In this scenario, IKE Phase 1 and EAP authentication complete successfully, and the client receives an IPv4 address from the configured VPN IP pool. However, the IPsec tunnel fails during the Phase 2 / CHILD_SA negotiation.
The following messages can be observed in the IKE debug:
failed to match peer selectors
traffic selectors unacceptable
The issue occurs when the affected FortiClient endpoint proposes IPv6 or IPv6 traffic selectors while the FortiGate Phase 2 configuration only includes IPv4 traffic selectors.
The FortiGate receives and processes the IKE negotiation correctly. IKE Phase 1 is established, EAP/FNBAM authentication completes successfully, and the client receives an address from the configured VPN IP pool.
The failure occurs when FortiClient sends the traffic selectors for the CHILD_SA. Since the FortiGate does not have a matching IPv6 selector configured in Phase 2, it rejects the proposal, and the tunnel does not reach the UP state.
To confirm the behavior, compare the IKE debug from an affected endpoint with the debug from a working endpoint.
A working endpoint normally proposes IPv4 traffic selectors that match the FortiGate Phase 2 configuration. The FortiGate can then create the IPsec SA and establish the VPN tunnel successfully.
To collect an IKE debug for the affected user, run:
diagnose debug reset
diagnose vpn ike log filter clear
diagnose vpn ike log filter rem-addr4 <affected_public_IP>
diagnose debug console timestamp enable
diagnose debug application ike -1
diagnose debug enable
Reproduce the issue and then stop the debug:
diagnose debug disable
diagnose debug reset
To verify the configured Phase 2 selectors, run:
show full-configuration vpn ipsec phase2-interface
To resolve the issue when the VPN deployment is intended for IPv4 traffic only, disable IPv6 on the active network adapter of the affected FortiClient endpoint. After disabling IPv6, reconnect FortiClient.
FortiClient should then propose IPv4 traffic selectors. If the proposed selectors match the configured Phase 2 selectors on the FortiGate, the CHILD_SA is established, and the IPsec VPN tunnel reaches the UP state.
If IPv6 connectivity through the VPN is required, do not disable IPv6 permanently. Instead, configure compatible IPv6 or dual-stack traffic selectors in the FortiGate Phase 2 configuration.
| 
