGW: 203.0.113.10 two tunnels from the download # Job first: S2S / RA / ZTNA ## Four interview fails ### 1 · “The VPN is up” Which SA, which selectors, which route, which policy. ### 2 · Feature dump They asked for a path through this lab, not a list of FortiOS objects. ### 3 · ZTNA = SSL-VPN = IPsec S2S Different jobs, different proof commands. ### 4 · Invented SKU, ASN, or tunnel inside /30 Say “from the current vendor doc / AWS file.” Guessing a number is a fail. ## How to prove it You are ready when You can walk questions 1–18 without notes, and every answer names a layer of the stack plus one command or portal object. ## Traps Weak Strong Reboot the FortiGate Which SA is missing, then ike debug filtered Zscaler is a VPN ZPA is per-app; IPsec is an encryption domain Azure LNG is the VpnGw public LNG = 203.0.113.10 + 10.20.30.0/24 AWS HA is one tunnel Two tunnels from the download file ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 “VPN is up” is incomplete until you name… IKE vs IPsec SA, selectors, route, and policy Only the PSK length The VpnGw Mbps from memory ssl.root on an S2S tunnel Correct: a . This lesson. Q2 Phase-1 down. You do not start with… Peer IP, IKE version, PSK, proposals, UDP 500/4500 Widening Phase-2 to 0.0.0.0/0 diagnose vpn ike gateway list A WAN sniffer for IKE Correct: b . Lesson 2. Q3 Azure local network gateway in this lab? 203.0.113.10 and 10.20.30.0/24 203.0.113.50 and 10.40.0.0/16 203.0.113.60 and 10.50.0.0/16 10.20.40.0/24 only Correct: a . Lesson 6. Q4 AWS Site-to-Site HA unit is… Two tunnels on one VPN connection One Phase-1 and hope SSL-VPN split ZTNA tags Correct: a . Lesson 7. Q5 Priya’s SSL-VPN policy incoming interface? ssl.root vpn-branch GatewaySubnet port1 only always Correct: a . Lesson 5. Q6 Zscaler ZPA / FortiOS ZTNA is… Just a VPN A per-app grant, not an encryption-domain tunnel The same as Phase-2 A Customer Gateway Correct: b . Lesson 1. Check answers Reset VPN scenario class series: S2S vs RA vs ZTNA · Phase-1 down · Phase-2 / proxy ID · Route vs policy · SSL split tunnel · FGT → Azure · FGT → AWS · VPN interview ## Sources - This series lessons 1–7 - official pages cited there. - FortiOS 7.4 - IPsec VPN . - FortiOS 7.4 - SSL-VPN . - About Azure VPN Gateway . - AWS Site-to-Site VPN . - RFC 7296 - IKEv2 . Related: FortiGate IPsec · Azure hub-spoke · AWS TGW . --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt