Troubleshooting Tip: Site-to-Site IPsec VPN phase 1 not forming despite same SA on both local and remote site

To troubleshoot this, make sure firewall policy/policies is/are configured to allow bi-directional traffic from local to remote destinations is configured. It is quite common to omit firewall policy when configuring a Site-to-Site IPsec VPN without using the wizard. 

Before the firewall policy is configured, phase 1 cannot be formed.

After the firewall policy is configured, phase 1 is formed.

Result: Phase 1 is formed.

To better check IPSEC negotiation on the FortiGate, a debugging of the IKE daemon can be run. The below commands can be used:

diagnose vpn ike log-filter dst-addr4 <Remote_GW_IP>
diagnose debug application ike -1
diagnose debug console timestamp enable
diagnose debug enable

To disable:

diagnose debug disable
diagnose debug reset

If both sides are FortiGate Firewalls the debugging needs to be run on both of the devices to get a better overview of the negotiation.
Starting from FortiOS v7.4.1, the 'diagnose vpn ike log-filter dst-addr4' command has been changed to 'diagnose vpn ike log filter rem-addr4'.

Related article:

Troubleshooting Tip: IPsec VPN tunnels