ThisIPsec Phase 1 configurationdefines adynamicVPN tunnel that can accept connections from multiple peers. The settings chosen here suggest a configuration optimized fornetworks with intermittent traffic patternswhile ensuring resources are used efficiently.

Key configurations and their impact:

●set type dynamic→ This allows multiple peers to establish connections dynamically without needing predefined IP addresses.

●set ike-version 2→ UsesIKEv2, which is more efficient and supports features like EAP authentication and reduced rekeying overhead.

●set dpd on-idle→ Dead Peer Detection (DPD) is triggeredonly when the tunnel is idle, reducing unnecessary keep-alive packets and improving resource utilization.

●set add-route enable→ FortiGate automatically adds the route to the routing table when the tunnel is established, ensuring connectivity when needed.

●set proposal aes128-sha256 aes256-sha256→ Uses strong encryption and hashing algorithms, ensuring a secure connection.

●set keylife 28800→ Sets alonger key lifetime(8 hours), reducing the frequency of rekeying, which is beneficial for stable connections.

BecauseDPD is set to on-idle, the tunnel will not constantly send keep-alive messages but will still ensure connectivity when traffic is detected. This makes the configuration ideal fornetworks with regular but non-continuous traffic, balancing security and resource efficiency.

When usingIPsec VPNsandVXLAN, additional headers are added to packets, which can exceed thedefault 1500-byte MTU. This can lead tofragmentation issues, dropped packets, or degraded performance.

To resolve this, theMTU (Maximum Transmission Unit)should be adjustedonly if all devices in the network path support it. Otherwise, some devices may still drop or fragment packets, leading to continued issues.

Why adjusting MTU helps:

●VXLAN adds a 50-byte overheadto packets.

●IPsec adds additional encapsulation(ESP, GRE, etc.), increasing the packet size.

● If packets exceed the MTU, they may befragmented or dropped, causing intermittent connectivity issues.

● Lowering the MTU on interfaces ensurespackets stay within the supported size limitacross all network devices.

To minimizeCPU and RAM usagewhile still enforcingsecurity features like web filtering and application control,SSL certificate inspection modeis the best choice.

●SSL certificate inspectionallows FortiGate to inspectonly the SSL/TLS handshake, including theServer Name Indication (SNI) and certificate details, without decrypting the full encrypted payload.

● This enables features likeweb filtering and application controlbecause FortiGate can determine thedestination website or applicationbased onSNI and certificate information.

● Itsignificantly reduces system loadcompared tofull SSL inspection, which requires full decryption and re-encryption of traffic.

IKEv2 (Internet Key Exchange version 2) is an improvement over IKEv1, offering enhanced security, efficiency, and flexibility in VPN configurations.

It includes stronger Diffie-Hellman (DH) groups, such as Elliptic Curve (ECP) groups.

IKEv2 supports stronger cryptographic algorithms, includingElliptic Curve Diffie-Hellman (ECDH)groups such asECP256 and ECP384, providing improved security compared to IKEv1.

It supports the extensible authentication protocol (EAP).

IKEv2 natively supports EAP authentication, which allows integration with external authentication mechanisms such asRADIUS, certificates, and smart cards. This is particularly useful forremote access VPNswhere user authentication must be flexible and secure.

FortiGate, like other security appliances, cannot analyze encrypted HTTPS traffic unless itdecryptsit first. Ifonly certificate inspectionis enabled, FortiGate can see the certificate details (such as the domain and issuer) butcannot inspect the actual web content.

To fully analyze the traffic and detect potential malware threats:

●Full SSL inspection (Deep Packet Inspection)must be enabled in theSSL/SSH Inspection Profile.

● This allows FortiGate todecrypt the HTTPS traffic, inspect the content, and then re-encrypt it before forwarding it to the user.

● Without full SSL inspection, threats embedded in encrypted traffic may go undetected.

Unlike IPS or antivirus databases,FortiGate does not store a full web filter database locally. Instead, FortiGatequeries FortiGuard (or FortiManager, if configured) dynamicallyto classify and filter web content in real time.

Key points:

●Web filtering works on a cloud-based model:

● When a user requests a website,FortiGate queries FortiGuard servers to check its category and reputation.

● The response is then cached locally for faster lookups on repeated requests.

●No local web filter database version:

● UnlikeIPS and antivirus, which download and store signature updates locally,web filtering relies on cloud-based queries.

● This is whyno database version appears in the GUI.

●Flow mode vs Proxy mode:

● Inproxy mode, FortiGate cancachesome web filter data, improving performance.

● Inflow mode, all queries happen dynamically, with no locally stored database.

The MAC addresse0:23:ff:fc:00:86follows the format used inFortiGate High Availability (HA) clusters. When FortiGate devices are in an HA configuration, they usevirtual MAC addressesfor failover and redundancy purposes.

The suspicious packet is related to a cluster that has VDOMs enabled:FortiGate devices withVirtual Domains (VDOMs)enabled use specific MAC address ranges to differentiate HA-related traffic. This MAC address is likely part of that mechanism.

The suspicious packet is related to a cluster with a group-id value lower than 255:FortiGate HA clusters assign virtual MAC addresses based on thegroup ID. The last octet (00:86) corresponds to agroup IDthat isbelow 255, confirming this option.