IPsec VPN tunnel between 501e and Cisco ASA 5516

[chasby]

I'm working to set up an IPsec tunnel between a 501e running 6.4.6 firmware and a Cisco 5516.  We're using 3DES/SHA1/DH Grp2 for both Phase 1 and Phase 2.  The Fortigate show the tunnel comes up and looks normal, but if we initiate communications from the Fortigate side they fail and the Cisco reports encapsulation errors on Phase2.  However if communications initiate from the Cisco side things work fine.

We've checked settings, routing, and policies on both sides and they seem to match.

Anyone have any suggestions on what else to check or try?

[vinisantos_FTNT]

Would you have additional information about the error on the Cisco side? What's the log exactly?
Based on what you wrote, it sounds like it might be caused by a parameter set by Cisco that FortiGate isn't setting or not taking into account for incoming connections as well as not setting it outbound and that's when Cisco doesn't like the flow.

Phase 1 uses one bi-directional SA - which they agree on - while Phase 2 uses two, one for each traffic direction.
Due to the difference, Cisco is most likely getting a hash for the SA it doesn't expect/like.

I would review the defaults i.e.: show full
I'd also use "diag debug application ike -1" to confirm details of what is being sent and received in real-time.
"diagnose vpn tunnel list name <TUNNEL_NAME>" provides SA information about the tunnel.
"get vpn ipsec tunnel details" shows Phase 1 and Phase 2 parameter details.

I'd try and use that to match the config on the Cisco side to start.

[chasby]

Console output:

