Troubleshooting Tip: 'IKEv1 is insecure. Please use IKEv2.' - IKEv1 deprecation

Description

This article describes the behavior of FortiOS when configuring an IPsec VPN via the CLI when choosing IKEv1.

Scope

FortiOS v8.0.x.

Solution

When configuring the IPsec VPN, setting the following command will result in a warning:

config vpn ipsec phase1-interface
    edit Name_test
        set ike-version 1
end

It will show the following warning:

Warning: IKEv1 is insecure. Please use IKEv2.
Do you still want to use IKEv1? (y/n)

This is expected. This message has been introduced in FortiOS v8.0.0, as IKEv1 has been deprecated. Also IKEv2 simplifies negotiation (No Aggressive/Main mode choice in Phase1) and uses less bandwidth.

For additional details regarding changes in the CLI of v8.0.0, consult Changes in CLI.