FortiOS name for proxy IDs?

Correct: a. FortiOS 7.4 field names.

Azure policy-based vs a FortiGate /24 selector. Risk?

Correct: b. Lesson + Azure traffic selectors.

Multi-vendor · IPsec / SSL-VPN · Lesson 3 of 8

Phase-1 up, Phase-2 down: the selectors are not the same conversation

IKE is green. The LAN ping still dies. Phase-2 / IPsec SA is the encryption domain: local and remote selectors (proxy IDs) must match or be compatible. 0.0.0.0/0 on one side and 10.20.30.0/24 on the other is the classic Azure/AWS mismatch. Do not call the tunnel up until the SA that covers the ping exists.

Updated 2026-08-18·19 min read·L2 primary·Quiz at end

After this page you can

Read Phase-2 selectors as local/remote proxy IDs.
Spot 0.0.0.0/0 vs a real subnet before rebuilding IKE.
Prove the IPsec SA with diagnose vpn tunnel list.
Not confuse a missing route with a selector miss.

The ticket

Monitor: Phase-1 up. Priya 10.20.30.80 cannot ping 10.30.0.10. HQ Phase-2 is 10.20.30.0/24 ↔ 10.30.0.0/24. Branch (or Azure policy-based) offered 0.0.0.0/0. No child SA for that ping.

Quick interview answer

Phase-2 is the IPsec SA (IKEv2 CREATE_CHILD_SA). Selectors - FortiOS “Phase 2 Selectors,” Check Point “encryption domain,” Cisco “proxy IDs,” Azure “traffic selectors” - must agree on the pair of prefixes. A /0 vs a /24 often fails negotiation. Route-based cloud peers may use 0.0.0.0/0 on purpose; policy-based peers usually need the exact subnets. Proof: diagnose vpn tunnel list shows the selector that matches the ping.

Mismatched IPsec selectors between HQ and branch — Green IKE, red child SA. The ping is not in anyone’s domain.

Lab data · dummy only

FortiGate fgt-hq mgmt 10.10.10.1 · WAN 203.0.113.10 · LAN 10.20.30.0/24 · FortiManager 10.10.10.5 · FortiAnalyzer 10.10.10.6 · Priya 10.20.30.80 · branch peer WAN 198.51.100.10 · Azure VPN GW public 203.0.113.50 · AWS VGW public 203.0.113.60. RFC 5737. Not a customer.

Mental model

Name on the box	What it is	This lab must say
FortiOS Phase 2 Selectors	Local Address / Remote Address	local 10.20.30.0/24 remote 10.30.0.0/24
Proxy ID / encryption domain	Same idea on Cisco / Check Point	Those two prefixes, both directions
Azure / AWS traffic selectors	What the cloud child SA will accept	Match the FortiGate, or use route-based 0/0 on both
PFS / Phase-2 proposal	Second negotiation after selectors	Same enc/auth/PFS group

Child SA only covers the agreed pair

If only one side says 0.0.0.0/0, many peers refuse the child SA.

https://fgt-hq.techclick-lab.in

Training mock · not live

FortiOS

DashboardNetworkVPNPolicy

VPN → IPsec Tunnels → vpn-branch

Phase 2 Selectors

Name

vpn-branch-p2

Local Address

10.20.30.0/24

Remote Address

10.30.0.0/24

PFS

Same group as peer, or both off

Auto-negotiate

Enable (so SA comes up without waiting for traffic)

FortiOS 7.4 Phase 2 Selectors. Training mock.

How to choose

Two FortiGates in this lab: exact subnets both ways. Azure/AWS policy-based or “use policy-based traffic selectors”: read the cloud selector list and mirror it. Azure route-based VNet GW often wants 0.0.0.0/0 ↔ 0.0.0.0/0 on the FortiGate Phase-2; a leftover /24 on only one side is the ticket. Prefer route-based so you are not maintaining a selector matrix.

Runbook

Side A - IKE first
diagnose vpn ike gateway list must already show established. If not, go back to lesson 2.
Side B - print both selectors
HQ: local 10.20.30.0/24 remote 10.30.0.0/24. Peer: the reverse, or an agreed 0/0 pair. PFS and Phase-2 proposal aligned.
Side C - prove the child SA
diagnose vpn tunnel list name vpn-branch shows selectors that contain 10.20.30.80 → 10.30.0.10. Then sourced ping. If SA is up and ping dies, that is route/policy (next lesson), not proxy ID.

fgt-hq · Phase-2 proof

diagnose vpn ike gateway list
# IKE SA: established

diagnose vpn tunnel list name vpn-branch
# dest: 198.51.100.10  status: up
# selectors: 10.20.30.0/24 - 10.30.0.0/24
# num of child sa: 0   ← Phase-2 still this ticket

execute ping-options source 10.20.30.1
execute ping 10.30.0.10

Four failures

1 · 0.0.0.0/0 vs 10.20.30.0/24

Classic vs Azure policy-based and vs a peer that auto-offers /0. Mirror the peer or move both sides to route-based /0.

2 · Extra Phase-2 that never matches the ping

You have an SA for 10.20.30.0/24 ↔ 10.40.0.0/16 (Azure) but Priya is pinging the branch. Wrong child.

3 · PFS / Phase-2 proposal mismatch

Selectors look identical. Child SA still dies. Align PFS group or disable PFS on both.

4 · Auto-negotiate off, no interesting traffic

SA waits for a packet that SNAT or routing never sends. Enable auto-negotiate or ping with the LAN source.

How to prove it

Close Phase-2 only when

1) IKE still up. 2) tunnel list shows a child SA whose selectors contain the test flow. 3) You can explain /0 vs /24 if either side uses it. 4) You did not reset the PSK to fix selectors.

Traps

GUI said	You still print	Wrong fix
VPN up	Which SA: IKE or IPsec, and which selectors	New PSK
Phase-2 down	Both peers’ local/remote prefixes + PFS	Disable the firewall policy
SA up, ping dead	Route + policy + SNAT (lesson 4)	Another Phase-2

VPN scenario class series: S2S vs RA vs ZTNA · Phase-1 down · Phase-2 / proxy ID · Route vs policy · SSL split tunnel · FGT → Azure · FGT → AWS · VPN interview

Sources

Related: FortiGate IPsec · Azure hub-spoke · AWS TGW.