# Phase-1 up, Phase-2 down: the selectors are not the same conversation Source: https://ai.techclick.in/blog_vpn_phase2_proxyid_encrypt_domain Markdown: https://ai.techclick.in/blog_vpn_phase2_proxyid_encrypt_domain.md Publisher: Techclick Infosec Pvt Ltd Phase-1 up, Phase-2 down: proxy ID / encryption domain / selectors must match. 0.0.0.0/0 vs subnet. Dummy 10.20.30.0/24. ## The ticket Monitor: Phase-1 up. Priya 10.20.30.80 cannot ping 10.30.0.10. HQ Phase-2 is 10.20.30.0/24 ↔ 10.30.0.0/24. Branch (or Azure policy-based) offered 0.0.0.0/0. No child SA for that ping. Quick interview answer Phase-2 is the IPsec SA (IKEv2 CREATE_CHILD_SA). Selectors - FortiOS “Phase 2 Selectors,” Check Point “encryption domain,” Cisco “proxy IDs,” Azure “traffic selectors” - must agree on the pair of prefixes. A /0 vs a /24 often fails negotiation. Route-based cloud peers may use 0.0.0.0/0 on purpose; policy-based peers usually need the exact subnets. Proof: diagnose vpn tunnel list shows the selector that matches the ping. Hero · two maps Green IKE, red child SA. The ping is not in anyone’s domain. Lab data · dummy only FortiGate fgt-hq mgmt 10.10.10.1 · WAN 203.0.113.10 · LAN 10.20.30.0/24 · FortiManager 10.10.10.5 · FortiAnalyzer 10.10.10.6 · Priya 10.20.30.80 · branch peer WAN 198.51.100.10 · Azure VPN GW public 203.0.113.50 · AWS VGW public 203.0.113.60 . RFC 5737. Not a customer. ## Mental model Name on the box What it is This lab must say FortiOS Phase 2 Selectors Local Address / Remote Address local 10.20.30.0/24 remote 10.30.0.0/24 Proxy ID / encryption domain Same idea on Cisco / Check Point Those two prefixes, both directions Azure / AWS traffic selectors What the cloud child SA will accept Match the FortiGate, or use route-based 0/0 on both PFS / Phase-2 proposal Second negotiation after selectors Same enc/auth/PFS group Child SA only covers the agreed pair Selector match versus 0.0.0.0/0 mismatch HQ 10.20.30.0/24 Priya .80 - Phase-2 SA selectors must match Branch 10.30.0.0/24 not 0.0.0.0/0 Mismatch /24 vs /0 If only one side says 0.0.0.0/0, many peers refuse the child SA. https://fgt-hq.techclick-lab.in Training mock · not live FortiOS Dashboard Network VPN Policy VPN → IPsec Tunnels → vpn-branch ### Phase 2 Selectors Name vpn-branch-p2 Local Address 10.20.30.0/24 Remote Address 10.30.0.0/24 PFS Same group as peer, or both off Auto-negotiate Enable (so SA comes up without waiting for traffic) Cancel Save FortiOS 7.4 Phase 2 Selectors. Training mock. ## How to choose Two FortiGates in this lab: exact subnets both ways . Azure/AWS policy-based or “use policy-based traffic selectors”: read the cloud selector list and mirror it. Azure route-based VNet GW often wants 0.0.0.0/0 ↔ 0.0.0.0/0 on the FortiGate Phase-2; a leftover /24 on only one side is the ticket. Prefer route-based so you are not maintaining a selector matrix. ## Runbook #### Side A - IKE first diagnose vpn ike gateway list must already show established. If not, go back to lesson 2. - #### Side B - print both selectors HQ: local 10.20.30.0/24 remote 10.30.0.0/24. Peer: the reverse, or an agreed 0/0 pair. PFS and Phase-2 proposal aligned. - #### Side C - prove the child SA diagnose vpn tunnel list name vpn-branch shows selectors that contain 10.20.30.80 → 10.30.0.10. Then sourced ping. If SA is up and ping dies, that is route/policy (next lesson), not proxy ID. fgt-hq · Phase-2 proof diagnose vpn ike gateway list # IKE SA: established diagnose vpn tunnel list name vpn-branch # dest: 198.51.100.10 status: up # selectors: 10.20.30.0/24 - 10.30.0.0/24 # num of child sa: 0 ← Phase-2 still this ticket execute ping-options source 10.20.30.1 execute ping 10.30.0.10 ## Four failures ### 1 · 0.0.0.0/0 vs 10.20.30.0/24 Classic vs Azure policy-based and vs a peer that auto-offers /0. Mirror the peer or move both sides to route-based /0. ### 2 · Extra Phase-2 that never matches the ping You have an SA for 10.20.30.0/24 ↔ 10.40.0.0/16 (Azure) but Priya is pinging the branch. Wrong child. ### 3 · PFS / Phase-2 proposal mismatch Selectors look identical. Child SA still dies. Align PFS group or disable PFS on both. ### 4 · Auto-negotiate off, no interesting traffic SA waits for a packet that SNAT or routing never sends. Enable auto-negotiate or ping with the LAN source. ## How to prove it Close Phase-2 only when 1) IKE still up. 2) tunnel list shows a child SA whose selectors contain the test flow. 3) You can explain /0 vs /24 if either side uses it. 4) You did not reset the PSK to fix selectors. ## Traps GUI said You still print Wrong fix VPN up Which SA: IKE or IPsec, and which selectors New PSK Phase-2 down Both peers’ local/remote prefixes + PFS Disable the firewall policy SA up, ping dead Route + policy + SNAT (lesson 4) Another Phase-2 ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 Phase-1 up, no IPsec child SA. First check? Phase-2 selectors / proxy IDs / PFS SSL-VPN port FAZ disk FGCP heartbeat Correct: a . This ticket. Q2 0.0.0.0/0 on one peer and 10.20.30.0/24 on the other often… Always works Fails Phase-2 negotiation Disables IKE Turns the tunnel into ZTNA Correct: b . Classic mismatch. Q3 FortiOS name for proxy IDs? Phase 2 Selectors (Local / Remote Address) ssl.root GatewaySubnet Customer Gateway Correct: a . FortiOS 7.4 field names. Q4 diagnose vpn tunnel list is the proof for… IKE identity only The IPsec child SA and its selectors SSL-VPN assigned IPs Azure SKU Correct: b . Runbook. Q5 Azure policy-based vs a FortiGate /24 selector. Risk? None Cloud offers 0.0.0.0/0 and Phase-2 never builds PSK is ignored UDP 500 is rewritten to 443 Correct: b . Lesson + Azure traffic selectors. Q6 Child SA up, ping still dies. Next lesson is… Route / policy / SNAT, not another PSK IKEv1 only ZTNA tags New WAN IP Correct: a . Trap table. Check answers Reset VPN scenario class series: S2S vs RA vs ZTNA · Phase-1 down · Phase-2 / proxy ID · Route vs policy · SSL split tunnel · FGT → Azure · FGT → AWS · VPN interview ## Sources - FortiOS 7.4 Administration Guide - IPsec VPN (Phase-2 selectors) . - RFC 7296 - IKEv2 CREATE_CHILD_SA . - Azure VPN Gateway settings - policy-based vs route-based / traffic selectors . Related: FortiGate IPsec · Azure hub-spoke · AWS TGW . --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt