topic ipsec tunnel Phase 2 is down but IKE phase one shows green in Next-Generation Firewall Discussions

ipsec tunnel Phase 2 is down but IKE phase one shows green

ChiragChudasama — Mon, 26 May 2025 11:16:08 GMT

Hi everyone,

I have an Arista Untangle firewall deployed at a remote site, and I’m trying to establish an IPsec VPN tunnel between it and a Palo Alto firewall.

The tunnel comes up on the Untangle side and shows as active, and on the Palo Alto side, IKE Phase 1 is green, but IPsec Phase 2 remains down.

I've triple-checked the configurations on both sides, and they are identical — proposals, proxy IDs, pre-shared keys, and phase settings all match. Despite this, Phase 2 won't come up on the Palo Alto.

Has anyone encountered this issue or have suggestions on what to check next?

Your help is greatly appreciated!

Thanks in advance,
Chirag Chudasama

Re: ipsec tunnel Phase 2 is down but IKE phase one shows green

Raido_Rattameister — Mon, 26 May 2025 12:51:42 GMT

Try to initiate traffic from Arista side towards Palo.

Then go into Palo System log (Monitor > Logs > System) and look for any errors.

Re: ipsec tunnel Phase 2 is down but IKE phase one shows green

ChiragChudasama — Thu, 29 May 2025 11:42:37 GMT

Hi,

thanks for you response on post @Raido_Rattameister . i was check all logs as you define. but not found any information regarding this.

then i'm restart Phase-2 tunnel in Network > IPsec tunnel

after that phase -1 is showing up and green. then tunnel work fine with fully function.

Regards,

Chirag Chudasama