Prod_SDWan-Primary # di de enable

Prod_SDWan-Primary # ike shrank heap by 159744 bytes
ike 0: comes 69.164.108.84:500->198.199.186.2:500,ifindex=16....
ike 0: IKEv1 exchange=Informational id=29b3c2326c524812/e050cb7e26bc4450:6f1c3cd8 len=84
ike 0: in 29B3C2326C524812E050CB7E26BC4450081005016F1C3CD8000000545944243CBFFBC2AD4DC4047B8FF7DBE940605BB3D43127239A512B4CC7A0ED44884F169A
F4C5C3C4ED679FB2792C7428C694A180AB9B7CFD
ike 0:2ndReachTele:5128248: dec 29B3C2326C524812E050CB7E26BC4450081005016F1C3CD8000000540B00001870CF6A736B1D4F7066B3CFECE6FAD54397CF79EE00
0000200000000101108D2829B3C2326C524812E050CB7E26BC4450068B8901
ike 0:2ndReachTele:5128248: notify msg received: R-U-THERE
ike 0:2ndReachTele:5128248: enc 29B3C2326C524812E050CB7E26BC445008100501D7A93469000000540B0000187A8EC6F98113D497E90EBB602EEE750DDB2B34AC00
0000200000000101108D2929B3C2326C524812E050CB7E26BC4450068B8901
ike 0:2ndReachTele:5128248: out 29B3C2326C524812E050CB7E26BC445008100501D7A934690000005CF405658630CBC93AAFE57E364F7461E61FDB4FCFA5FC45A868
E297B4551168EA5865BA7817EF917C2DB8DF92509A1646EF06D9A94917232524CA334FA6F08CBE
ike 0:2ndReachTele:5128248: sent IKE msg (R-U-THERE-ACK): 198.199.186.2:500->69.164.108.84:500, len=92, id=29b3c2326c524812/e050cb7e26bc44
50:d7a93469
ike 0:2ndReachTele:2ndReachTele:16: admin flush IPsec SA
ike 0:2ndReachTele: flushing 2ndReachTele
ike 0:2ndReachTele: deleting IPsec SA with SPI 707d6adc
ike 0:2ndReachTele:2ndReachTele: deleted IPsec SA with SPI 707d6adc, SA count: 0
ike 0:2ndReachTele: sending SNMP tunnel DOWN trap for 2ndReachTele
ike 0:2ndReachTele:5128248: send IPsec SA delete, spi 3d44d20e
ike 0:2ndReachTele:5128248: enc 29B3C2326C524812E050CB7E26BC445008100501E39BAE58000000440C0000187607BBD53693405372E57C4C83055A851DA2C6EA00
00001000000001030400013D44D20E
ike 0:2ndReachTele:5128248: out 29B3C2326C524812E050CB7E26BC445008100501E39BAE580000004C83767F48CD026C416F795B99050FB177C146A86662ECE3057A
C7FDBD3A153095B362F02D702EDDF69D5B2CC0E4B68BCD
ike 0:2ndReachTele:5128248: sent IKE msg (IPsec SA_DELETE-NOTIFY): 198.199.186.2:500->69.164.108.84:500, len=76, id=29b3c2326c524812/e050c
b7e26bc4450:e39bae58
ike 0:2ndReachTele:2ndReachTele: sending SNMP tunnel DOWN trap
ike 0:2ndReachTele: flushed 2ndReachTele
ike 0: comes 69.164.108.84:500->198.199.186.2:500,ifindex=16....
ike 0: IKEv1 exchange=Informational id=29b3c2326c524812/e050cb7e26bc4450:d8d0cacb len=84
ike 0: in 29B3C2326C524812E050CB7E26BC445008100501D8D0CACB000000547A3FCEB251229D9E89AB768F1B3D452C8C0CA75BCDF579608EB3E3159E89919D4E29E524
E0AFA150D9D07E942161298C8B306E16C6C68A5A
ike 0:2ndReachTele:5128248: dec 29B3C2326C524812E050CB7E26BC445008100501D8D0CACB000000540C00001869A3BE5199F2AE994B12952C8675C814D11DE1C900
00001C000000010110000129B3C2326C524812E050CB7E26BC445000000000
ike 0:2ndReachTele:5128248: recv ISAKMP SA delete 29b3c2326c524812/e050cb7e26bc4450
ike 0:2ndReachTele: deleting
ike 0:2ndReachTele: flushing
ike 0:2ndReachTele: flushed
ike 0:2ndReachTele:5128248: HA send IKE SA del 29b3c2326c524812/e050cb7e26bc4450
ike 0:2ndReachTele: deleted
ike 0:2ndReachTele: set oper down
ike shrank heap by 159744 bytes
ike 0:2ndReachTele:2ndReachTele: IPsec SA connect 16 198.199.186.2->69.164.108.84:0
ike 0:2ndReachTele:2ndReachTele: config found
ike 0:2ndReachTele: created connection: 0x14b53aa0 16 198.199.186.2->69.164.108.84:500.
ike 0:2ndReachTele: IPsec SA connect 16 198.199.186.2->69.164.108.84:500 negotiating
ike 0:2ndReachTele: no suitable ISAKMP SA, queuing quick-mode request and initiating ISAKMP SA negotiation
ike 0:2ndReachTele:5128333: initiator: main mode is sending 1st message...
ike 0:2ndReachTele:5128333: cookie fee4654dfddf5c7f/0000000000000000
ike 0:2ndReachTele:5128333: out FEE4654DFDDF5C7F00000000000000000110020000000000000000A80D00003800000001000000010000002C010100010000002401
