VPN: IPsec Site-to-Site ו־SSL VPN

Connecting two offices and remote employee access, including the IPsec negotiation phases.

IPsec site-to-site permanently links two networks. Negotiation happens in two phases: Phase 1 builds an encrypted management channel and authenticates the peers, Phase 2 defines which traffic actually enters the tunnel.

Phase 1 — IKE: peer identity (pre-shared key or certificate), encryption, DH group and lifetime.
Phase 2 — IPsec SA: the selectors (local vs remote network) and PFS.
SSL VPN — remote user access via browser (web mode) or (tunnel mode).

Two FortiGates talk over UDP 500 and 4500. Phase 1 (IKE) settles who is who: main or aggressive mode, PSK or certificate, DH group, encryption and lifetime. Phase 2 settles what gets encrypted: local and remote selectors, PFS, lifetime and ESP. Even with the tunnel up you still need firewall policies in both directions and a static route to the remote subnet. Phase 1 up with phase 2 down almost always means mismatched selectors, PFS or lifetime.

Short and clear

Phase 1 agrees on identity and the secure channel (IKE): mode, authentication, DH group, lifetime.
Phase 2 agrees on what gets encrypted: network selectors, PFS and ESP.
A tunnel that is up is not connectivity — you still need policies both ways and a route to the remote subnet.
Most failures are simply mismatched settings between the two peers.

Real-life examplePhase 1 is up but no traffic flows: one side uses selector 10.10.0.0/16, the other 10.10.10.0/24. Align the selectors, then run diagnose vpn tunnel list and watch the counters increase.

diagnose vpn ike gateway list        # статус Phase 1
diagnose vpn tunnel list             # статус Phase 2 и счётчики пакетов
diagnose debug application ike -1    # подробный лог согласования
diagnose debug enable

text

VPN: IPsec site-to-site and SSL VPN

What you will learn here

IPsec in Two Phases: Phase 1 Identifies, Phase 2 Encrypts

Short and clear

Check yourself