I85PREP
⌘ K
FCP study materials
FCP study resources

FCP: SSL VPN and IPsec VPN Configuration

FCP · Work through your exam, one topic at a time.

All guide sections

SSL VPN and IPsec VPN Configuration

SSL VPN and IPsec VPN Configuration tests how to build remote-access and site-to-site tunnels and how to troubleshoot why a tunnel is up but traffic does not flow. Expect questions on portal settings, phase 2 selectors, routing, and authentication.

SSL VPN mechanics

  • SSL VPN settings define the listening port, tunnel IP pools, and authentication.
  • Realms map different user groups to different portals; portal settings control split tunneling, bookmarks, and client OS checks.
  • Tunnel mode requires an IP pool; routes are pushed or manually added depending on split-tunnel settings.
  • Web mode proxies applications and does not require an IP pool.
  • Firewall policies must allow SSL VPN traffic from the VPN interface or zone to internal resources.

IPsec mechanics

  • Phase 1 negotiates the IKE SA: version, authentication method, encryption, DH group, and peer ID.
  • Phase 2 defines ESP selectors and PFS; mismatched selectors cause the tunnel to fail or drop traffic.
  • Route-based VPN uses a tunnel interface and static routes; policy-based VPN uses policy addresses and NAT.
  • DPD detects dead peers; NAT-T encapsulates ESP in UDP 4500 when NAT is present.
  • IKEv2 supports multiple child SAs and MOBIKE; IKEv1 uses main or aggressive mode.

Worked example

A dial-up IPsec VPN assigns 10.10.10.0/24 to clients. A client connects, phase 1 and phase 2 come up, but no internal resource is reachable. Check that the client received an address from the pool, the firewall policy from the VPN zone to internal allows the pool subnet, and a return route to the pool exists. For a route-based VPN, add a route to 10.10.10.0/24 via the tunnel interface. Policy lookup happens after route lookup, so a missing route means no policy match.

Traps

  • Policy-based and route-based VPNs use different policy logic; do not mix selectors.
  • Split tunneling changes client routing; full tunnel requires all traffic to enter the tunnel.
  • SSL VPN bookmarks work in web mode; tunnel mode needs client routes.

Key points

  • Tunnel-mode SSL VPN requires an IP pool; web mode does not.
  • IPsec phase 2 selector mismatch prevents traffic even when phase 1 is up.
  • Route-based VPN needs a route to the remote subnet via the tunnel interface.
  • NAT-T uses UDP 4500 when NAT is detected.
  • Split tunneling changes which client traffic enters the tunnel.