While reviewing a route-based IPsec tunnel on FortiGate, an administrator must classify which negotiated parameters are agreed during IKE phase 1 and which are agreed during phase 2, so that a colleague editing the configuration changes the correct page. Which grouping correctly assigns the parameters to their phase?
- APhase 1 agrees the peer authentication method, the Diffie-Hellman group, and the IKE SA lifetime; phase 2 agrees the traffic selectors and the IPsec SA encryption and lifetime. Correct
- BPhase 1 agrees the data encryption algorithm and the quick mode selectors; phase 2 agrees the peer authentication method and the Diffie-Hellman group.
- CPhase 1 agrees the traffic selectors and the IPsec SA lifetime; phase 2 agrees the peer authentication method and the IKE SA lifetime.
- DPhase 1 agrees the traffic selectors and the data encryption algorithm; phase 2 agrees the Diffie-Hellman group and the peer authentication method.
Why A is correct: Correct: phase 1 builds the IKE/ISAKMP SA, negotiating peer authentication, the DH group and the IKE SA lifetime; phase 2 builds the IPsec SA, negotiating the traffic selectors, the data encryption transform and the IPsec SA lifetime.
Why B is wrong: Tempting because all four items are real tunnel parameters, but it inverts the phases: encryption of data and selectors are phase 2 concerns, while peer authentication is a phase 1 concern.
Why C is wrong: Tempting because it pairs a lifetime with each phase, but selectors and the IPsec SA lifetime belong to phase 2, while peer authentication and the IKE SA lifetime belong to phase 1, so both groupings are reversed.
Why D is wrong: Tempting because selectors and encryption both protect data, but selectors and the data transform are negotiated in phase 2, and the DH group and peer authentication are negotiated in phase 1, so this assignment is wrong.