Troubleshooting Scenario Questions

The firewall policy's NAT setting is set to 'disable'

Why wrong: The admin stated NAT is enabled.

The IP pool is configured for one-to-one NAT

Why wrong: One-to-one NAT does not prevent the pool from being used; it's a different type.

The internal host is using a non-standard source port

Why wrong: Source port does not affect IP pool matching.

The FortiGate's physical port is not set to the same VLAN ID

Why wrong: The physical port is not assigned a VLAN ID; the VLAN interface is.

The FortiGate's administrative access is not enabled on the VLAN interface

Why wrong: Administrative access (ping) may be needed, but the primary issue is tagging.

The FortiGate's VLAN interface is not assigned to any VDOM

Why wrong: VDOM assignment is necessary but usually defaults to root; tagging is the immediate issue.

The Phase 2 proposal uses AES256 but the remote client only supports AES128

Why wrong: If the Phase 2 proposal were mismatched, the IPsec SA negotiation would fail and the tunnel would not come up at all. Since the tunnel is established and the problem is that user traffic is not passing, the proposals must have been successfully negotiated with matching cipher and integrity algorithms. Therefore, a mismatch in AES key lengths cannot be the cause of post-negotiation traffic loss.

The FortiGate's routing table does not have a route to the remote user's subnet

Why wrong: In a dial-up VPN scenario, the remote user's IP address is dynamically assigned, so the FortiGate typically relies on a static route pointing toward the dial-up tunnel interface or a per-user host route learned from IKE. If the FortiGate lacked such a route, return packets from the destination network could not be sent back, but the symptom of no sessions suggests the initial forward packets are being dropped before any session creation. Missing routes usually manifest as asymmetric routing or ICMP unreachable messages, not a clean absence of sessions when a policy drop is the culprit.

The remote user's FortiClient is blocking split tunneling

Why wrong: Split tunneling controls which destination networks the FortiClient routes directly vs. through the IPsec tunnel; blocking it would force all client traffic into the tunnel, not prevent it from doing so. If split tunneling were disabled, we would expect to see more sessions and traffic hitting the FortiGate's tunnel interface, yet the session table shows no traffic at all. The absence of any sessions indicates the packets are not reaching the FortiGate or are being explicitly dropped by policy rather than being influenced by client-side routing decisions.

Enable split tunneling on the SSL VPN portal

Why wrong: Split tunneling controls which traffic goes through the VPN, but web mode still only supports web applications.

Add the server IP addresses to the portal's bookmarks

Why wrong: Bookmarks only provide links for web-based access, not RDP.

Configure a firewall policy allowing the client's IP to the servers

Why wrong: The policy may already exist, but web mode cannot carry non-web traffic.

execute ping 203.0.113.50

Why wrong: Ping tests connectivity, not policy matching.

diagnose debug flow

Why wrong: `diagnose debug flow` is an active debugging command that generates verbose output for every packet matching its filter, making it inefficient for simply identifying the policy number. It is designed to trace the exact path of a specific packet through the FortiGate in real-time, showing precisely where it is denied or allowed, including the policy ID. This command is invaluable for deep-diving into live traffic issues, analysing the full processing flow to understand *why* a decision was made, rather than just quickly identifying a matching policy.

get firewall policy

Why wrong: This command shows the configuration, not real-time matching.

get system performance status

Why wrong: This shows system performance, not policy matching.

config system ha

Why wrong: This is for HA configuration, not troubleshooting.

execute ping options

Why wrong: Ping tests connectivity, not policy matching.

NAT is disabled, so the server cannot send replies back.

Why wrong: NAT is not required for traffic between internal VLANs because the FortiGate simply routes packets based on the destination IP, and the server's reply goes directly back to the source IP using the existing routing table. Disabling NAT would affect source address translation for egress to external networks, not internal reachability, so this is not the reason HTTPS is blocked.

The policy order is incorrect; a deny policy above is blocking traffic.

Why wrong: The administrator already verified there are no overlapping or conflicting policies, so a deny policy above would be a separate explicit rule. If a deny policy above were blocking traffic, it would deny all traffic from VLAN10 to VLAN20, not selectively HTTPS; since only HTTPS fails, a policy-order issue is not the cause.

The schedule is configured incorrectly and the policy is inactive during the current time.

Why wrong: The schedule is set to Always, meaning the policy is active 24/7; a schedule-based denial would make the policy inactive at specific times, causing all traffic to fail, not just HTTPS. Since the policy is active and the issue is protocol-specific, the schedule configuration is not the cause.

The firewall policy from internal to DMZ is blocking traffic

Why wrong: The firewall policy between internal and DMZ is explicitly configured to permit traffic, as verified in the policy table. Even if it were blocking, that would affect direct internal-to-DMZ communication, but the problem is about internal users reaching an internal server via the public IP. Since the policy allows traffic, and the destination of the forwarded traffic is a DMZ server, the policy is not the bottleneck. In fact, the traffic path from internal to public IP would first hit the FortiGate's VIP, then be redirected to the DMZ server, which is allowed by the internal-to-DMZ policy.

Hairpin NAT is not enabled on the FortiGate

Why wrong: Hairpin NAT (also known as NAT loopback) is a feature that allows internal clients to access a public IP address that is mapped to an internal server through the FortiGate's external interface. However, in this scenario, the destination server is the DMZ server (10.0.0.10) because the port forwarding rule is defined for that server. Enabling hairpin NAT would only allow the internal users to reach the DMZ server via the public IP; it would not change the destination IP to the internal server. Therefore, the root cause is the misconfiguration of the destination in the VIP/port forwarding rule, not the absence of hairpin NAT.

The IP Pool for outbound NAT is misconfigured

Why wrong: The IP pool is used for source NAT when internal users initiate outbound connections to the Internet. Since internal users are able to browse the Internet successfully, the IP pool is functioning as intended and is not misconfigured. This proves that the outbound NAT path is not the cause of the problem. The issue lies in the inbound port forwarding rule, which uses a VIP rather than an IP pool; a misconfigured IP pool would not affect the forwarding of incoming traffic to an internal server.

The default route on the FortiGate is missing

Why wrong: For the FortiGate to successfully ping 8.8.8.8, it must have a valid route to that destination—usually a default route pointing to its next-hop gateway. If the default route were missing, the FortiGate would return 'Destination host unreachable' because no route exists for the packet. Thus, the administrator's test proves the FortiGate's routing is operational, so this cannot explain why internal hosts fail to connect.

DNS resolution is failing

Why wrong: The administrator's connectivity test to 8.8.8.8 uses a raw IP address, so a DNS failure would have no impact on that test. DNS is only required when resolving hostnames to IPs; if DNS were broken, pinging an IP would still work perfectly. Since the problem is that clients cannot reach external destinations even by IP, the cause is strictly routing or forwarding, not name resolution.

The FortiGate's interface to the internal network is down

Why wrong: If the interface were down, the FortiGate likely wouldn't be able to ping from itself either, but it could still ping if the internal interface is separate? Actually ping from FortiGate uses its own routing, so internal interface down would not affect pinging 8.8.8.8 if default route is via port1. So internal interface could be down and still ping. But then internal hosts wouldn't reach the FortiGate. So this is plausible. However, the most likely is wrong gateway.

The firewall policy allowing IPsec traffic is missing.

Why wrong: A firewall policy that permits IPsec traffic governs which data flows are allowed to traverse an established VPN tunnel, but it does not drive the IKE Phase 2 negotiation itself. In route-based VPNs the tunnel can establish with no policy present, and in policy-based VPNs the policy's local/remote selectors must match the Phase 2 proxy IDs, but a missing policy would show symptoms like dropped traffic or no matching policy, not a failure to create the Phase 2 IPsec SA. Therefore, if Phase 2 is not coming up, the root cause is not the absence of a firewall policy.

