iph1->ivm == NULL

[Ammar]

Dears,

Since two days i am getting this message "iph1->ivm == NULL"  and all VPN with ASA on the other side is facing iKE Phase 1 time out

[kiwi]

Hi @Ammar,

I've seen this error in relation to the ASA sending the PEER ID as FQDN instead of IP.

See if the following DOC can help you :

https://live.paloaltonetworks.com/t5/Configuration-Articles/VPN-Tunnel-Down-Between-Palo-Alto-Networ...

Cheers !

-Kiwi.

[Ammar]

so if that is the case, how can i solve the issue ???

[kiwi]

Hi @Ammar,

Check the crypto settings on the ASA side and confirm if it is configured with FQDN or IP (and change it if you can).

Alternatively, as a workaround you can configure both VPN peers in aggressive mode which might also help.

Note that the info provided is rather slim and I'm basing my answer on the error message you added.

In relation the me having seen this error before, it came together with the following error (which is a clear give-away of the issue):

iph1->ivm == NULL

IKE phase-1 negotiation is failed. Peer's ID payload <some.domain.com>(type fqdn) does not match a configured IKE gateway

Cheers,

-Kiwi

[Ammar]

Hi @kiwi

i think in my case it is different.

i'm geeting this error anlng with a timeout in IKE Phase 1 (however peers are communicating perfectly)

[kiwi]

Hi @Ammar

My example also returned a timeout in IKE-Ph1 :

IKE phase-1 SA is deleted SA: X.X.X.X[500]-X.X.X.X[500] cookie:54ec63e98d074d27:0000000000000000.
04/04 17:09:30
IKE phase-1 negotiation is failed as initiator, aggressive mode. Failed SA: X.X.X.X[500]-X.X.X.X[500] cookie:54ec63e98d074d27:0000000000000000. Due to timeout.
04/04 17:09:30
iph1->ivm == NULL
04/04 17:09:10
IKE phase-1 negotiation is failed. Peer's ID payload <some.domain.com> (type fqdn) does not match a configured IKE gateway.

Cheers,

-Kiwi