Domain 5 — VPN 17 cards
IKEv1 main mode — how many messages, and what is protected?
Six messages, and the peer identity is protected.
IKEv1 aggressive mode — how many messages, and what is the trade-off?
Three messages, but the identity is sent in the clear. Needed for dynamic-IP peers that identify by peer ID.
What does IKEv2 give you over IKEv1?
Fewer exchanges, built-in NAT traversal, and EAP support.
Which phase 1 settings must match on both peers?
Encryption and hash proposals, DH group, authentication method (PSK or certificate), and — for IKEv1 — the mode.
Does the phase 1 lifetime have to match on both ends?
No. The LOWER of the two values is used.
Which port does NAT-T use, and where is NAT detected?
NAT-T encapsulates ESP in UDP 4500. NAT is detected during IKE negotiation on UDP 500.
Phase 1 is up but phase 2 will not establish. What is the number one cause?
A quick mode selector mismatch — the local and remote subnets must mirror each other on the two ends.
What two things does a route-based IPsec tunnel need before traffic will pass?
1. A static route for the remote subnet via the tunnel interface · 2. Firewall policies in BOTH directions
What does dead peer detection actually accomplish in a redundant VPN?
It detects the failure so the tunnel goes down and its routes are withdrawn, letting the backup route take over.
How is redundancy between two IPsec tunnels expressed?
In ROUTING — same destination via both tunnels, using distance for active/backup, or equal distance plus priority for preference, or equal both for ECMP.
How many tunnels does a full mesh of n sites need, and what is the scalable alternative?
n(n−1)/2 tunnels. · · ADVPN is the alternative — shortcut tunnels built on demand.
How is a dial-up IPsec hub configured?
One phase 1 with type dynamic, addresses handed out by mode-config, and set add-route enable to inject client routes. Peer ID or XAuth identifies clients.
IKE error: NO_PROPOSAL_CHOSEN. What does it mean?
A proposal mismatch — in phase 1 or phase 2.
IKE error: INVALID_ID_INFORMATION. What does it mean?
A selector or peer-ID mismatch.
The tunnel is up but counters only increment in one direction. Crypto problem or not?
Not crypto. It is a firewall policy or routing problem.
Which command shows phase 1 state, and which shows phase 2 SAs?
Phase 1: diagnose vpn ike gateway list · · Phase 2: diagnose vpn tunnel list
What changed for SSL VPN in FortiOS 7.6?
Tunnel and web mode were removed from lower-memory entry-level models, in favour of IPsec dial-up and ZTNA.