The remote gateway IP address is unreachable.

Why wrong: If the remote gateway IP address were unreachable, the FortiGate would be unable to send IKE packets, and Phase 1 would never complete. Because Phase 2 negotiation is only initiated after a successful Phase 1, a reachability failure would abort the process before Phase 2 is ever attempted. Since the administrator observes a Phase 2 failure, the Phase 1 SA exists, which proves the remote gateway is reachable over the network, eliminating this option as the cause.

The pre-shared key is incorrect.

Why wrong: An incorrect pre-shared key is used in IKE Phase 1 to authenticate the peers—not in Phase 2. If the PSK does not match, authentication during Phase 1 Main Mode or Aggressive Mode exchange fails, and no IKE SA is established. Thus the Phase 2 Quick Mode would never be invoked, so a PSK mismatch cannot be the explanation for a Phase 2-specific failure; this issue would prevent Phase 1 entirely.

The IKE version is mismatched (IKEv1 vs IKEv2)

Why wrong: A mismatch between IKEv1 and IKEv2 is detected during Phase 1 (the IKE_SA_INIT exchange in IKEv2, or Main/Aggressive Mode in IKEv1), where peers exchange SA proposals with different payload structures and mandatory attributes. Without an established IKE SA, there is no authenticated and encrypted channel over which Phase 2 (Quick Mode or CREATE_CHILD_SA) can run. Consequently, the failure manifests as a Phase 1 negotiation error, not a Phase 2 proposal mismatch.

The pre-shared key is incorrect

Why wrong: An incorrect pre-shared key causes authentication failure during IKE Phase 1 (or the IKE_AUTH exchange in IKEv2), because each peer derives a keyed hash using the PSK and verifies it against the peer's response. If the keys do not match, the IKE SA is never established. Phase 2 is only initiated after the IKE SA is active, and its parameters, including traffic selectors, are never discussed—so this scenario cannot produce a Phase 2 proposal mismatch.

The firewall policies are blocking IKE traffic on UDP port 500

Why wrong: IKE negotiation relies on UDP port 500 (and UDP 4500 for NAT traversal); if a firewall policy blocks these ports, the IKE SA cannot be formed because the initial SA proposal packets are dropped. Without the IKE SA, Phase 2 cannot even begin, as its messages are encapsulated and encrypted inside the IKE SA. Therefore, the failure would appear as a Phase 1 timeout or no-response error, not a proposal mismatch, which is a logical parameter incompatibility and would occur even when the network path is fully open.

Client certificate authentication is required but not provided

Why wrong: If client certificate authentication is required, the FortiGate would reject the SSL VPN handshake or the user would fail to authenticate before any tunnel is established. Since the user is able to connect (we are troubleshooting traffic flow after successful login), the issue is not at the authentication stage. Therefore this option is wrong; it would manifest as a login failure, not as a connectivity problem after the tunnel is up.

Split tunneling is disabled

Why wrong: Split tunneling controls whether the client sends only specific routes over the tunnel (split) or all traffic (full tunnel). When split tunneling is disabled (i.e., full tunnel is in effect), the client sends all traffic through the SSL VPN tunnel, which actually would allow more traffic to the internal network, not block it. The issue here is at the FortiGate firewall policy level, not on the client side. Thus disabling split tunneling would not prevent access; it would direct more traffic into the tunnel.

The SSL VPN realm is not configured correctly

Why wrong: The realm is used in the SSL VPN portal URL to select a specific authentication method and portal configuration. If the realm were misconfigured, the user would not be able to access the correct login page or would receive an authentication error. The traffic forwarding after a successful connection is independent of realm settings; realms affect the pre-authentication phase and portal presentation, not how the FortiGate routes traffic from ssl.root to internal networks.

