Informational Exchange Received Delete IKE-SA from Peer: xx.xx.xx.xx

[Sangeeth_N]

Hi

I am trying to establish a VPN with an interoperable device[Sophos]. As checked, all the VPN parameters are matching. 

The VPN itself is not getting established and I am able to find the below mentioned log in SmartLog :

Informational Exchange Received Delete IKE-SA from Peer: xx.xx.xx.xx; Cookies: xxxxxxxxxxxxxxxxxxxxxxxxxxx

Any idea regarding why this issue  occurred.

[Marco_Valenti]

you should be able to find the causing issue with vpn debug ikeon (turn it off with vpn debug ikeoff) and the opening relevant file (ike.elg) with checkpoint ikeview and see if there are any kind of problem regarding phase 2

[Sangeeth_N]

Hi  @Marco_Valenti 

I am only able to find phase1 info,  as below :

[Sangeeth_N]

I am only able to find phase1 info. Couldn't find any phase2 related info from ike.elg file 

[Marco_Valenti]

Try to generate some traffic if you can' t have a phase 2 established check the encryption domain for both gateway involved and vpn community , verify there are no nat rule that match this kind of traffic if there are no need for nat

[Timothy_Hall]

Please click the "+" sign next to "P1" and post another screenshot so we can see how far you are getting in Phase 1.  If Phase 1 is completely succeeding but is immediately followed by a "Delete SA" notification, check the Phase 1 and Phase 2 SA Lifetime timers and make sure they match exactly on both sides.  Note that the Phase 1 timer is expressed in minutes on the Check Point and the Phase 2 timer is expressed in seconds, while most other vendors express both values in seconds.

[Sangeeth_N]

Hi @Timothy_Hall 

Please find the screenshot as below :

[Timothy_Hall · Accepted solution]

You made it all the way through IKE Phase 1 as I suspected, then the Delete SA happened immediately after.   Your SA Lifetime timers for Phase 1 and/or Phase 2 do not match, check them on both sides.

[Matlu]

Hello, @Timothy_Hall 

One question, please.

This type of logs that you can see in the SmartConsole, is an "evidence" that this VPN is "down"?

The strange thing is that when I go to the DashBoard of "Tunnel & User Monitoring", I see this VPN up, as if it was working fine.

Cheers. 🙂

[Timothy_Hall · Accepted solution]

All that means is that you sent an encrypted packet to your peer with an SPI it did not recognize because the tunnel associated with that particular SPI no longer exists on the peer end.  In response the peer sends your firewall a "Delete SA" telling your firewall to delete it on that end.  So the particular tunnel you tried to send to with a nonexistent SPI is "down", yes.  But when some interesting traffic arrives on either end the tunnel should come back up, unless the tunnel can only be initiated in one direction.  However Delete SAs don't really work right in an interoperable scenario, so your firewall's SmartView Monitor will show a VPN tunnel as "up" even though the peer thinks it is down.

Any time you set up a new VPN you need to ensure that either peer can successfully initiate a working tunnel from scratch.  Due to a subnets/Proxy-ID mismatch it is all too common that the VPN can only be successfully initialized in one direction.  So if the interesting traffic arrives at the side that is unable to initiate a working tunnel, the VPN will be down until the other side receives some interesting traffic and tries to bring it up from that end.  Once a tunnel is up and working it generally does not matter which side initiated it, the tunnel will be 2-way for purposes of passing traffic.