[Document Sharing] IKE SA Negotiation Failed

Created: Sep 28, 2018 13:08:32Latest reply: Sep 28, 2018 13:13:21 902 2 1 0 0

IKE SA Negotiation Failed

Symptom

The IPSec service cannot be normally transmitted. The output of the display ike sa command shows that IKE SA negotiation failed.

The following shows an example of the command output. If the Flag parameter is displayed as RD or RD|ST, an SA is established successfully. ST indicates that the local end is the IKE initiator.

    Conn-ID  Peer            VPN   Flag(s)                Phase                 
  ---------------------------------------------------------------               
    13118    10.1.3.2        0     RD                     v1:2  
    12390    10.1.3.2        0     RD                     v1:1

   Number of IKE SA : 2
  ---------------------------------------------------------------
         
  Flag Description:    
  RD--READY   ST--STAYALIVE   RL--REPLACED   FD--FADING   TO--TIMEOUT
  HRT--HEARTBEAT   LKG--LAST KNOWN GOOD SEQ NO.   BCK--BACKED UP
  M--ACTIVE   S--STANDBY   A--ALONE  NEG--NEGOTIATING

If IKE SA negotiation fails, the Flag parameter is empty, the Peer parameter is 0.0.0.0, or the command output contains no record.

Procedure

Run the display ike proposal command to check whether the IKE peer uses the same IKE proposal.
If not, change IKE proposals on the peer to be the same. If the authentication algorithms in the IKE proposals are different, perform the following operations.
On the IKE initiator:
```
ike proposal 10
 authentication-algorithm sha2-256
```
On the IKE responder:
```
ike proposal 10
 authentication-algorithm sha2-384
```
Run the display ike peer command to check whether the configuration in the peer view is correct.
- Check whether the remote IP address is configured.
  When the ACL mode is used for IPSec tunnel establishment, the remote IP address must be specified for the device in IKE main negotiation mode. In addition, the remote IP addresses specified for the IKE peer must match each other.
  If the IP addresses of the IKE initiator and responder are 10.1.1.2 and 10.2.1.2, the configuration is as follows.
  On the IKE initiator:
```
ike peer mypeer1
 remote-address 10.2.1.2
```
  On the IKE responder:
```
ike peer mypeer2
 remote-address 10.1.1.2
```
  If the IKE responder uses the policy template mode, you do not need to configure the remote IP address for the responder.
- Check whether the pre-shared keys of the IKE peer are the same.
```
ike peer mypeer
 pre-shared-key cipher %^%#JvZxR2g8c;a9FPNn'$7`DEV&=G(=Et02P/%\*!%^%#   //The key is Huawei@123.
```
  If not, change the pre-shared keys to be the same.
- Check whether the IKE proposals referenced by the IKE peer are the same.
  For example, the IKE initiator references IKE proposal 10.
```
ike peer mypeer
 ike-proposal 10
```
  The related configuration of IKE proposal 10 is as follows.
```
ike proposal 10
 encryption-algorithm aes-128
 authentication-algorithm sha2-256 
```
  If the configurations in the IKE proposals are different, change them to be the same.