Overview
Domain 5 contains a single objective in the FortiOS 7.6 outline: implement a meshed or partially redundant IPsec VPN. Its listed subtopics are IPsec VPN concepts, building tunnels with the IPsec wizard, redundant VPNs between two FortiGate devices, reviewing IPsec logs, and diagnosing IPsec issues. SSL VPN, which appeared in the June 2025 exam description, is not part of the current objectives.
You need to understand IKE phase 1 and phase 2, route-based versus policy-based tunnels, and how routes, firewall policies and dead peer detection combine to give failover. Questions often show a tunnel status, an IKE debug excerpt or a pair of routes over two tunnels, and ask why traffic does not flow or which tunnel is used. Every tunnel also needs firewall policies in both directions and a route that points traffic into the tunnel interface.
How it's tested
VPN items tend to give a tunnel configuration, an IPsec monitor screen, IKE debug lines or two competing routes. You identify which phase failed, which tunnel carries traffic, or what extra object is needed. Read phase 1 and phase 2 settings on both peers carefully, because a single mismatch is often the whole answer.
-
Which phase failed
Debug output or logs show a negotiation error, and you decide whether the problem is in phase 1 or phase 2 and what mismatched.
-
Up but no traffic
The tunnel is up, yet traffic fails, and you find the missing route, firewall policy or selector.
-
Design redundancy
Two tunnels exist between sites, and you choose the routing and dead peer detection settings that give the required failover.
A route-based tunnel shows phase 1 and phase 2 up, but branch users cannot reach the head office subnet. The tunnel being up rules out keys and proposals. The next checks are a static route for the remote subnet through the tunnel interface and a firewall policy from the LAN to the tunnel interface. The branch has the policy but no route, so traffic leaves through the default route.
Objectives 1
Official objectives from the Fortinet outline, in outline order.
5.1 Implement a meshed or partially redundant IPsec VPNIPsec concepts, the IPsec wizard, redundant tunnels between FortiGates, logs and troubleshooting.
- What it means
- This objective covers building IPsec tunnels between FortiGate devices and making them resilient. It includes IKE and IPsec fundamentals, using the IPsec wizard to create tunnels from templates, designing full mesh, partial mesh or hub-and-spoke topologies with backup tunnels, reviewing VPN logs and fixing common negotiation and traffic problems.
- What to understand
- Phase 1 authenticates the peers with a pre-shared key or certificates and agrees on encryption, hashing and Diffie-Hellman groups, using IKEv1 or IKEv2. Phase 2 negotiates the IPsec security associations and the quick mode selectors that define protected subnets. Route-based tunnels create a virtual interface used by routes and policies, which makes redundancy straightforward: two tunnels with routes of different distance or priority, plus dead peer detection to remove a failed path. NAT traversal encapsulates IPsec in UDP 4500. Tools include the IPsec monitor, VPN event logs and IKE debug output.
- How it shows up
- Expect to find the cause of a failed or idle tunnel, or choose the settings for a backup tunnel.
- Common confusion
- Assuming an up tunnel guarantees traffic flow; routes and firewall policies are still required.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
IKE phase 1
Authenticates peers and builds the secure channel for negotiation.
- Remember
- PSK or certificates, with matching proposals and DH group.
- Tested as
- Which-phase-failed questions.
- Trap
- Blaming phase 2 for an authentication error.
-
IKE phase 2
Negotiates IPsec SAs and the protected subnets.
- Remember
- Selectors must match on both peers.
- Tested as
- Up-but-no-traffic questions.
- Trap
- Ignoring selector mismatches.
-
IKEv1 versus IKEv2
Two IKE versions with different exchanges.
- Remember
- Both peers must use the same version.
- Tested as
- Negotiation failures.
- Trap
- Mixing versions between peers.
-
Route-based (interface mode) IPsec
Creates a tunnel interface used in routes and policies.
- Remember
- Preferred for redundancy and dynamic designs.
- Tested as
- Design questions.
- Trap
- Forgetting the route into the tunnel.
-
Policy-based IPsec
Tunnel selected by a firewall policy with an IPsec action.
- Remember
- Less flexible for redundancy.
- Tested as
- Design comparisons.
- Trap
- Choosing it for multi-tunnel failover.
-
IPsec wizard
Creates tunnels from templates with matching objects.
- Remember
- It also adds routes and policies.
- Tested as
- Configuration questions.
- Trap
- Assuming it only builds phase 1.
-
Dead peer detection
Detects an unresponsive peer and brings the tunnel down.
- Remember
- Enables routes to fail over.
- Tested as
- Redundancy questions.
- Trap
- Expecting failover without it.
-
Redundant tunnels
Two tunnels with routes of different distance or priority.
- Remember
- The preferred tunnel carries traffic until it fails.
- Tested as
- Partial mesh designs.
- Trap
- Giving both routes identical values unintentionally.
-
NAT traversal
Encapsulates ESP in UDP 4500 when NAT is detected.
- Remember
- Required behind NAT devices.
- Tested as
- Tunnel failures through NAT.
- Trap
- Blocking UDP 4500 upstream.
-
Full versus partial mesh
Every site connects to every other, or only some sites connect.
- Remember
- Partial mesh reduces tunnel count.
- Tested as
- Topology questions.
- Trap
- Overestimating mesh scalability.
-
IKE debug
Shows negotiation messages and errors between peers.
- Remember
- Filter by peer address first.
- Tested as
- Troubleshooting questions.
- Trap
- Running it unfiltered.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Phase 1 versus phase 2
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Phase 1 | Authenticates peers and protects negotiation | Keys, proposals, DH group, IKE version | Blaming selectors for a key mismatch |
| Phase 2 | Creates IPsec SAs for user traffic | Selectors, proposals, PFS | Ignoring selectors when phase 1 is up |
Route-based versus policy-based IPsec
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Route-based | Tunnel interface used by routes and policies | Supports redundancy and dynamic routing | Forgetting the route into the tunnel |
| Policy-based | Policy with an IPsec action picks the tunnel | Simple single-tunnel setups | Using it for multiple redundant tunnels |
VPN topologies
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Hub-and-spoke | Branches connect to a central hub | Fewest tunnels, hub carries transit | Hub becomes a single point of failure |
| Partial mesh | Some direct links plus backups | Balances cost and resilience | Missing routes for indirect paths |
| Full mesh | Every site connects to every other | Most resilient, most tunnels | Underestimating management overhead |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Up means working
- What candidates pick
- Conclude the VPN works because phase 1 and phase 2 are up.
- Why it looks right
- The monitor shows a green status.
- Why it's wrong
- Traffic also needs a route into the tunnel interface and policies allowing it in each direction.
Clue to watch for Users cannot reach remote subnets despite an up tunnel.
-
Wrong phase
- What candidates pick
- Fix phase 2 selectors when the debug shows an authentication failure.
- Why it looks right
- Selectors are a familiar culprit.
- Why it's wrong
- Authentication and proposal errors occur in phase 1; selectors are only negotiated once phase 1 succeeds.
Clue to watch for The debug output mentions a PSK or proposal mismatch.
-
Automatic failover
- What candidates pick
- Expect traffic to move to the backup tunnel instantly without other settings.
- Why it looks right
- Two tunnels look redundant.
- Why it's wrong
- Without dead peer detection and routes with different distance or priority, the failed tunnel's route can stay active.
Clue to watch for The primary peer is unreachable but traffic still uses its tunnel.
-
Policy-based for redundancy
- What candidates pick
- Choose policy-based IPsec for a multi-tunnel failover design.
- Why it looks right
- It needs fewer objects.
- Why it's wrong
- Route-based tunnels work with routing to provide failover; policy-based tunnels are tied to fixed policies.
Clue to watch for The requirement mentions backup tunnels or dynamic paths.
