topic Re: Phase 2 tunnel status in General Topics

Phase 2 tunnel status

pink-panther — Fri, 09 Jul 2021 09:18:52 GMT

Please excuse me as I am still learning and am relatively inexperienced. I assume the phase 2 status can be red for following reasons (assuming IKE phase 1 is all correct and working) Authentication, Encryption, DH settings being incorrect/mismatched or lifetime expiring. Are there any other reasons it would be red perhaps to do with remote or local LANs or IPs and could you explain in layman terms?

Re: Phase 2 tunnel status

OtakarKlier — Fri, 09 Jul 2021 17:27:25 GMT

Hello,

You are correct that you can have a good phase 1 and a bad phase 2. Most of the time its a configuration mismatch, could be passphrase.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGkCAK

Hope that helps.

Re: Phase 2 tunnel status

MP18 — Sat, 10 Jul 2021 04:33:23 GMT

@pink-panther

Also if local and remote proxy ids does not match that can also cause phase 2 shown as red.

Regards

Re: Phase 2 tunnel status

aleksandar.astardzhiev — Sun, 11 Jul 2021 15:48:35 GMT

Hi @pink-panther

I would disagree with @OtakarKlier. If pre-shared key is wrong phase1 will not be completed. If phase1 is established, this means the pre-shared key (alongwith the rest of phase1 settings) is the same on both ends.

And would agree with @MP18 - most common reason for failing phase2 is local and remote proxy id (encryption domains). But similar to phase1 it could also fail due to Authentication, Encryption or DH settings

Re: Phase 2 tunnel status

a-techie — Mon, 12 Jul 2021 18:06:14 GMT

@aleksandar.astardzhiev Is there an authentication in Phase2? I thought auth piece only happens in the phase1 of the negotiation.

Re: Phase 2 tunnel status

OtakarKlier — Mon, 12 Jul 2021 18:41:09 GMT

Yep my bad on that passphrase part.