Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor

Phase2 selectors



Just a quick question..


When will you use phase 2 selectors like -> and when wil you specify the local and remote subnet?

Is there a rule for that? Which one is preffered while building en IPSec?


Or is used only while building IPSec between Fortigates?


Just crossing my mind...



Esteemed Contributor III

It really matters  when you use it, but both side needs to be configured the same.




1> when you use 0.0.0/0:0  ( aka quad 0s ) you loose the ability to get per src/dst SA flows details


2> many  host of firewall support quad 0s, fortigate, juniper, chkp, strongswan, forcepoint, etc.......


3> why you might do quad0s over specific src/dst subnet-pair,  Is due to the remote-side only supports quad0s ( ie like a cloud-provider ) or if you want to run a dynamic-routing protocol and will send various different networks across the tunnel


4> if you only want one ipsec-SA for monitoring purposes vrs trying to monitor up/down over X amount if vpn-tunnels


5> or if you want simpler configuration overall 


Ken Felix





PCNSE NSE StrongSwan
New Contributor

Ok thanks for the reply... So even if I choose for the simpler configuration and use quad 0s on my Fortigate the other side must also support it and use it inside their P2.. Am I correct?

Esteemed Contributor III

Yes, as Ken stated at the beginning. Both sides need to have the same selector sets. 0/0<->0/0 is not an exception.

Valued Contributor

For example Checkpoints do NOT support selectors by default (i.e in 99% of deployments), only via VTI interfaces .  

I, personally, unless explicitly required (e.g. VPN with AWS/Azure you have to use it or when using dynamic routing between peers), prefer specific selectors - just removes another weak link in the possible chain of failures.  


If you are sure you will be setting up VPN between Fortigates only for ever after, then no problem - between Fortigates it works just fine.



Yuri  blog: All things Fortinet, no ads.
Yuri blog: All things Fortinet, no ads.
Top Kudoed Authors