Quick troubleshooting view
Phase 1 is established but no usable Phase 2 SA is created.
- different selectors.
- proposal P2.
- Interesting traffic absent.
- Compare selectors.
- Compare proposal.
- Generate traffic.
- Aligning selectors.
- Align P2 parameters.
- Correct roads/policies.
Contextual technician plan
Check local/subnet remote on both sides.
The Vpn tunnel list.The command should complete without an unexpected error and return data consistent with the intended service.
If the result is normal, keep this layer lower in the hypothesis ranking and continue with the next discriminating check.
If the result is abnormal, preserve the output and investigate this layer before making broader changes.
Align encryption, ish and PFS.
Diagnostic debug application ike -1The command should complete without an unexpected error and return data consistent with the intended service.
If the result is normal, keep this layer lower in the hypothesis ranking and continue with the next discriminating check.
If the result is abnormal, preserve the output and investigate this layer before making broader changes.
Test a communication corresponding to the selectors.
The test should establish whether the tunnel is up and whether the required remote network is reachable through the expected route/selectors.
If tunnel and remote IP reachability are correct, lower negotiation/routing hypotheses and test internal DNS or the target service.
If the tunnel or remote network path is missing, keep status/routes/selectors as evidence and correct the exact negotiation, Phase 2 or routing mismatch.
Repeat the same validation test after the correction and confirm the original symptom is gone. Validate stability before closing the incident.
Before changing configuration, record the current value and a way back.
Escalader if the peer-save is not administered or if several tunnels overlap.
Phase 1 is established but no usable Phase 2 SA is created.
Causes probables
- different selectors.
- proposal P2.
- Interesting traffic absent.
Diagnostic étape par étape
- 1
Compare selectors.
Check local/subnet remote on both sides.
- 2
Compare proposal.
Align encryption, ish and PFS.
- 3
Generate traffic.
Test a communication corresponding to the selectors.
Commands utiles
The Vpn tunnel list.Diagnostic debug application ike -1Solutions possibles
- Aligning selectors.
- Align P2 parameters.
- Correct roads/policies.
Escalader if the peer-save is not administered or if several tunnels overlap.