Phase 2 tunnel status

[pink-panther]

Please excuse me as I am still learning and am relatively inexperienced. I assume the phase 2 status can be red for following reasons (assuming IKE phase 1 is all correct and working) Authentication, Encryption, DH settings being incorrect/mismatched or lifetime expiring. Are there any other reasons it would be red perhaps to do with remote or local LANs or IPs and could you explain in layman terms?  

[OtakarKlier]

Hello,

You are correct that you can have a good phase 1 and a bad phase 2. Most of the time its a configuration mismatch, could be passphrase.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGkCAK

Hope that helps.

[MP18]

@pink-panther 

Also if local and remote proxy ids does not match that can also cause phase 2 shown as red.

Regards

[aleksandar.astardzhiev]

Hi @pink-panther 

I would disagree with @OtakarKlier. If pre-shared key is wrong phase1 will not be completed. If phase1 is established, this means the pre-shared key (alongwith the rest of phase1 settings) is the same on both ends.

And would agree with @MP18 - most common reason for failing phase2 is local and remote proxy id (encryption domains). But similar to phase1 it could also fail due to Authentication, Encryption or DH settings

[a-techie]

@aleksandar.astardzhiev  Is there an authentication in Phase2? I thought auth piece only happens in the phase1 of the negotiation.

[OtakarKlier]

Yep my bad on that passphrase part.