IPsec tunnel doesn't connect - no errors seen

[1treelanedrv]

Hi everyone, do you have any idea why this tunnel will not establish? 

I'm trying to connect with a partner company. The IPsec config is identical across two templates.  Both sites have their own unique public IP and are connecting to the same peer IP on the partner's side. The Secondary_Gateway connects fine. But this Primary_Gateway only shows this in the ikemgr.log.

2025-03-28 10:45:44.375 -0500 debug: sysd_msg_send(daemon/panike_sysd_if.c:2487): iked sysd msg enqueue: ike_debug_handler
2025-03-28 10:45:49.287 -0500 debug: pan_msg_process(daemon/panike_sysd_if.c:2849): iked rcv msg ike_stats_handler(18).
2025-03-28 10:45:49.299 -0500 debug: sysd_msg_send(daemon/panike_sysd_if.c:2487): iked sysd msg enqueue: ike_stats_handler
2025-03-28 10:45:52.404 -0500 debug: pan_msg_process(daemon/panike_sysd_if.c:2849): iked rcv msg ike_stats_handler(18).
2025-03-28 10:45:52.416 -0500 debug: sysd_msg_send(daemon/panike_sysd_if.c:2487): iked sysd msg enqueue: ike_stats_handler
2025-03-28 10:46:03.083 -0500 debug: pan_msg_process(daemon/panike_sysd_if.c:2849): iked rcv msg ike_sa_handler(13).
2025-03-28 10:46:03.084 -0500 [INFO]: { 1: }: Primary_Gateway: IKEv2 SA test initiate start.
2025-03-28 10:46:03.099 -0500 [PNTF]: { 1: }: ====> IKEv2 IKE SA NEGOTIATION STARTED AS INITIATOR, non-rekey; gateway Primary_Gateway <====
====> Initiated SA: 10.1.1.1[500]-10.2.2.2[500] SPI:1a14bc5f2ee04e45:0000000000000000 SN:14 <====
2025-03-28 10:46:03.099 -0500 [DEBG]: { 1: 1}: ikev2_initiate: child_sa created: id 23
2025-03-28 10:46:03.183 -0500 [DEBG]: 10.1.1.1[500] - 10.2.2.2[500]:(nil) 1 times of 248 bytes message will be sent over socket 1024
2025-03-28 10:46:03.183 -0500 debug: sysd_msg_send(daemon/panike_sysd_if.c:2487): iked sysd msg enqueue: ike_sa_handler
2025-03-28 10:46:07.540 -0500 debug: pan_msg_process(daemon/panike_sysd_if.c:2849): iked rcv msg ipsec_sa_handler(14).
2025-03-28 10:46:07.540 -0500 [DEBG]: { 1: 1}: ikev2_initiate: child_sa created: id 24
2025-03-28 10:46:07.541 -0500 debug: sysd_msg_send(daemon/panike_sysd_if.c:2487): iked sysd msg enqueue: ipsec_sa_handler
2025-03-28 10:46:08.001 -0500 [DEBG]: { 1: }: IKEv2 retransmit, child id 0, retry cnt 1 limit 10
2025-03-28 10:46:08.001 -0500 [DEBG]: 10.1.1.1[500] - 10.2.2.2[500]:(nil) 1 times of 248 bytes message will be sent over socket 1024
2025-03-28 10:46:14.841 -0500 debug: pan_msg_process(daemon/panike_sysd_if.c:2849): iked rcv msg ike_sa_handler(13).
2025-03-28 10:46:14.841 -0500 debug: sysd_msg_send(daemon/panike_sysd_if.c:2487): iked sysd msg enqueue: ike_sa_handler
2025-03-28 10:46:18.000 -0500 [DEBG]: { 1: }: IKEv2 retransmit, child id 0, retry cnt 2 limit 10
2025-03-28 10:46:18.000 -0500 [DEBG]: 10.1.1.1[500] - 10.2.2.2[500]:(nil) 1 times of 248 bytes message will be sent over socket 1024
2025-03-28 10:46:18.052 -0500 debug: pan_msg_process(daemon/panike_sysd_if.c:2849): iked rcv msg ipsec_sa_handler(14).
2025-03-28 10:46:18.053 -0500 debug: sysd_msg_send(daemon/panike_sysd_if.c:2487): iked sysd msg enqueue: ipsec_sa_handler
2025-03-28 10:46:21.014 -0500 debug: pan_msg_process(daemon/panike_sysd_if.c:2849): iked rcv msg tunnel_cfg_handler(16).
2025-03-28 10:46:21.014 -0500 debug: sysd_msg_send(daemon/panike_sysd_if.c:2487): iked sysd msg enqueue: tunnel_cfg_handler
2025-03-28 10:46:38.000 -0500 [DEBG]: { 1: }: IKEv2 retransmit, child id 0, retry cnt 3 limit 10

[TomYoung]

Hi @1treelanedrv ,

If you don't see anything under Monitor > Logs > System, the next step is to check if you see the packets under Monitor > Logs > Traffic.  You should see 2-way traffic or drops.  In order to see drops, you may need to Override the interzone-default rule and configure logging.

Thanks,

Tom

[1treelanedrv]

Today I issued "test vpn ike-sa" at 10:24. 

[1treelanedrv]

Well, I only had "logging at end" enabled for this rule. I've enabled "logging at start". Which, as you can imagine, shows the opening of the session. No two-way. I don't think they are responding. 

The other firewall doesn't show any logs even though its VPN shows connected after doing the test vpn ike-sa. haha 

I just don't know. 

I'm meeting with them later today. If we find the fix, I'll update this thread. 

[TomYoung]

Hi @1treelanedrv ,

Correct.  Your System and Traffic logs both confirm no response from the other side.

Thanks,

Tom