Domain 5 VPN
trapmemorisedefault valuenew in 7.6
§5.1 IPsec fundamentals
Phase 1 — the IKE security association
Must match on both ends: encryption and hash proposals, DH group, authentication method (pre-shared key or certificate), and for IKEv1 the mode.
Lifetime does NOT need to match — the lower of the two values is used. This is asked directly.
NAT-T wraps ESP inside UDP 4500 when a NAT device is detected. Detection happens during IKE on UDP 500.
Phase 2 — the IPsec security association
Quick mode selectors must mirror on the two ends. A selector mismatch is the number one cause of "phase 1 is up but phase 2 is down." You have fixed this exact thing at work — it's on the exam too.
Also in phase 2: PFS with its own DH group, replay detection, keylife in seconds or KB, and auto-negotiate / keepalive to bring the tunnel up without interesting traffic.
Route-based (interface mode)
Assume this is the only style. It creates a virtual tunnel interface and needs both of:
A static route for the remote subnet via the tunnel interface
Firewall policies in both directions between the tunnel interface and the LAN
Policy-based VPN is legacy and largely gone from the GUI.
§5.2 Redundant & meshed IPsec
Build two phase 1s, one per WAN path, each with its own tunnel interface.
Redundancy is expressed in routing: same destination via both tunnels, using distance (active / backup) or equal distance plus priority (preference) or equal both (ECMP).
Add a blackhole route at a higher distance so traffic doesn't leak out the default route when both tunnels drop.
DPD is what actually detects failure and withdraws the routes.
Full mesh = n(n−1)/2 tunnels. ADVPN is the scalable alternative — on-demand shortcut tunnels. Know it exists.
§5.3 Dial-up, SSL VPN & troubleshooting
Dial-up IPsec: one phase 1 on the hub with type dynamic. Clients get addresses from mode-config; set add-route enable injects the client route on the hub. Peer ID or XAuth identifies the client.
SSL VPN (lighter): web / portal mode vs tunnel mode · portal assignment via authentication rules · the ssl.root interface still needs firewall policies · IP pool assignment · split tunnelling set in the portal.
Reading the errors: