IPsec VPN Phase 2 Selector Mismatch: Troubleshooting Guide
An administrator is configuring a site-to-site IPsec VPN between two FortiGates. After applying the configuration, the VPN status shows 'down'. Phase 1 parameters are identical on both sides. What is the most likely cause of the failure?
Quick Answer
The answer is a Phase 2 selector mismatch between the local and remote subnets. When Phase 1 parameters are identical and the VPN status shows 'down', the most likely cause is that the Phase 2 selectors—the specific source and destination subnet definitions—do not match exactly on both FortiGates. Phase 2 uses these selectors to negotiate IPsec security associations; if they are misaligned, the Quick Mode or Child SA exchange fails, leaving the tunnel down even if the IKE Phase 1 SA is up. On the Fortinet NSE 4 exam, this scenario tests your understanding of IPsec VPN troubleshooting, often appearing as a trap where you might overlook subnet mismatches after confirming Phase 1. A common memory tip is to think of Phase 2 selectors as a "mirror"—they must be exact opposites on each side, so always verify that the local subnet on one FortiGate matches the remote subnet on the other, and vice versa.
⚠ Common exam trap
Many candidates assume a Phase 1 mismatch (like pre-shared keys) is the cause when the VPN is down, but the question explicitly states Phase 1 parameters are identical, forcing the focus to Phase 2 selector mismatches, which is a classic NSE4 exam trick.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Phase 2 selectors (local and remote subnets) are mismatched.
When Phase 1 parameters are identical and the VPN is down, the most common cause is a mismatch in Phase 2 selectors (local and remote subnets). Phase 2 uses these selectors to negotiate the IPsec security associations (SAs); if they do not match exactly on both sides, the IKEv1/v2 Quick Mode or Child SA exchange will fail, leaving the tunnel in a 'down' state even though Phase 1 (IKE SA) may be up.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The Phase 2 selectors (local and remote subnets) are mismatched.
Why this is correct
Phase 2 requires matching proxy IDs.
- ✗
The pre-shared keys do not match.
Why it's wrong here
Phase 1 would fail, not Phase 2.
- ✗
The firewall policies are not configured.
Why it's wrong here
Policies are needed for traffic, not for bringing up the tunnel.
- ✗
NAT traversal is disabled but both FortiGates are behind NAT.
Why it's wrong here
NAT-T mismatch would cause Phase 1 issues.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate administrator has configured a route-based IPsec VPN. After Phase 2 is up, traffic is not passing. The administrator verifies that the firewall policy allows traffic and the routes are correct. What should the administrator check next?
medium- ✓ A.The static route uses the VPN interface as the outgoing interface
- B.The remote gateway's IP address is reachable
- C.The pre-shared key is correct
- D.The Phase 2 proposal includes the correct local and remote subnets
Why A: In a route-based IPsec VPN, traffic is routed to the VPN tunnel interface (e.g., 'to_remote'). Even if firewall policies and static routes exist, the static route must explicitly use the VPN interface as the outgoing interface. If the static route points to a different interface or a next-hop IP instead of the tunnel interface, the kernel will not forward traffic into the IPsec tunnel, causing Phase 2 to be up but no traffic to pass. This is a common misconfiguration that breaks the route-based VPN model.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.