A NOC engineer is troubleshooting a new site-to-site IPsec tunnel to a substation that never comes up at all. Checking the logs, phase 1 never completes and no security association is ever established. Which category of misconfiguration is the most likely cause?
Select an answer to reveal the explanation.
Short Explanation
If phase 1 never even completes, the two FortiGates aren't managing to agree on the basics of how to talk securely at all — that points straight at phase 1 itself: a wrong pre-shared key, or proposals that don't match. Phase 2 problems, routing problems, and policy problems all assume phase 1 already succeeded.
Full Explanation
When phase 1 fails to complete and no IKE security association is ever formed, the fault almost always lies within the phase 1 parameters themselves: a pre-shared key that doesn't match character-for-character between the two peers, or an encryption algorithm, authentication/hash algorithm, or Diffie-Hellman group proposal that isn't offered identically on both sides, will prevent the peers from ever agreeing on how to build the secure channel. A phase 2 selector mismatch is a later-stage problem — it can only occur once phase 1 has already succeeded and the peers move on to negotiating the data-plane SA, so it cannot explain a phase 1 failure. A firewall policy denying traffic to the substation subnet would affect data traffic attempting to cross an already-established tunnel, not the underlying IKE negotiation, which typically uses UDP 500/4500 between the two public-facing interfaces and is governed by its own local-in policy rather than the internal firewall policy that controls tunneled traffic. An incorrect static route pointing at the wrong next hop is also a post-tunnel problem — routing decides where traffic goes once a tunnel interface exists and is up, which presupposes phase 1 and phase 2 already completed successfully. The practical first check for a phase 1 failure is 'diagnose debug application ike -1' combined with 'diagnose debug enable', which shows exactly which proposal or key comparison failed during negotiation.