IPsec VPN Tunnel Established but No Traffic: Routing Misconfiguration
A FortiGate administrator notices that the IPsec VPN tunnel is established but traffic is not passing. The firewall policy allowing traffic from the remote subnet to the local subnet is in place. What is the MOST likely cause?
Quick Answer
The answer is a missing static route on the FortiGate for the remote subnet pointing to the tunnel interface. Even when an IPsec VPN tunnel is established and a firewall policy is in place, traffic cannot flow without a proper route telling the FortiGate which interface to use to reach the remote network. Routing misconfiguration is the most common cause of the "IPsec VPN tunnel established but no traffic" issue, as the tunnel interface itself is not automatically added to the routing table for remote subnets. On the Fortinet NSE 4 exam, this scenario tests your understanding of the three pillars of VPN traffic flow: phase 1, phase 2, and routing—with routing being the frequently overlooked trap. A common memory tip is "Tunnel up, policy in place, but no route? No ride." Always verify that a static route exists for the remote subnet with the tunnel interface as the destination device.
⚠ Common exam trap
Candidates often assume a firewall policy alone is sufficient for VPN traffic, forgetting that route-based VPNs require a separate static route to direct traffic into the tunnel interface, which is a common oversight in NSE4 exams.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
There is no static route on the FortiGate for the remote subnet pointing to the tunnel interface
When an IPsec VPN tunnel is established but traffic fails to pass, the most common cause is the lack of a static route on the FortiGate for the remote subnet pointing to the tunnel interface. Even with a correct firewall policy, the FortiGate cannot forward traffic to the remote subnet without a route that directs packets into the VPN tunnel interface (e.g., 'tunnel.1'). This is a fundamental routing requirement for route-based VPNs, which are the default configuration on FortiGate.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The VPN tunnel is a policy-based VPN and the policy is incorrectly configured
Why it's wrong here
Policy-based VPNs require policy match; but if the tunnel is up and policy exists, routing is more likely.
- ✗
The Phase 2 proposal includes PFS, but the remote side does not
Why it's wrong here
PFS mismatch would prevent Phase 2 from coming up.
- ✗
The local firewall is blocking ICMP
Why it's wrong here
ICMP blocking would affect ping, but not necessarily all traffic.
- ✓
There is no static route on the FortiGate for the remote subnet pointing to the tunnel interface
Why this is correct
Without a route, the FortiGate does not know how to forward traffic to the remote subnet even if the tunnel is up.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator is troubleshooting an IPsec VPN that is not passing traffic. The Phase 1 and Phase 2 are both up. Which TWO CLI commands can be used to verify the VPN tunnel status and traffic flow? (Choose two.)
medium- ✓ A.diagnose vpn tunnel list
- B.execute ping-options source
- C.diagnose vpn ike config
- D.diagnose netlink interface list
- ✓ E.diagnose sys session list
Why A: 'diagnose vpn tunnel list' displays the status of all IPsec VPN tunnels, including Phase 1 and Phase 2 security associations (SAs), their uptime, and the number of packets transmitted and received. This allows the administrator to verify that the tunnel is established and to check for any packet drops or errors that might indicate a traffic flow issue.
Variation 2. You are configuring a route-based IPsec VPN with BGP over the tunnel. After Phase 2 is up, the BGP session does not establish. You run 'diagnose debug ipsec' and see no errors. What should you check next?
medium- A.Disable anti-replay on the tunnel
- B.Enable NAT traversal
- ✓ C.Ensure the tunnel interface is added to the BGP neighbor configuration
- D.Check the Phase 1 proposal
Why C: When Phase 2 is up and 'diagnose debug ipsec' shows no errors, the IPsec tunnel is functioning correctly at the encryption layer. The BGP session failing to establish typically indicates a routing or interface configuration issue. Option C is correct because the tunnel interface must be explicitly added to the BGP neighbor configuration (e.g., 'config router bgp -> config neighbor -> set interface <tunnel>') so that BGP knows to send its TCP packets (port 179) over that specific tunnel interface; without this, BGP may try to use the physical interface instead, causing the session to fail.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.