IPSEC GUI shows green for both phase 1 and 2 - Need to restart the ipsec to ping across the ipsec

[MP18]

Gui shows both phase 1 and 2 up.

Can not ping lan IP at vendor end.

when i ping vendor lan ip 

i see below

( description contains 'IKE phase-2 negotiation failed when processing proxy ID. cannot find matching phase-2 tunnel for received proxy ID. received local id: 0.0.0.0/0 type IPv4_subnet protocol 0 port 0, received remote id: 192.168.46.32/28 type IPv4_subnet protocol 0 port 0.' )

I need to restart the phase 2 from gui to make it work

Need to know why every time i need to retstart the phase 2 to make this work?

PA has this proxy is 

Local 10.0.0.0/8

Remote 192.168.46.32/28

[Remo · Accepted solution]

Hi @MP18 

Looks like the other end has configured the wrong proxy ID for your subnet. Instead of 10.0.0.0/8 they configured 0.0.0.0/0 or nothing is also possible and because of that they accept when you start the phase 2 tunnel but your firewall does not accept what the offer in the phase 2 negotiation.

[MP18]

You are spot on