"IKE uses UDP port 500. If NAT-T is enabled in a NAT scenario, IKE uses UDP port 4500."
"IKEv2 provides a simpler operation, which is the result of using a single exchange mode and requiring less messages to bring up the tunnel." For the specific workaround asked in this question, Fortinet's official documentation states that for an IP-level VPN, SSL VPN tunnel mode is useful to avoid issues caused by intermediate devices such as "ESP packets being blocked," "UDP ports 500 or 4500 being blocked," and "fragments being dropped, causing IKE negotiation that uses large certificates to fail if the peer does not support IKE fragmentation." ( Fortinet Document Library ) Fortinet's official documentation also states: "The ip-fragmentation command controls packet fragmentation before IPsec encapsulation, which can benefit packet loss in some environments." ( Fortinet Document Library ) Technical Deep Dive:
The correct answers are A and B .
A is correct because SSL VPN tunnel mode can bypass the classic IPsec transport problems caused by intermediate devices filtering ESP or blocking UDP 500/4500 . Fortinet explicitly documents this as a practical workaround. ( Fortinet Document Library ) B is correct because enabling fragmentation helps when IKE negotiation uses large certificates and fragments are being dropped in transit. Fortinet documents this exact failure scenario and the related fragmentation control. ( Fortinet Document Library ) Why the others are not correct:
* C is not the key fix. Hub-and-spoke is a topology choice, not the actual mechanism that solves blocked ESP or UDP 500/4500.
* D is not sufficient for this problem. IKEv2 uses fewer messages, but it still relies on IPsec/IKE transport and does not itself solve intermediate devices blocking ESP or UDP 500/4500. The source PDF mentions simpler operation, not blocked-port avoidance.
So, the two effective fixes are:
* Use SSL VPN tunnel mode
* Enable fragmentation