topic Re: IKE phase-2 negotiation is failed as initiator, quick mode in General Topics

IKE phase-2 negotiation is failed as initiator, quick mode

LCMember1607 — Thu, 26 Jan 2012 14:56:57 GMT

Could someone clarify this error message?

IKE phase-2 negotiation is failed as initiator, quick mode. Failed SA: 216.204.241.93[500]-216.203.80.108[500] message id:0x43D098BB. Due to negotiation timeout

Thanks

Re: IKE phase-2 negotiation is failed as initiator, quick mode

jdelio — Thu, 26 Jan 2012 23:10:27 GMT

This error means that Phase 2, IKE negotiation is timing out on UDP 500.

Now, there can be many causes, but here are a couple of things to check.

1. Make sure that your UDP timeout is not dropping the connections before they can reply.. increasing your UDP timeout by 30 seconds.

2. Make sure that your rules are not blocking your traffic. Check Monitor for dropped traffic.

3. Check with your peer, see if they are getting any of the phase 2 communication.

Past this, if you are not getting any where, Please open up a support case by logging into support.paloaltonetworks.com or calling in at +1-866-898-9087

Re: IKE phase-2 negotiation is failed as initiator, quick mode

Retired Member — Fri, 27 Jan 2012 06:39:10 GMT

To add to Jdelio's response, seems PA is initiator in your output. You should be checking on the responder side. Always the responder side will usually show what is failing. If you do not have access to responder IKE peer, then I would suggest to have remote side be the initiator of the tunnel and then check PA side logs to see what is failing.

Most common phase-2 failure is due to proxy-id mismatch. That would be first thing I would check. Also check IPSec crypto to ensure that proposals match on both sides.

-Richard

Re: IKE phase-2 negotiation is failed as initiator, quick mode

LCMember1607 — Fri, 27 Jan 2012 14:40:10 GMT

Thanks Guys, Proxies it was.