Route-Based vs Policy-Based IPsec VPN on FortiGate
What is the primary difference between route-based and policy-based IPsec VPNs on a FortiGate?
Quick Answer
The answer is that route-based IPsec VPNs use a tunnel interface, while policy-based VPNs rely on firewall policies to define traffic selectors. This distinction is fundamental because a route-based VPN creates a virtual Layer 3 interface (like a "tunnel" interface) that you can reference in static routes and firewall policies, treating the VPN as a logical network segment. In contrast, a policy-based VPN embeds the traffic selectors—source, destination, and service—directly within the Phase 2 configuration, bypassing the need for a separate interface. On the Fortinet NSE 4 Network Security Professional NSE4 exam, this concept tests your understanding of how traffic is steered: route-based VPNs follow the routing table, whereas policy-based VPNs are triggered by matching firewall policies. A common trap is assuming both methods use the same routing logic; remember that policy-based VPNs do not appear in the routing table. For a quick memory tip, think "Route-based = Interface in the route table; Policy-based = Selectors in the Phase 2 config."
⚠ Common exam trap
Watch out — candidates often confuse 'route-based' with 'dynamic routing' and 'policy-based' with 'static routing', but in reality, route-based VPNs can use either static or dynamic routing, while policy-based VPNs are inherently static and cannot participate in dynamic routing protocols.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Route-based uses a tunnel interface, policy-based uses firewall policies to define traffic selectors.
The primary difference is that route-based IPsec VPNs use a tunnel interface (e.g., 'phase1-interface' and 'phase2-interface') which participates in routing, while policy-based IPsec VPNs rely on firewall policies with explicit traffic selectors (source/destination addresses and services) to trigger encryption. In route-based VPNs, the tunnel interface is assigned an IP address and routes are used to direct traffic into the tunnel, decoupling encryption from policy matching. In policy-based VPNs, the firewall policy itself defines what traffic is encrypted, making the traffic selector part of the policy configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Route-based requires a static route, policy-based uses dynamic routing.
Why it's wrong here
Both can use static or dynamic routing; route-based uses routes via the tunnel interface.
- ✗
Route-based encrypts all traffic, policy-based encrypts only specified services.
Why it's wrong here
Both encrypt based on policies; route-based uses firewall policies for encryption.
- ✗
Route-based supports only IKEv2, policy-based supports both IKEv1 and IKEv2.
Why it's wrong here
Both types support IKEv1 and IKEv2.
- ✓
Route-based uses a tunnel interface, policy-based uses firewall policies to define traffic selectors.
Why this is correct
Correct: route-based has a tunnel interface; policy-based defines selectors in Phase 2.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which of the following is a characteristic of route-based IPsec VPN compared to policy-based IPsec VPN?
easy- A.Route-based VPN is only supported in IKEv1
- B.Route-based VPN requires Phase 2 selectors to match both local and remote subnets
- ✓ C.Route-based VPN can use dynamic routing protocols like OSPF
- D.Route-based VPN uses firewall policies with IPsec action
Why C: Route-based IPsec VPNs create a virtual tunnel interface (e.g., ipsec0 or tunnel) that acts as a logical routing point, allowing dynamic routing protocols such as OSPF to exchange routes over the encrypted tunnel. This is a key advantage over policy-based VPNs, which rely on static security policies and cannot support dynamic routing.
Variation 2. When configuring a route-based IPsec VPN, which of the following must be created to allow traffic to flow through the tunnel?
easy- ✓ A.A static route to the remote subnet via the IPsec interface
- B.A firewall policy with the VPN interface as source
- C.A NAT rule to translate the private IPs
- D.A security profile for VPN traffic
Why A: In a route-based IPsec VPN, the tunnel is represented as a virtual IPsec interface. To route traffic from the local network to the remote subnet through this tunnel, a static route must be configured with the remote subnet as the destination and the IPsec interface as the next-hop or outgoing interface. Without this route, the FortiGate has no forwarding information to send traffic into the tunnel, even if the IPsec phase 1 and phase 2 settings are correctly established.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.