An administrator is configuring an IPsec VPN between site A and site B. The Remote Gateway setting in both sites has been configured as Static IP Address. For site A, the local quick mode selector is 192.168.1.0/24 and the remote quick mode selector is 192.168.2.0/24. Which subnet must the administrator configure for the local quick mode selector for site B?

In a site-to-site IPsec VPN, the Phase 2 selectors (Quick Mode Selectors) must be configured as a mirror image on the two peers. The "local" subnet on one end of the tunnel must match the "remote" subnet on the other end, and vice versa. Since Site A's configuration defines the remote network as 192.168.2.0/24, this is the network that Site B must define as its local network for the Phase 2 negotiation to succeed and the tunnel to be established correctly.

A. 192.168.1.0/24 is Site A's local subnet, so it must be configured as Site B's remote subnet.
B. 192.168.0.0/24 is an incorrect subnet that does not match the selectors defined on Site A.
D. 192.168.3.0/24 is an incorrect subnet that does not match the selectors defined on Site A.

1. FortiOS 7.0.0 Administration Guide, "Phase 2 configuration", p. 1264. The guide states, "The source and destination addresses that you define here must be the opposite of the addresses that you define on the remote gateway."

2. FortiOS 7.0.0 Cookbook, "Site-to-site IPsec VPN with pre-shared key", p. 5. The example configuration clearly shows the local and remote selectors being mirrored between the two sites. For example, Site 1's local selector is Site 2's remote selector.