The remote gateway's IP address is reachable

Why wrong: The remote gateway's public address has already been proven reachable because Phase 2 is up, which necessarily means Phase 1 completed successfully over the network path between the two peers. Reachability of the remote gateway is a prerequisite for building the IPsec tunnel, not a condition that controls whether the tunnel is used for a given subnet after establishment. Thus, this option is redundant and does not identify the critical prerequisite for sending data through a route-based tunnel.

The pre-shared key is correct

Why wrong: A correct pre-shared key is required for IKE Phase 1 authentication, and if the pre-shared key were invalid, the tunnel would never have come up. Since the administrator has already confirmed that Phase 2 is active, the PSK has already been validated by both peers during the IKE handshake. Consequently, PSK correctness is a necessary but already-met condition that cannot be the missing factor allowing traffic to traverse the route-based VPN.

The Phase 2 proposal includes the correct local and remote subnets

Why wrong: In a route-based IPsec VPN, Phase 2 selectors (proxy IDs) are typically configured as 0.0.0.0/0 to avoid subnet-specific matching, allowing the routing table to dictate which destination networks are sent through the tunnel. Unlike policy-based VPNs, the local and remote subnets are not part of the Phase 2 proposal; they are determined by static routes and firewall policies. Therefore, specifying correct local and remote subnets in Phase 2 is neither required nor relevant once the tunnel is already up.

The IKE version is not compatible

Why wrong: The IKE version is not the culprit here because both FortiGates are explicitly configured to use IKEv2, and IKE version negotiation occurs during Phase 1. If the versions were incompatible, the Phase 1 IKE SA would never be established, preventing any Phase 2 negotiation from starting. The presence of a 'proposal mismatch' error during Phase 2 categorically proves that Phase 1 completed successfully, including all IKE version and SA exchanges. Thus, an IKE version mismatch is not a plausible cause for this specific Phase 2 error.

The Phase 2 selectors (local and remote subnets) are misconfigured

Why wrong: While incorrect local and remote Phase 2 selectors (proxy IDs) can prevent a tunnel from carrying traffic, they do not cause a 'proposal mismatch' error in FortiGate's logs. A selector mismatch typically results in 'no proposal chosen' or a failure to negotiate the IPsec SA because the traffic selectors do not match, or the tunnel may come up but fail to encrypt the expected subnets. The 'proposal mismatch' notification specifically indicates that the cryptographic transform sets (encryption, authentication, PFS) offered by the initiator were rejected by the responder, not that the protected subnets were different.

The pre-shared keys do not match

Why wrong: Pre-shared keys are used for authenticating the peer during Phase 1, not Phase 2. If the pre-shared keys did not match, the IKE Phase 1 authentication would fail, generating a different error such as 'pre-shared key mismatched' or 'authentication failed' and preventing the establishment of the IKE SA. A Phase 2 'proposal mismatch' error can only occur after Phase 1 has been successfully established with a valid PSK, so mismatched keys are definitively not the cause. Additionally, PSK mismatch affects the integrity of the entire IKE SA, whereas 'proposal mismatch' is a negotiation error between cryptographic algorithms, which is phase-specific.

Ensure that the antivirus profile is enabled on the policy

Why wrong: An antivirus profile is responsible for scanning files and message bodies for malware signatures; it does not inspect or categorize URLs. Even if the antivirus profile is disabled on the policy, the web filter will still evaluate the requested URL against the configured Social Networking category and block Facebook when the action is Block. Enabling antivirus has no bearing on the symptom, so it is not one of the three most likely causes for this issue.

Confirm that the 'Social Networking' category is not set to 'Monitor' instead of 'Block'

Why wrong: The administrator has explicitly set the Social Networking category to Block in the profile, so rechecking the dropdown would only confirm an action that is already correct. Even if a group override or a custom category redefined the action, the field value shown would reflect that, and merely verifying it does not address the root cause when the symptom is that Facebook is still accessible. This is a reasonable sanity check, but it is not one of the three most likely causes because the configuration already matches the intended blocking action.