010000800B0001000C000400015180800100058003000180020002800400020D000014AFCAD71368A1F1C96B8696FC775701000D0000144048B7D56EBCE88525E7DE7F00D6
C2D30D0000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000000000148299031757A36082C6A621DE00000000
ike 0:2ndReachTele:5128333: sent IKE msg (ident_i1send): 198.199.186.2:500->69.164.108.84:500, len=168, id=fee4654dfddf5c7f/00000000000000
00
ike 0: comes 69.164.108.84:500->198.199.186.2:500,ifindex=16....
ike 0: IKEv1 exchange=Identity Protection id=fee4654dfddf5c7f/ea866476789d8536 len=108
ike 0: in FEE4654DFDDF5C7FEA866476789D853601100200000000000000006C0D00003800000001000000010000002C0101000100000024010100008001000580020002
8004000280030001800B0001000C000400015180000000184048B7D56EBCE88525E7DE7F00D6C2D3C0000000
ike 0:2ndReachTele:5128333: initiator: main mode get 1st response...
ike 0:2ndReachTele:5128333: VID FRAGMENTATION 4048B7D56EBCE88525E7DE7F00D6C2D3C0000000
ike 0:2ndReachTele:5128333: negotiation result
ike 0:2ndReachTele:5128333: proposal id = 1:
ike 0:2ndReachTele:5128333: protocol id = ISAKMP:
ike 0:2ndReachTele:5128333: trans_id = KEY_IKE.
ike 0:2ndReachTele:5128333: encapsulation = IKE/none
ike 0:2ndReachTele:5128333: type=OAKLEY_ENCRYPT_ALG, val=3DES_CBC.
ike 0:2ndReachTele:5128333: type=OAKLEY_HASH_ALG, val=SHA.
ike 0:2ndReachTele:5128333: type=AUTH_METHOD, val=PRESHARED_KEY.
ike 0:2ndReachTele:5128333: type=OAKLEY_GROUP, val=MODP1024.
ike 0:2ndReachTele:5128333: ISAKMP SA lifetime=86400
ike 0:2ndReachTele:5128333: out FEE4654DFDDF5C7FEA866476789D85360410020000000000000000B40A000084C04332E25DF088E003E6CB9E014B3DD499F78C2D49
9C550BF549C71E73DE95ED57D0028DCB19A848EA1EED1CE475FA56F3AEBE2116C0DADA8C1D65FA6DD240410D07D04763F7DF33AA0AAF8ADB5D96C104F54DF1F33A12FBF6C0
1DD5D02B43F61C8A55CFA80FEAE8A85AB6AC60E8006EA6D67D25F4E9BA20845616755A7CCAE000000014B0DDBFC41370F457B3E4DFFA0DC2EA29
ike 0:2ndReachTele:5128333: sent IKE msg (ident_i2send): 198.199.186.2:500->69.164.108.84:500, len=180, id=fee4654dfddf5c7f/ea866476789d85
36
ike 0: comes 69.164.108.84:500->198.199.186.2:500,ifindex=16....
ike 0: IKEv1 exchange=Identity Protection id=fee4654dfddf5c7f/ea866476789d8536 len=256
ike 0: in FEE4654DFDDF5C7FEA866476789D85360410020000000000000001000A000084AACA6A37163E96CCEDE25BDDFE40D811AAA3F0A76E4936761950CD65B13A7DE4
BA6D52A4DA91B8973003861CDEE650F7CC81C93338CB236909AD34F1F5E003B6174EC9E13961A658A42D67DB85DF7D3D0723B8E4F0A3FB86F9384B7324C7C9A677CF9CDC1C
F1906BC1DDA24FDEA30F65EA9A873C8589CC96E6B5DF59FA6440A80D0000182DBCE9C8C490B17CBD4FAF404ED1A237BE2E722B0D00001412F5F28C457168A9702D9FE274CC
01000D00000C09002689DFD6B7120D0000141F41C36B789C8536D2CFC4BEECF9C927000000141F07F70EAA6514D3B0FA96542A500100
ike 0:2ndReachTele:5128333: initiator: main mode get 2nd response...
ike 0:2ndReachTele:5128333: VID CISCO-UNITY 12F5F28C457168A9702D9FE274CC0100
ike 0:2ndReachTele:5128333: peer supports UNITY
ike 0:2ndReachTele:5128333: VID draft-ietf-ipsra-isakmp-xauth-06.txt 09002689DFD6B712
ike 0:2ndReachTele:5128333: VID unknown (16): 1F41C36B789C8536D2CFC4BEECF9C927
ike 0:2ndReachTele:5128333: VID unknown (16): 1F07F70EAA6514D3B0FA96542A500100
ike 0:2ndReachTele:5128333: nat unavailable
ike 0:2ndReachTele:5128333: ISAKMP SA fee4654dfddf5c7f/ea866476789d8536 key 24:360F8871315C4A94036B2171437DA638B4EE5A5338CE09A7
ike 0:2ndReachTele:5128333: add INITIAL-CONTACT
ike 0:2ndReachTele:5128333: enc FEE4654DFDDF5C7FEA866476789D853605100201000000000000005C0800000C01000000C6C7BA020B0000186BA1BA4EE839822FE5
32796FC61C8A7F18B1A1700000001C0000000101106002FEE4654DFDDF5C7FEA866476789D8536
ike 0:2ndReachTele:5128333: out FEE4654DFDDF5C7FEA866476789D853605100201000000000000006496A4776685B772BA7BA8D4FEE18AA9B0B1929CBA80FDA0A2CB
421E0E1EA689412E1B24A5EE77F155F16CEE0C6AE3027985A5FDB04ADDEDE5E9EDE6BCEAAD3042C2143EC31BB768DB
ike 0:2ndReachTele:5128333: sent IKE msg (ident_i3send): 198.199.186.2:500->69.164.108.84:500, len=100, id=fee4654dfddf5c7f/ea866476789d85
