topic Re: phase 1 up phase 2 down in General Topics

phase 1 up phase 2 down

MP18 — Fri, 29 Mar 2019 16:06:13 GMT

( description contains 'IKE phase-1 negotiation is failed. Peer\'s ID payload 10.175.150.0 (type ipaddr) does not match a configured IKE gateway.' )

and ( description contains 'IKE phase-1 negotiation is failed as responder, main mode. Failed SA: 198.160.191.5[500]-173.182.112.167[500] cookie:5357205146f1b40c:a194d23cbec27a50. Due to timeout.' )

I get above in system logs phase 1 is up but phase 2 not

Re: phase 1 up phase 2 down

BPry — Fri, 29 Mar 2019 18:23:45 GMT

@MP18,

Under the IKE Gateway for the tunnel verify that the Local Identification and the Peer Identification are actually matching (in reverse order) for the selected tunnel.

The following is an example:

PA-1:

Local Identification: IP address 10.10.139.230

Peer Identification FQDN (hostname) TEST01

PA-2:

Local Identification: FQDN (hostname) TEST01

Peer Identification: IP address 10.10.139.230

What the log is saying is that essentially the peer device is sending the id of 10.175.150.0 as it's Local Identification, and that ID doesn't match any of your IKE Gateway's configured Peer Identification. Meaning that the firewall doesn't have an IKE Gateway configured for the device.

Re: phase 1 up phase 2 down

MP18 — Fri, 29 Mar 2019 18:57:43 GMT

Got it.

Many Thanks