This article describes VPN status messages related to IKE Phase 2 in 12.1X44 and later releases. The messages are confirmed based on 12.1X46-D35 and 12.1X44-D35.

• IKE Phase 2 is not active.
• The remote address of the VPN is not listed in the output of the show security ipsec security-associations command.

The VPN messages described in this article are shown in the syslog. To configure the syslog to display VPN status messages, see KB10097 - How to configure syslog to display VPN status messages.

Run the show log kmd-log command and find the error message.

IPsec proposal mismatch

Messages:

• 12.1X44
  
  No message

• 12.1X46
  
  Sep 7 09:26:57 kmd[1393]: IKE negotiation failed with error: No proposal chosen. IKE Version: 1, VPN: vpn1 Gateway: ike-gw, Local: 10.10.10.1/500, Remote: 10.10.10.2/500, Local IKE-ID: 10.10.10.1, Remote IKE-ID: 10.10.10.2, VR-ID: 0 
  
  Note: If Local and Remote IKE-ID are displayed as "Not-Available," it is a Phase1 failure message. Refer to KB30548 - IKE Phase 1 VPN status messages in 12.1X44 and later releases for more information.
  

Action:

• Authentication algorithm
• Encryption algorithm
• Lifetime kilobytes
• Lifetime seconds
• Protocol
• Perfect Forward Secrecy

Proxy-ID mismatch

Messages:

• 12.1X44
  
  Sep 7 09:23:05 kmd[1334]: IKE Phase-2: Failed to match the peer proxy IDs [p2_remote_proxy_id=ipv4_subnet(any:0,[0..7]=192.168.1.0/24), p2_local_proxy_id=ipv4_subnet(any:0,[0..7]=192.168.3.0/24)] for local ip: 10.10.10.2, remote peer ip:10.10.10.1

• 12.1X46
  
  Sep 7 09:33:07 kmd[1393]: KMD_VPN_TS_MISMATCH: Traffic-selector mismatch, vpn name: vpn1, Peer Proposed traffic-selector local-ip: ipv4(192.168.5.0-192.168.5.255), Peer Proposed traffic-selector remote-ip: ipv4(192.168.3.0-192.168.3.255)
Sep 7 09:33:07 kmd[1393]: IKE negotiation failed with error: TS unacceptable. IKE Version: 1, VPN: test_vpn Gateway: ike-gw, Local: 10.10.10.1/500, Remote: 10.10.10.2/500, Local IKE-ID: 10.10.10.1, Remote IKE-ID: 10.10.10.2, VR-ID: 0

Action:

The proxy-id must be an exact "reverse" match of the peer's configured proxy-id; see KB10124 - How to fix the Phase 2 error: Failed to match the peer proxy IDs.

Note: If the VPN established successfully, the following messages are shown in the syslog:

• 12.1X44

• 12.1X46