topic Re: IKEV2 Errors in Log in General Topics

IKEV2 Errors in Log

gzygadlo — Wed, 18 Jul 2018 16:59:19 GMT

On my PA-500 and PA-820's when I have a IKEV2 tunnel I tend to see this alot. Both of these are running 8.0.10

'IKEv2 SA negotiation is failed. received notify type TS_UNACCEPTABLE

Trying to figure out what is causing this. Anyone have any ideas

Re: IKEV2 Errors in Log

Remo — Wed, 18 Jul 2018 17:42:31 GMT

This is because the IPSec Phase 2 networks (Proxy IDs) do not match. And because of this the other peer sends back this TS_UNACCEPTABLE message back to your firewall.

--> https://tools.ietf.org/html/rfc5996#section-2.9

Re: IKEV2 Errors in Log

Steven_Borba — Mon, 14 Nov 2022 21:26:47 GMT

I was just having something like this too, but it is from a PAN to a PAN, and there are no proxy ids.

So I decided to do a cli based show and found that the ipsec tunnel had "set network tunnel ipsec TUNNELNAME disabled yes", but the tunnel wasn't greyed out in the webui. Enabled the tunnel and it started working.

Adding this in case someone else runs into it

Re: IKEV2 Errors in Log

tactig4r — Wed, 15 Feb 2023 14:46:27 GMT

Hi. Please, can you explain more about this?

Can you also post the show command please?

Thanks

Re: IKEV2 Errors in Log

millerfuturex — Tue, 03 Oct 2023 20:21:27 GMT

That fixed mine. Thanks for the hint.

Re: IKEV2 Errors in Log

SinovuyoGamnca — Thu, 01 Feb 2024 14:23:52 GMT

Hi Steven,

Could you please paste the command here

Re: IKEV2 Errors in Log

jsconnects — Tue, 30 Dec 2025 15:05:17 GMT

Probably not all that helpful years later, but from configuration mode:

show network tunnel ipsec <tunnel-name>