FortiGate IKEv1 to IKEv2 Site-to-Site Migration

Record the existing tunnel and both sides of the agreement

Use a protected configuration backup and the actual tunnel editor. Record the FortiOS build, VDOM, phase 1 name, physical interface, local gateway, remote gateway, authentication method and both identity types and values. Keep the backup private: even encrypted secret fields are sensitive. A wizard-created tunnel still needs this inventory; converting its editor to Custom is not a reason to recreate its routes or address objects.

In IKEv2 there is no Main/Aggressive Mode choice, and IKEv1 XAuth is not available. EAP is a separate user-authentication design; do not add it to an ordinary PSK site-to-site tunnel. See FortiOS 7.2.13 IKE version selection.

Compare parameters before editing

Local and remote selectors swap roles at the opposite gateway. Preserve the negotiated scope, including protocol or port selectors if present. If the peer requires explicit subnets, do not replace them with 0.0.0.0/0. Changing cipher suites and topology in the same window adds independent failure causes; agree only the changes required for a supported IKEv2 pairing. Phase 1 settings and phase 2 settings describe the separate controls.

An IKE SA authenticates the gateways; the Child SA carries protected traffic. Treat their proposals as separate rows, even though FortiOS retains “phase 1” and “phase 2” configuration names. Check AEAD/PRF assumptions with the peer rather than carrying a phase 1 proposal string into phase 2.

Apply the agreed change in a coordinated window

For an already inspected route-based tunnel whose remaining settings match the new agreement, the IKE-version edit is small. The symbolic tunnel name below must identify an existing object; entering a new name would create a different object. If the existing authentication needs more changes, stop and prepare those explicitly first.

config vpn ipsec phase1-interface
    edit "<existing-tunnel>"
        set ike-version 2
    next
end

Coordinate the equivalent change on the other gateway. Do not change the phase 1 interface type as part of this edit; FortiOS documents that an interface-type change requires a new interface.

Verify the application, then retain or roll back

Generate an authorized connection from a host in each required selector pair. Confirm IKEv2 negotiation, the expected Child SA selectors, increasing encrypt/decrypt counters and a complete application transaction. Test an already working subnet as well as the critical service. A ping sourced by the firewall can use a different address from the client and is not enough.

If negotiation fails, use the bounded IKE debug guide. If the Child SA exists but the application fails, follow the subnet traffic guide. Stop at the agreed deadline rather than expanding selectors or disabling protections to get a green icon.

Rollback: coordinate both gateways back to their recorded IKEv1 settings and restore only other values changed in this window. If only ike-version changed, restore its saved value of 1 on the same object. Verify the original application paths again. Stop debug output and clear only the diagnostic filters you introduced.

Get useful IKE debug output · Trace protected subnet traffic · Compare IKEv2 transforms · Compare protected address coverage