An administrator wants to create an IPsec VPN tunnel between two FortiGate devices. Which three configuration steps must be performed on both units to support this scenario? (Choose three.)

Firewall policies are crucial for controlling which traffic is allowed to traverse the VPN tunnel once it is established, defining the source, destination, service, and action for traffic passing between the internal networks and the VPN interface.

Configuring user groups is relevant for client-to-site VPNs or user-based access control, but it's not a mandatory step for establishing a basic site-to-site IPsec tunnel between two FortiGate devices.

FortiGates operate in various modes, but there isn't a specific 'IPsec VPN mode' for the entire device; IPsec VPNs are a feature configured within the device's existing operating mode.

Phase 2 parameters define the security associations for the actual data tunnel, including encryption and authentication algorithms for data transfer, PFS settings, and key lifetimes, which must match on both VPN peers for the tunnel to establish.

Phase 1 parameters, or the Internet Key Exchange (IKE) phase, define how VPN peers authenticate and establish a secure channel for exchanging Phase 2 keys, and these settings must be identical on both FortiGates.