IKE Phase-1 Negotiation is Failed as Responder
96124
Created On 09/25/18 19:44 PM - Last Modified 06/07/23 08:29 AM
Resolution
Details
The System Log shows the following error message:
IKE phase-1 negotiation is failed as responder, main mode. Failed SA: 10.1.1.1[500]-10.2.2.2[500] cookie:32718ea3e053bc01:99d432334b1acc03. Due to timeout.
- It is not possible to ping from the VPN gateway IP of the PAN to the VPN gateway IP of the firewall at the other end of the tunnel.
- It is possible to ping from the PAN to the VPN gateway IP of the other firewall if a source IP (PAN VPN gateway IP) is not specified.
- The IPSec VPN is working correctly.
- VPN configuration is correct on both firewalls.
- Security policy configuration is correct on both firewalls.
Resolution
Check the routing table of devices between the firewalls. A route table entry may need to be added or removed to provide proper network connectivity.
owner: jdavis