Based on the phase 2 configuration shown in the exhibit, what configuration change will bring phase 2 up?

Refer to the exhibit.

A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 status is up, but phase 2 fails to come up.

Based on the phase 2 configuration shown in the exhibit, what configuration change will bring phase 2 up?
A . On HQ-FortiGate, enable Diffie-Hellman Group 2.
B . On HQ-FortiGate, enable Auto-negotiate.
C . On Remote-FortiGate, set Seconds to 43200.
D . On HQ-FortiGate, set Encryption to AES256.

View Answer

Answer: D

Explanation:

D. On HQ-FortiGate, set Encryption to AES256.

A phase 2 proposal defines the algorithms supported by the peer for encrypting and decrypting the data over the tunnel. You can configure multiple proposals to offer more options to the remote peer when negotiating the IPsec SAs.

Like in phase 1, you need to select a combination of encryption and authentication algorithms. D is correct, the Encryption and authentication algorithm needs to match inorder for IPSEC be successfully established Encryption algorithm must be the same.