FCP-FGT-AD - VPN - Section 5.2

Implement a meshed or partially redundant IPsec VPN including IKE phase 1 and phase 2 configuration.

Implement IPsec VPN tunnels by configuring IKE phase 1 authentication and encryption parameters and IKE phase 2 selectors, then apply them in hub-and-spoke or redundant VPN topologies. Diagnose tunnel negotiation failures by correlating phase 1 and phase 2 status outputs with the configured settings.

IPsec VPNIKE phase 1IKE phase 2hub-and-spokeredundant VPN

Practice question for this objective

Free sampleVPNhard

While reviewing a route-based IPsec tunnel on FortiGate, an administrator must classify which negotiated parameters are agreed during IKE phase 1 and which are agreed during phase 2, so that a colleague editing the configuration changes the correct page. Which grouping correctly assigns the parameters to their phase?

  • APhase 1 agrees the peer authentication method, the Diffie-Hellman group, and the IKE SA lifetime; phase 2 agrees the traffic selectors and the IPsec SA encryption and lifetime. Correct
  • BPhase 1 agrees the data encryption algorithm and the quick mode selectors; phase 2 agrees the peer authentication method and the Diffie-Hellman group.
  • CPhase 1 agrees the traffic selectors and the IPsec SA lifetime; phase 2 agrees the peer authentication method and the IKE SA lifetime.
  • DPhase 1 agrees the traffic selectors and the data encryption algorithm; phase 2 agrees the Diffie-Hellman group and the peer authentication method.
Phase 1 negotiates peer authentication, DH group and IKE SA lifetime; phase 2 negotiates traffic selectors, IPsec encryption and the IPsec SA lifetime. Phase 1 establishes the secure IKE/ISAKMP channel, so it owns peer authentication, the DH group and the IKE SA lifetime. Phase 2 uses that channel to build the IPsec SAs that actually protect user traffic, so it owns the traffic selectors, the data encryption transform and the IPsec SA lifetime.

Why A is correct: Correct: phase 1 builds the IKE/ISAKMP SA, negotiating peer authentication, the DH group and the IKE SA lifetime; phase 2 builds the IPsec SA, negotiating the traffic selectors, the data encryption transform and the IPsec SA lifetime.

Why B is wrong: Tempting because all four items are real tunnel parameters, but it inverts the phases: encryption of data and selectors are phase 2 concerns, while peer authentication is a phase 1 concern.

Why C is wrong: Tempting because it pairs a lifetime with each phase, but selectors and the IPsec SA lifetime belong to phase 2, while peer authentication and the IKE SA lifetime belong to phase 1, so both groupings are reversed.

Why D is wrong: Tempting because selectors and encryption both protect data, but selectors and the data transform are negotiated in phase 2, and the DH group and peer authentication are negotiated in phase 1, so this assignment is wrong.

See more FCP-FGT-AD practice questions, answers explained.

More in this domain

Back to all VPN objectives, or the FCP-FGT-AD cert hub.

Examworthy is not affiliated with or endorsed by Fortinet. Original, blueprint-aligned practice material only.