A utility is standardizing its substation IPsec design and wants new engineers to understand why route-based tunnels are generally preferred over policy-based tunnels for sites likely to need dynamic routing, redundancy, or per-application firewall control later. What is the core structural difference that explains this preference?
Select an answer to reveal the explanation.
Short Explanation
The whole difference comes down to whether the tunnel gets its own interface. A route-based tunnel hands you a virtual interface you can route through, monitor, and attach a routing protocol to — a policy-based tunnel just ties encryption to a policy, with nothing else to hang future features on.
Full Explanation
Route-based IPsec creates a virtual tunnel interface (VTI) that the FortiGate treats like any other interface: it can be placed in a zone, referenced by static routes, joined to a dynamic routing protocol, and have its own set of firewall policies for granular per-application control across the tunnel. Policy-based IPsec has no such interface — the phase 1 and phase 2 definitions are referenced directly inside a firewall policy, which is simpler for a single, static, never-changing tunnel but offers nothing for a routing protocol or a redundancy scheme to attach to, which is exactly why sites expecting to need those capabilities later are steered toward route-based design from the start. The claim about differing default encryption strength is false — the cipher suite in both route-based and policy-based tunnels is whatever the administrator configures in the phase 1 and phase 2 proposals; neither mode has an inherently stronger default. Certificate versus pre-shared key authentication is an independent choice available to both route-based and policy-based tunnels; neither mode restricts which authentication method can be used, so tying authentication method exclusively to one mode is incorrect. Dialup versus static-IP peer identification is also an orthogonal configuration choice under phase 1 and applies regardless of whether the tunnel is ultimately built as route-based or policy-based, so neither mode is restricted to one peer-identification style. To see this distinction directly on a FortiGate, compare 'config system interface' (which lists a tunnel entry only for route-based configurations) against a policy-based tunnel's phase 1 definition, which never appears as an interface at all.