Build, diagnose, and recover FortiGate VPNs.
Develop practical skills for IPsec VPN operations, from tunnel state and selectors to Phase 1, Phase 2, routing, and failure recovery.
This is the engineering problem. This is how a real engineer investigates it. This is how KiwiTut lets you practise it.
READ THE CLI.
UNDERSTAND THE STATE.
MAKE THE CHANGE.
Fix the network.
Prove the recovery.
IPsec fundamentals
Understand the FortiGate VPN dependency chain from peer reachability through protected traffic.
Phase 1 / Phase 2
Distinguish IKE authentication and proposal negotiation from the child SA that carries traffic.
gateway HQ-BRANCH role=responder established
Selectors
Match local and remote protected networks to the traffic that must cross the tunnel.
Routing
Connect tunnel state to usable routes, policy direction, NAT behavior, and the return path.
Protected subnets must point at the tunnel interface.
Check with: get router info routing-table all and get router info routing-table lookup 10.20.40.0/24
Routing decides where, policy decides whether. A shadowed or missing policy silently drops matched traffic even on a healthy tunnel.
Tunnel diagnosis
Read operational evidence to isolate negotiation, selector, routing, and post-tunnel traffic failures.
Recovery validation
Prove the protected service works in both directions, not only that the tunnel reports up.
Policy and NAT interplay
Selectors define interesting traffic; policies and NAT decide how it is handled in flight. All three must agree.
Both peers need mirror-image selectors – one-sided definitions negotiate but never carry traffic.
Inspect with: show vpn ipsec phase2
Confirm whether central SNAT applies before blaming the tunnel.
Inspect with: show firewall central-snat-map
Verification checklist
- Gateway established in
diagnose vpn ike gateway list - Tunnel up in
diagnose vpn tunnel list - Routes present for protected subnets
- Policy counters increment for matched traffic
- End-to-end probe succeeds across the tunnel
Related engineering paths: SD-WAN path selection, the CLI decision-record guide, and the symptom-first troubleshooting workflow. Or browse the full FortiGate paths catalogue.
Train inside KiwiTut Pro.
These public paths describe the engineering work. The real hands-on FortiGate network operations simulator is private beta at app.kiwitut.com and is available only after controlled access is approved.