Troubleshooting Tip: Site-to-Site IPsec VPN phase 2 not forming due to implicit deny, policy 0.

To troubleshoot this, make sure the correct IP address is keyed into the firewall address.

Example of the problem:

In this example:
10.2.71.0/24 has been wrongly configured in the firewall address. This will result in implicit deny, policy 0 as a destination has to be 10.3.71.0/24.

Solution:
Change the wrong subnet 10.2.71.0/24 to the correct subnet 10.3.71.0/24.

Result:
There is no more implicit deny, policy 0 detected in the forward log. Site-to-Site IPsec VPN phase 2 is formed.

Related article: