IKE phase-2 negotiation is failed as initiator, quick mode

[LCMember1607]

Could someone clarify this error message?

IKE phase-2 negotiation is failed as initiator, quick mode. Failed SA:  216.204.241.93[500]-216.203.80.108[500] message id:0x43D098BB. Due to  negotiation timeout

Thanks

[jdelio]

This error means that Phase 2, IKE negotiation is timing out on UDP 500.

Now, there can be many causes, but here are a couple of things to check.

1. Make sure that your UDP timeout is not dropping the connections before they can reply.. increasing your UDP timeout by 30 seconds.

2. Make sure that your rules are not blocking your traffic. Check Monitor for dropped traffic.

3. Check with your peer, see if they are getting any of the phase 2 communication.

Past this, if you are not getting any where,  Please open up a support case by logging into support.paloaltonetworks.com or calling in at +1-866-898-9087

[Retired Member · Accepted solution]

To add to Jdelio's response, seems PA is initiator in your output. You should be checking on the responder side. Always the responder side will usually show what is failing. If you do not have access to responder IKE peer, then I would suggest to have remote side be the initiator of the tunnel and then check PA side logs to see what is failing.

Most common phase-2 failure is due to proxy-id mismatch. That would be first thing I would check. Also check IPSec crypto to ensure that proposals match on both sides.

-Richard

[LCMember1607]

Thanks Guys, Proxies it was.