IKE phase-2 negotiation is failed as initiator, quick mode

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

IKE phase-2 negotiation is failed as initiator, quick mode

L3 Networker

Could someone clarify this error message?

IKE phase-2 negotiation is failed as initiator, quick mode. Failed SA:  216.204.241.93[500]-216.203.80.108[500] message id:0x43D098BB. Due to  negotiation timeout

Thanks

1 ACCEPTED SOLUTION

Accepted Solutions

To add to Jdelio's response, seems PA is initiator in your output. You should be checking on the responder side. Always the responder side will usually show what is failing. If you do not have access to responder IKE peer, then I would suggest to have remote side be the initiator of the tunnel and then check PA side logs to see what is failing.

Most common phase-2 failure is due to proxy-id mismatch. That would be first thing I would check. Also check IPSec crypto to ensure that proposals match on both sides.

-Richard

View solution in original post

3 REPLIES 3

Community Team Member

This error means that Phase 2, IKE negotiation is timing out on UDP 500.

Now, there can be many causes, but here are a couple of things to check.

1. Make sure that your UDP timeout is not dropping the connections before they can reply.. increasing your UDP timeout by 30 seconds.

2. Make sure that your rules are not blocking your traffic. Check Monitor for dropped traffic.

3. Check with your peer, see if they are getting any of the phase 2 communication.

Past this, if you are not getting any where,  Please open up a support case by logging into support.paloaltonetworks.com or calling in at +1-866-898-9087

LIVEcommunity team member
Stay Secure,
Joe
Don't forget to Like items if a post is helpful to you!

To add to Jdelio's response, seems PA is initiator in your output. You should be checking on the responder side. Always the responder side will usually show what is failing. If you do not have access to responder IKE peer, then I would suggest to have remote side be the initiator of the tunnel and then check PA side logs to see what is failing.

Most common phase-2 failure is due to proxy-id mismatch. That would be first thing I would check. Also check IPSec crypto to ensure that proposals match on both sides.

-Richard

Thanks Guys, Proxies it was.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!