Technical Tip: Debug message showing: Ignoring request to establish IPsec SA, gateway is in passive mode

[Rajan_kohli]

Description	This article describes the issue where VPN phase 1 is not coming up for a route-based VPN and the debug logs are showing the message: 'ignoring request to establish IPsec SA, gateway is in passive mode'.
Scope	FortiGate 6.2, 6.4, 7.0, 7.2.
Solution	Disable passive mode in VPN phase 1 setting. Follow the steps given below: # config vpn ipsec phase1-interface     edit phase-1-name <----- Tunnel name.         set passive-mode disable end This setting makes the FortiGate a Responder and will ignore any IKE request if it is being initiated by the FortiGate.