Site to Site VPN Phase 2 Down

Question

Site to site VPN, when trying to establish connection with customer gateway - IKE Phase 1 is established, but IKE phase 2 is down. In the logs - 
{
    "event_timestamp": 1690951183,
    "details": "received packet: from XXXXXX [UDP 4500] to XXXXXXXX [UDP 4500] (92 bytes)",
    "dpd_enabled": true,
    "nat_t_detected": true,
    "ike_phase1_state": "established",
    "ike_phase2_state": "down"
}

Customer Gateway Configuration
![Customer Gateway Configuration](/media/postImages/original/IMyAw3uwPORMqzHEeJEKMAcg)

Aws Tunnel Configuration
![Aws Tunnel Configuration](/media/postImages/original/IM-lfTFVytRL-Ps-lBvTLKLw)

Why is the phase 2 connection not getting established.

Accepted Answer

According to the screenshot of the configuration on Customer Gateway that you provided, the Perfect Forward Secrecy (PFS) is disabled. You must enable it on the Customer Gateway. It is [one of the requirements](https://docs.aws.amazon.com/vpn/latest/s2svpn/your-cgw.html#CGRequirements) to establish IKE Phase 2.

Answer

The following documents are common troubleshooting methods.  
Common cases are that the DH Group numbers do not match and the connection fails, etc.  
By the way, is it possible to check the VPN logs and other information on the Customer Gateway?  
Perhaps there is some error message that can be helpful in the investigation.  
https://repost.aws/knowledge-center/vpn-tunnel-phase-2-ipsec

Answer

Check the DPD (Dead Peer Detection) settings on your customer gateway.
https://repost.aws/knowledge-center/vpn-tunnel-instability-inactivity

Site to Site VPN Phase 2 Down

Contenido relevante