Troubleshooting Tip: Site-to-Site IPsec VPN phase 2 not forming due to implicit deny, policy 0.

[Oscar_Wee]

Description	This article describes how to resolve Site-to-Site IPsec VPN phase 2 not forming due to implicit deny, policy 0.
Scope	FortiGate.
Solution	To troubleshoot this, make sure the correct IP address is keyed into the firewall address. Example of the problem: In this example: 10.2.71.0/24 has been wrongly configured in the firewall address. This will result in implicit deny, policy 0 as a destination has to be 10.3.71.0/24. Solution: Change the wrong subnet 10.2.71.0/24 to the correct subnet 10.3.71.0/24. Result: There is no more implicit deny, policy 0 detected in the forward log. Site-to-Site IPsec VPN phase 2 is formed. Related article: Troubleshooting Tip: IPsec VPN tunnels