IPsec Phase 2

i personally find 0.0.0.0/0 selectors to give you more flexibility and its easier to scale any changes.

indeed. It only gets quite obfuscating with so many phase2s :)

I also tend to use an open (i.e. 0.0.0.0/0) p2 selector and then do the rest with routing and policies.

In addition, that's the size of network you want to use routing protocol either OSPF or BGP.

Toshi

If both sides/sites use Fortigates, I'd use an address group as 'named address'. Make it routeable, right from the start. Then I use it in

- phase2

- policy

- static route

And for 60 s2s VPNs, use a template and script it, along with the address groups.

Using the wildcard '0.0.0.0/0' is a FortiOS speciality.

Provided that at both ends you have Fortigates (e.g. Checkpoint doesn't play well with 0.0.0.0) then using 0.0.0.0 for the encryption domain would be a common practice, usually you also run BGP or (less so - OSPF) on them to advertise subnets of each other, and this way save yourself configuring static routes on remote FGTs. 

I appreciate everyone's responses. I received my response. Could someone please explain to me what's happening in the FortiGate routing table when we put 0.0.0.0/0 in phase 2 IPsec? and whether they clash if we have 0.0.0.0/0 directed to the WAN interface?

If your FortiGate device is stuck on "negotiating" during IPsec Phase 2, try these:

Check Debug Logs: Use diag debug application ike -1 for detailed logs.

Verify Configurations: Ensure both ends have matching Phase 2 settings.

Check for Duplicate Selectors: Look for conflicts in policy and object addresses.

Review Keepalive Settings: Enable "Keep Alive" for idle tunnels.

Check FortiOS Bugs: Ensure you’re on a stable FortiOS version.

For more details, visit the Fortinet Community.