Troubleshooting Route-Based IPsec VPN: Why Firewall Policies Are Required
An administrator configures a route-based IPsec VPN between two FortiGates. The Phase 1 and Phase 2 are up. The administrator adds a static route on each FortiGate pointing to the remote subnet via the virtual tunnel interface (e.g., 'to_remote'). Traffic between the subnets fails. What is the MOST likely missing configuration?
Quick Answer
The answer is a missing firewall policy to permit traffic between the local and remote subnets via the virtual tunnel interface. In a route-based IPsec VPN, Phase 1 and Phase 2 establish the encrypted tunnel, and the static route directs traffic into the tunnel interface, but the FortiGate still enforces security policies at the interface level. Without an explicit firewall policy allowing traffic from the source interface (e.g., internal) to the tunnel interface (e.g., 'to_remote'), the FortiGate drops the packets, even though the VPN is technically up. On the Fortinet NSE 4 Network Security Professional exam, this is a classic trap: candidates often assume a route-based VPN only needs routes and IPsec settings, forgetting that firewall policies govern all inter-interface traffic. The exam tests your understanding that route-based VPNs separate routing from security, unlike policy-based VPNs where the policy itself defines the traffic selector. Memory tip: "Tunnel up, route set, but no policy? Packets get wrecked."
⚠ Common exam trap
Watch out — candidates often assume a static route and an established IPsec tunnel are sufficient for traffic flow, overlooking the mandatory firewall policy that FortiGate requires to permit inter-subnet traffic in a route-based VPN.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A firewall policy is required to permit traffic between the interfaces
In a route-based IPsec VPN, even when Phase 1 and Phase 2 are up and a static route exists via the virtual tunnel interface, traffic will still be dropped unless a firewall policy explicitly permits it. FortiGate uses a stateful firewall, so a policy must allow traffic from the local interface to the tunnel interface (or vice versa) to forward packets. Without this policy, the FortiGate will not forward traffic between the subnets, even though the tunnel is established.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
NAT must be disabled on the tunnel interface
Why it's wrong here
NAT is not relevant unless specifically required.
- ✗
The tunnel interface must be added to a zone
Why it's wrong here
Adding to a zone is optional.
- ✗
The Phase 2 proposal must include the correct local and remote subnets
Why it's wrong here
In route-based VPN, Phase 2 selectors are typically 0.0.0.0/0.0.0.0; specific subnets are handled by routing.
- ✓
A firewall policy is required to permit traffic between the interfaces
Why this is correct
Route-based VPNs require explicit firewall policies to allow traffic through the tunnel.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate administrator is configuring a route-based IPsec VPN between two FortiGate devices. After setting up the tunnel and firewall policies, traffic does not flow. The administrator runs 'diagnose vpn tunnel list' and sees the tunnel is up. 'get router info routing-table all' shows routes on both sides. However, pings from the local network to the remote network fail. What is the MOST likely cause?
hard- A.The pre-shared key is incorrect
- ✓ B.The firewall policy allowing traffic to the remote subnet has the source and destination interfaces reversed
- C.The remote FortiGate's static route points to the wrong local subnet
- D.The Phase 2 proposal uses different encryption algorithms on each side
Why B: The tunnel is up and routes are present, indicating Phase 1 and Phase 2 negotiations succeeded. The most likely cause is that the firewall policy allowing traffic to the remote subnet has the source and destination interfaces reversed. In a route-based VPN, the policy must have the incoming interface as the source (e.g., internal) and the outgoing interface as the destination (e.g., the VPN tunnel interface). Reversing these prevents traffic from being matched, even though the tunnel is established.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.