Troubleshooting Tip: Site-to-Site IPsec VPN phase 1 not forming due to Config ID error message on remote firewall.

Example of Config ID error message on remote firewall:

To troubleshoot this, remove the local ID.

Result: Phase 1 is formed.

Note :

• In a scenario with multiple dial-up IPsec VPN tunnels sharing a single WAN connection, configuring peerID is crucial for directing connections to the correct tunnel, especially when multiple tunnels are involved.
• Without a defined peerID, all connections default to the first tunnel, potentially causing routing issues.
• Additionally, aggressive mode must be enabled in phase 1 settings to facilitate this process, as it allows for more flexible negotiation and identification.
• The local ID, exchanged during phase 1, serves as an additional verification parameter on the remote side, enabling it to filter and permit only connections from specific identities, thereby enhancing security and ensuring proper tunnel association.

Related article:

Troubleshooting Tip: IPsec VPN tunnels

Technical Tip: Use of PeerID and LocalID in IPsec VPN between two FortiGates