Alarms When an IPsec VPN Session or Tunnel Is Down

When an IPsec VPN session or tunnel is down, an alarm is raised and the reason for the Down alarm is displayed on the Alarms dashboard or the VPN page on the NSX Manager user interface.

Solution

Use the following tables to locate the Reason message that you see on the NSX Manager user interface and review the possible cause for the Down alarm. To resolve the alarm, perform the necessary actions listed for the specific Reason message and possible cause for the Down alarm.

Table 1. Causes and Solutions for an IPsec VPN Session Is Down Alarm
Reason for the IPsec VPN Session Down Alarm	Possible Cause	Necessary Actions to Resolve the Alarm Message
`Authentication failed`	The IKE SA establishment between the VPN gateways failed due to a failure in authentication. Authentication of the IKE SA depends on the pre-shared key, Local ID, and Remote ID values.	Verify the `Local ID` and `Remote ID` values. The Local ID value must be set as the Remote ID value in the peer VPN gateway. Verify the `Pre-shared Key` value. It must match exactly in both the VPN gateways.
`No proposal chosen`	The IKE transform configuration in both the local and peer configuration file are inconsistent.	Ensure that the following properties are configured the same for both gateways. `DH groups` `Digest and encryption algorithms`
`Peer sent delete`	The peer gateway initiated a delete case. A `DELETE` payload is received for IKE SA.	To determine why the peer gateway sent a `DELETE` payload, examine the logs in the NSX Edge and on the peer gateway side.
`Peer not responding`	The IKE SA negotiation timed out.	Verify that the remote gateway is up. Verify the connectivity to the remote gateway.
`Invalid syntax`	IKE proposals or transforms are not formed correctly. There are malformed IKE payloads.	To debug the invalid syntax, analyze the logs.
`Invalid spi`	An invalid SPI value was received in the IKE payload.	To debug the invalid SPI value, analyze the logs.
`Configuration failed`	The session configuration realization failed in NSX Edge due to some constraints or certain criteria. The reason is listed in the session dump under `Session_Config_Fail_Reason`.	Resolve the error using the reason displayed in the session dump under `Session_Config_Fail_Reason`.
`Negotiation not started`	The IKE SA negotiation has not started.	Verify that the `Connection Initiation Mode` property in the session configuration is set to `Responder` Verify that the peer configuration has at least one of the gateways set to `Initiator`. .
`IPsec service not active`	Status of the VPN service used for the session is not active.	Verify if the Admin Status in the IPsec VPN service configuration is disabled.
`Session disabled`	Admin has disabled the session.	Enable the session to resolve this error.
`SR state is not Active`	SR is in a standby state.	Verify that the VPN session on the NSX Edge node where HA peer SR is in the Active state.

Table 2. Causes and Solutions for an IPsec VPN Tunnel Is Down Alarm
Reason for the IPsec VPN Tunnel Down Alarm	Possible Cause	Necessary Actions to Resolve the Alarm Message
`Peer sent delete`	The peer gateway sent a `DELETE` payload for the IPSEC SA.	To understand why the peer gateway sent a `DELETE` payload, you must check the logs in both the NSX Edge and in the peer gateway side.
`No proposal chosen`	The ESP transform configuration is not consistent in the configurations for both the local and peer gateways.	Ensure that the following properties are configured the same for both gateways. `DH groups` `Digest and encryption algorithms` The `PFS` is activated or not.
`TS unacceptable`	The IPsec SA setup has failed due to a mismatch in the policy rule definition between the gateways for the tunnel configuration.	Check the local and remote network configuration on both gateways.
`IKE SA down`	The IKE SA session is down.	Check the session down reason listed in the logs and resolve the errors.
`Invalid syntax`	The proposals or transforms are not formed correctly. There are malformed payloads.	To debug the invalid syntax, analyze the logs.
`Invalid spi`	An invalid SPI value was received in the ESP payload.	To debug the invalid SPI value, analyze the logs.
`No IKE peers`	All IKE peers are dead. There are no peer gateways left with whom to try to establish a connection.	Check if the remote gateway is up. Check the connectivity to the configured peer gateways.
`IPsec negotiation not started`	The IPsec SA negotiation has not started.	The IKE SA is not up yet. Check the session down reason listed in the logs and resolve the errors.