- 최신
- 최다 투표
- 가장 많은 댓글
There are specific troubleshooting instructions in this Knowledge base article for VPN Phase2 issues:
https://aws.amazon.com/premiumsupport/knowledge-center/vpn-tunnel-phase-2-ipsec/
Can you clarify if you are using Policy based VPN or Route based VPN, if route based is it Static route based or BGP?
Lastly, are you using IKEv1 or IKEv2?
If you are using IKEv2 you can change the Start-up action for the VPN, see this documentation
Startup action: The action to take when establishing the VPN tunnel for a new or modified VPN connection. By default, your customer gateway device initiates the IKE negotiation process to bring the tunnel up. You can specify that AWS must initiate the IKE negotiation process instead.
To activate both tunnels. The ipsec tunnel config should have overlapip=yes parameter set. By default, it is no.
From ipsec spec,
a boolean (yes/no) that determines, when (left|right)subnet=vhost: is used, if the virtual IP claimed by this states created from this connection can with states created from other connections.
Note that connection instances created by the Opportunistic Encryption or PKIX (x.509) instantiation system are distinct internally. They will inherit this policy bit.
The default is no.
This feature is only available with kernel drivers that support SAs to overlapping conns. At present only the (klips) mast protocol stack supports this feature.
관련 콘텐츠
AWS 공식업데이트됨 2년 전- AWS 공식업데이트됨 9달 전
Hi Tushar, thanks for your reply. The tunnels are Route base, static and we are using IKEv2. We are using a Start-up option of 'Add', but I have tried 'Start' as well with no success. Tunnel 1 works fine for us, as we are only get the error I mentioned above on Tunnel 2. The AWS config for Tunnel 1 matches tunnel 2. Do you happen to know what the error "AWS tunnel was unable to decrypt the security payload(s)" means?
If the configs of tunnel1 and tunnel2 are matching exactly then I suggest to open a Support ticket with AWS and SonicWall.
Ok thanks. I'll go that route.