During phase 2 of an IPsec negotiation between the utility's NOC FortiGate and a substation peer, the administrators must agree on which specific traffic will be encrypted and how the data-plane security association is protected. What does phase 2 primarily negotiate?
Select an answer to reveal the explanation.
Short Explanation
Once phase 1 sets up the trusted channel, phase 2 is where the real work happens: the two FortiGates agree on the encryption for actual data packets and define exactly which subnets — say, the NOC's operations segment and the substation's control LAN — are allowed to travel through the tunnel. It's the difference between agreeing to talk securely and agreeing on what you're actually going to say.
Full Explanation
IKE phase 2 (quick mode) negotiates the IPsec security association that protects the actual data traffic: an encryption and authentication proposal for the data plane, and the traffic selectors (often called proxy IDs) that specify which source and destination subnets are permitted to traverse the tunnel — for example, the NOC's operations subnet talking to the substation's device network. This is distinct from phase 1, which only protects the negotiation itself. Authentication via pre-shared key or certificate happens in phase 1, not phase 2, so that option misidentifies which phase handles peer trust. The DH group and hash used purely for the IKE handshake are also phase 1 constructs, though phase 2 can optionally use Perfect Forward Secrecy with its own DH exchange — that refinement doesn't change which phase defines traffic selectors. GUI administrative access across a tunnel interface is governed entirely by firewall policy and the interface's allowaccess settings, not by anything IKE phase 2 negotiates — the two peers never discuss administrative access as part of building the IPsec SA. To verify phase 2 came up correctly, run 'diagnose vpn tunnel list' and confirm the selectors shown match the subnets the utility intended to connect.