[SRX] How to troubleshoot IKE Phase 2 VPN connection issues

Troubleshooting IKE Phase 2 problems is best handled by reviewing VPN status messages on the responder firewall.

Configure a new syslog file, kmd-logs, to capture relevant VPN status logs on the responder firewall.

# set system syslog file kmd-logs daemon info
# set system syslog file kmd-logs match KMD
# commit

Note: The filename is kmd-logs; it is important that you do not name the file kmd, as the IKE debugs are written to the file kmd.

The match text "KMD" should be in uppercase. The file kmd-logs is written to the /var/log directory. For more information, see KB10097 - [Includes video] How to configure syslog to display VPN status messages.

Attempt to bring the VPN tunnel up again, so that the VPN status messages are logged to the syslog file, kmd-logs.
Run the command show log kmd-logs, and look for Phase 2 errors such as the following:

No proposal chosen

Messages:

Sep 7 09:26:57 kmd[1393]: IKE negotiation failed with error: No proposal chosen. IKE Version: 1, VPN: vpn1 Gateway: ike-gw, Local: 10.10.10.1/500, Remote: 10.10.10.2/500, Local IKE-ID: 10.10.10.1, Remote IKE-ID: 10.10.10.2, VR-ID: 0

Note: If Local and Remote IKE-ID are displayed as "Not-Available," it is a Phase 1 failure message. Refer to KB30548 - IKE Phase 1 VPN status messages for more information.

Action:

Verify the local Phase 2 VPN configuration elements. The Phase 2 proposal elements include the following:

Authentication algorithm

Encryption algorithm

Lifetime kilobytes

Lifetime seconds

Protocol

Perfect Forward Secrecy

Either change the local configuration to accept at least one of the remote peer’s Phase 2 proposals, or contact the remote peer’s admin and arrange for the IKE configurations at both ends of the tunnel to use at least one mutually acceptable Phase 2 proposal.

Traffic-selector mismatch

Messages:

Nov  4 12:24:09   kmd[2531]: KMD_VPN_TS_MISMATCH: Traffic-selector mismatch, vpn name: VPN-1, Peer Proposed traffic-selector local-ip: ipv4(tcp:80,192.168.3.0-192.168.3.255),  Peer Proposed traffic-selector remote-ip: ipv4(tcp,192.168.2.0-192.168.2.255)
Nov  4 12:24:09   kmd[2531]: IPSec negotiation failed with error: Peer proposed traffic-selectors are not in configured range. IKE Version: 1, VPN: VPN-1 Gateway: Gateway, Local: 192.168.1.1/500, Remote: 192.168.1.2/500, Local IKE-ID: 192.168.1.1, Remote IKE-ID: 192.168.1.2, VR-ID: 0

Action:

The proxy-id must be an exact "reverse" match of the peer's configured proxy-id; see KB10124 - [SRX] How to fix the Phase 2 Proxy ID/Traffic-selector mismatch error.

If you are unable to locate any Phase 2 messages, continue to Step 4.

Review the Phase 2 proposals using show security ipsec, and confirm that the configuration matches the Phase 2 proposals configured by the peer.

root@srx210# show security ipsec
proposal ipsec-phase2-proposal {
    protocol esp;
    authentication-algorithm hmac-sha1-96;
    encryption-algorithm aes-128-cbc;
}
policy ipsec-phase2-policy {
    perfect-forward-secrecy {
        keys group2;
    }
    proposals ipsec-phase2-proposal;
}
vpn ike-vpn-srx1 {
    vpn-monitor;
    ike {
        gateway gw-srx1;
        ipsec-policy ipsec-phase2-policy;
    }
}

Enable "per tunnel debug" detailed logging (traceoptions), and analyze the output.

See: KB19943 - How to enable VPN (IKE/IPsec) traceoptions for specific SAs (Security Associations)

If the issue is still not resolved, collect logs and open a case with your technical support representative.

See: KB21781 - [SRX] Data Collection Checklist - Logs/Data to Collect for Troubleshooting

Knowledge Base