-
NAT does not matter
- What candidates pick
- Ignore an upstream NAT device when a tunnel fails to form.
- Why it looks right
- The FortiGates look correctly configured.
- Why it's wrong
- Behind NAT, IPsec needs NAT traversal on UDP 4500, which a blocking upstream device prevents.
Clue to watch for One peer sits behind a router performing NAT.
Answer framework
Follow this order when a Domain 5 question describes an IPsec tunnel that fails or a redundant design.
- Check whether phase 1 is up; if not, compare IKE version, authentication method, pre-shared key or certificates, proposals and DH groups on both peers.
- If phase 1 is up but phase 2 is not, compare selectors, phase 2 proposals and PFS settings, since these are negotiated only in phase 2.
- With both phases up, confirm a route sends the remote subnet into the tunnel interface and policies allow traffic in each direction.
- For redundancy, give the backup tunnel's route a higher distance or priority and enable dead peer detection so the failed path is withdrawn.
- Use the IPsec monitor, VPN event logs and a filtered IKE debug to confirm the cause, and check NAT traversal on UDP 4500 when NAT is present.
Practice question
Want more like this? The NSE 4 practice test has questions for every domain.
Checklist
0 of 10
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Build two FortiGate VMs and connect them with a site-to-site tunnel using the IPsec wizard. Afterwards, inspect every object the wizard created, including phase 1, phase 2, address groups, the static route and both firewall policies, so you know what to add when building a tunnel manually.
Then break it on purpose. Change the pre-shared key, a proposal, then a phase 2 selector, and each time read the IPsec monitor, the VPN event log and a filtered IKE debug to see how the failure appears. Delete the route or a policy to reproduce a tunnel that is up but passes nothing.
Finally, add a second tunnel and practice redundancy: equal routes first to see ECMP, then different priority values with dead peer detection, and disable the primary path to watch failover. Sketch hub-and-spoke, partial mesh and full mesh designs and count tunnels for each. Leave SSL VPN aside, since the current objectives no longer list it.
FAQ
How much of the NSE 4 exam is VPNs?
Fortinet weights the VPNs domain at 10-15% of the FortiOS 7.6 Administrator exam, about 6 to 8 questions, all drawn from one IPsec objective.
Is SSL VPN still tested?
SSL VPN is not listed in the current FortiOS 7.6 objectives on the exam page. The June 2025 exam description included it, so older study material may still cover it.
Why is my tunnel up but not passing traffic?
Check for a route sending the remote subnet into the tunnel interface, firewall policies in both directions, and matching phase 2 selectors on each peer.
What is the difference between route-based and policy-based IPsec?
Route-based IPsec creates a tunnel interface used by routes and policies, which suits redundancy. Policy-based IPsec selects the tunnel through a firewall policy with an IPsec action.
How do I make one tunnel a backup?
Give its route a higher distance or priority value than the primary tunnel's route, and enable dead peer detection so the primary route is removed when the peer fails.
What does NAT traversal do?
When a NAT device sits between peers, NAT traversal wraps ESP in UDP 4500 so the translated packets still reach and match the IPsec session.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- CompTIA Cybersecurity Analyst+ Study guide
- Microsoft Security Operations Analyst Associate Study guide
- Certified Ethical Hacker Study guide
- Penetration Tester Study guide
- Systems Security Certified Practitioner Study guide
- Certified in Risk and Information Systems Control Study guide
- CompTIA PenTest+ Study guide
- CompTIA SecurityX (CASP+) Study guide
- Azure Security Engineer Associate Study guide
- CISM (Certified Information Security Manager) Study guide
- CISSP Study guide
- CompTIA Security+ Study guide
- Certified Information Systems Auditor Study guide
- Certified Cloud Security Professional Study guide
Test your Domain 5 knowledge
You have reviewed IPsec phases, route-based tunnels, redundancy and troubleshooting. Test whether you can find why a tunnel fails or which tunnel carries traffic.