How to Fix FortiGate IPsec VPN Phase 1 & Phase 2 Down
diagnose vpn ike log-filter dst-addr4 <peer-ip> and diagnose debug app ike -1 to spot PSK or Diffie-Hellman proposal mismatches. If Phase 1 is up but Phase 2 is down, verify that local and remote Phase 2 subnet selectors mirror the peer exactly (or use 0.0.0.0/0 for BGP/route-based tunnels).
PortalPilot sits inside your browser to translate raw IKE debug strings, Phase 1/2 negotiation drops, and routing issues into plain-English root causes and change requests.
🔍 Step 1: Check Tunnel State in FortiOS CLI
# Check overall tunnel summary
get vpn ipsec tunnel summary
# If Phase 1 is UP (1) but Phase 2 is DOWN (0):
'VPN-SITE-A': 198.51.100.2:4500 selectors(total,up): 1/0 rx(pkt,err): 0/0 tx(pkt,err): 0/0
⚡ Step 2: Run Real-Time IKE Packet Trace
Capture the exact negotiation failure string between the two endpoints:
# Reset any prior debug filters
diagnose debug reset
# Filter to the specific remote firewall IP
diagnose vpn ike log-filter dst-addr4 198.51.100.2
# Enable full verbose IKE output
diagnose debug app ike -1
diagnose debug enable
# Bring up the tunnel manually to trigger negotiation
diagnose vpn ike gateway clear name "VPN-SITE-A"
diagnose vpn tunnel up "VPN-SITE-A"
# When done, always turn off debugging:
diagnose debug disable
diagnose debug reset🛠️ Step 3: Hardened FortiOS CLI Remediation
# Fix Phase 1 proposals (e.g. matching AES256-SHA256 & DH Group 14)
config vpn ipsec phase1-interface
edit "VPN-SITE-A"
set proposal aes256-sha256
set dhgrp 14
set keylife 28800
set dpd-retryinterval 10
next
end
# Fix Phase 2 Selectors (use 0.0.0.0/0 for route-based / BGP tunnels)
config vpn ipsec phase2-interface
edit "VPN-SITE-A_p2"
set phase1name "VPN-SITE-A"
set proposal aes256-sha256
set dhgrp 14
set src-subnet 0.0.0.0 0.0.0.0
set dst-subnet 0.0.0.0 0.0.0.0
set auto-negotiate enable
next
end❓ Frequently Asked Questions
What is the difference between IPsec Phase 1 and Phase 2 on FortiGate?
Phase 1 (IKE SA) authenticates the remote gateway, verifies the pre-shared key (PSK) or digital certificate, and establishes a secure control channel. Phase 2 (IPsec SA) negotiates encryption proposals and traffic selectors (local and remote subnets) to encrypt the actual user payload data.
What causes 'IKE negotiation failed' in FortiOS?
The top 3 causes of Phase 1 IKE failure are: 1) Pre-shared key (PSK) typo between peers, 2) Mismatched encryption/hashing/Diffie-Hellman proposals (e.g. peer expects AES-256 with DH14, but FortiGate offers AES-128 with DH5), or 3) Blocked UDP ports 500/4500 by an upstream ISP or intermediate NAT router.
Why is Phase 1 UP but Phase 2 DOWN on a FortiGate tunnel?
When Phase 1 succeeds but Phase 2 fails, the issue is almost always a Phase 2 Quick Mode Selector mismatch. If FortiGate defines local subnet 10.10.0.0/24 and remote subnet 192.168.1.0/24, the remote firewall must mirror these exactly. For route-based tunnels connecting to cloud providers (Azure, AWS), both selectors should typically be set to 0.0.0.0/0.
Solve Fortinet Problems Fast with PortalPilot
PortalPilot translates raw FortiGate, FortiOS, and FortiPortal logs into plain-English root causes and change requests. 100% on-device zero-trust execution.