Refer to the exhibit. A FortiGate administrator has configured an IPsec VPN tunnel to a branch office. The tunnel fails to establish. What is the most likely cause?
Exhibit
Refer to the exhibit.
config vpn ipsec phase1-interface
edit "Branch_Tunnel"
set interface "wan1"
set peertype any
set net-device disable
set proposal aes256-sha256
set dhgrp 14
set remote-gw 203.0.113.10
set psksecret ENC XXXX
next
end
config vpn ipsec phase2-interface
edit "Branch_Tunnel_p2"
set phase1name "Branch_Tunnel"
set proposal aes256-sha1
set src-addr-type name
set dst-addr-type name
set src-name "local_net"
set dst-name "remote_net"
next
endTrap 1: Phase 2 proposal (aes256-sha1) is not compatible with Phase 1…
This is incorrect. FortiGate does not require authentication algorithms to match between Phase 1 and Phase 2. The tunnel can establish with different algorithms for each phase.
Trap 2: The pre-shared key is encrypted in the configuration
This is incorrect. The pre-shared key is stored encrypted in the configuration, but FortiGate decrypts it when needed; encryption does not prevent tunnel establishment.
Trap 3: The 'net-device disable' setting prevents tunnel creation
This is incorrect. 'set net-device disable' is not a standard IPsec setting; it does not prevent tunnel creation in typical site-to-site VPNs.
- A
Phase 2 proposal (aes256-sha1) is not compatible with Phase 1 proposal (aes256-sha256)
Why wrong: This is incorrect. FortiGate does not require authentication algorithms to match between Phase 1 and Phase 2. The tunnel can establish with different algorithms for each phase.
- B
The pre-shared key is encrypted in the configuration
Why wrong: This is incorrect. The pre-shared key is stored encrypted in the configuration, but FortiGate decrypts it when needed; encryption does not prevent tunnel establishment.
- C
The 'net-device disable' setting prevents tunnel creation
Why wrong: This is incorrect. 'set net-device disable' is not a standard IPsec setting; it does not prevent tunnel creation in typical site-to-site VPNs.
- D
The phase2 interface name does not match the phase1 name
This is correct. The phase2 interface name must match the phase1 interface name configured in the VPN. A mismatch prevents the IPsec SA from being established.