ronutz

FortiGate IPsec phase mismatch analyzer

Describe both IPsec peers and get the disagreement named, and which phase would fail. Phase 1 and phase 2 fail for different reasons and lead to different diagnostics.

Documentation (Markdown)

Security & WAF
Documentation

Runs entirely in your browser. Nothing is uploaded.

How an IPsec negotiation fails

  • Phase 1 authenticates the peers and protects the negotiation; phase 2 negotiates the security associations and the selectors.
  • Phase 1 failures are identity or proposal. Phase 2 failures are selectors, transforms or PFS.
  • Proposals INTERSECT: the lists do not have to be identical, they only need one value in common.
  • Lifetimes do NOT need to match. The shorter value wins.
  • Selectors are mirrored: one peer's local subnet is the other's remote, and they must match exactly.
  • Describe both peers, one block each:
  • peer: name=SiteA
  • phase1: version=ikev2, encryption=aes256, hash=sha256, dhgroup=14, auth=psk, lifetime=86400
  • phase2: encryption=aes256, hash=sha256, pfs=enable, dhgroup=14, src=10.1.0.0/16, dst=10.2.0.0/16
API endpointGEThttps://ronutz.com/api/v1/fortigate-ipsec-phase-mismatch-analyzerDocumented, not served. Opens the specification.

References