Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?


How to Analyze IKE Phase 2 VPN Status Messages



Review and analyze VPN status messages related to issues caused by an inactive IKE Phase 2.


  • IKE Phase 2 is not active.

  • The show security ipsec security-associations command output does not list the remote address of the VPN.


The best way to troubleshoot the IKE Phase 2 issues is by reviewing the VPN status messages of the responder firewall.

The responder firewall is the receiver side of the VPN that receives the tunnel setup requests. The initiator firewall is the initiator side of the VPN that sends the initial tunnel setup requests.

  1. Using the CLI, configure a syslog file, kmd-logs, for VPN status logs on the responder firewall.

    See KB10097-How to configure syslog to display VPN status messages. As you bring up the VPN tunnel, the messages are captured in ldm-logs.

  2. Using the CLI, check for Phase 2 error messages: show log kmd-logs

    Sample output messages:

      • Meaning—The device running Junos OS did not accept any of the IKE Phase 2 proposals that the specified IKE peer sent.

      • Action—Verify the local Phase 2 VPN configuration elements. The Phase 2 proposal elements include the following:

        • Authentication algorithm

        • Encryption algorithm

        • Lifetime kilobytes

        • Lifetime seconds

        • Protocol

        • Perfect forward secrecy

      You can change the local configuration to accept at least one of the remote peer’s Phase 2 proposals, or contact the remote peer’s administrator and arrange for the IKE configurations at both ends of the tunnel to use at least one mutually acceptable Phase 2 proposal.

    Sample output messages:

    If the VPN connection is established successfully, you can see the following messages in the syslog:

  3. If you could not locate any Phase 2 messages, proceed to Step 4.

  4. Using the CLI, review the Phase 2 proposals and confirm that the configuration matches the Phase 2 proposals configured by the peer: show security ipsec

  5. If the issue persists, to open a JTAC case with the Juniper Networks support team, see Data Collection for Customer Support for the data you should collect to assist in troubleshooting before opening a JTAC case.