36
ike 0: comes 69.164.108.84:500->198.199.186.2:500,ifindex=16....
ike 0: IKEv1 exchange=Identity Protection id=fee4654dfddf5c7f/ea866476789d8536 len=84
ike 0: in FEE4654DFDDF5C7FEA866476789D853605100201000000000000005474E9789885285EDABB902110C09416A3EFE778DB7D87A4E5B706E426D128AB54EA1EEAFB
6AE03CD55276D681FD9E18F993593AC4EE81FB3C
ike 0:2ndReachTele:5128333: initiator: main mode get 3rd response...
ike 0:2ndReachTele:5128333: dec FEE4654DFDDF5C7FEA866476789D85360510020100000000000000540800000C011101F445A46C540D000018CD6AEEC184B3A26686
57453BF0742E0EB00DC76700000014AFCAD71368A1F1C96B8696FC77570100
ike 0:2ndReachTele:5128333: VID DPD AFCAD71368A1F1C96B8696FC77570100
ike 0:2ndReachTele:5128333: DPD negotiated
ike 0:2ndReachTele:5128333: peer identifier IPV4_ADDR 69.164.108.84
ike 0:2ndReachTele:5128333: PSK authentication succeeded
ike 0:2ndReachTele:5128333: authentication OK
ike 0:2ndReachTele:5128333: established IKE SA fee4654dfddf5c7f/ea866476789d8536
ike 0:2ndReachTele:5128333: check peer route: if_addr4_rcvd=0, if_addr6_rcvd=0
ike 0:2ndReachTele: HA send IKE connection add 198.199.186.2->69.164.108.84
ike 0:2ndReachTele:5128333: HA send IKE SA add fee4654dfddf5c7f/ea866476789d8536
ike 0:2ndReachTele: set oper up
ike 0:2ndReachTele:5128333: initiating pending Quick-Mode negotiations
ike 0:2ndReachTele:5128333: cookie fee4654dfddf5c7f/ea866476789d8536:f981566d
ike 0:2ndReachTele:5128333:2ndReachTele:5398860: initiator selectors 0 0:172.20.24.216:0:0->0:10.86.0.20:0:0
ike 0:2ndReachTele:5128333: enc FEE4654DFDDF5C7FEA866476789D853608102001F981566D0000011C01000018DBE932B17922EECA433EA5A5ADF20CF55AEA88CC0A
00003800000001000000010000002C010304013D44D20F0000002001030000800100010002000400015180800400018005000280030002040000148EABF31C4159AEF10EA1
AFD450F55E5A05000084085E5DF4104EEBBF4583D1F8851897DFA0D58ACAD59EF68922284F5B7CD0E2D94F29F5E8353A8B66CDE018417ED6C1027F819D59E2A29E5F9E8568
5D7C96BB6EB0E0DF49265679E4ADF57C39F265FEB5EA8974B94CCEC96ED6C0BAE5072CFBBC290FEF62F95D51642FEB47847264C04E07EA78A80C4186A451E9E36CFF584904
0500000C01000000AC1418D80000000C010000000A560014
ike 0:2ndReachTele:5128333: out FEE4654DFDDF5C7FEA866476789D853608102001F981566D000001247F2DE7F540FE50B2D92CE138BFFC319391E85E3638EC1BF700
8780528EA4C3BFD7CE70A0319BA7D5B1DD334E1509A3B0F6681F9B3CC5436B878D2B41722DF2DE24CA38A0932C87B22CE8779F4F8248A35AC396A39C967B1A86E5BC1AF52E
6BAA87317E73DC68FF2B4D0FAA1FD9A9BB4CD13959E595B7704C9488063DEF8E3927F1D044FBD110963CDE3C65FCDA9D162330F752F96A08A3457F51797380D1115D55FB09
E871F5AFE1D9CF5C5C2848DD7046A05972A7376BCCBC151171F1F58ACF4DB00C7F8ED1762D0FF3D155B29C61BD3AF704C7436D017747F78789B84C73BBE4B9D862613E94E1
18EDDB37FB33E140BC00EC10BB179740A03154A26281B28989D41A5DCBBAB04C
ike 0:2ndReachTele:5128333: sent IKE msg (quick_i1send): 198.199.186.2:500->69.164.108.84:500, len=292, id=fee4654dfddf5c7f/ea866476789d85
36:f981566d
ike 0: comes 69.164.108.84:500->198.199.186.2:500,ifindex=16....
ike 0: IKEv1 exchange=Quick id=fee4654dfddf5c7f/ea866476789d8536:f981566d len=324
ike 0: in FEE4654DFDDF5C7FEA866476789D853608102001F981566D00000144CFD81C98B0BAF563E62AE5EFE79DA17E809AD57FCA75F5A0E5BF640ED697BC2DAA3C7D1C
B2E8CD5AB04C037AFD65D67F012E3A2D3787A89EFDEB9CA478B76351667EBC961B67B5B376AD820B959A4DBBC729B7C86125F41D3481F38E360F142B5C39D2185FBFA98763
67F71C9341216BAFA1F628ACD6B3919DD5EF4D4C3C17AD01C1A6E587835279801456150068A1004F7FA1E8E3CD3BAC9EAEED216A9BB5A83BF2FF4586CB046C6F50A2A3B6BA
4E49DBC33DF77E4D1CE042A7FDC1B5EF72E245AD53AA563EF3F8E57A50F7FFA4DAF971D08161C6F904859B43CF13FB73433B0B132AF21218CF48334E8B8A56AF6692520A5C
B8CA4EC040DBFC1567116D0704728F32CE615DA7F4F8618AB6983C455133407A6C14C26D2BD00528FE217B908673AA84DFC4429B90
ike 0:2ndReachTele:5128333: dec FEE4654DFDDF5C7FEA866476789D853608102001F981566D0000014401000018B9A4065900385C1E6103980ED02D86057993D8E50A
00003800000001000000010000002C010304014B323EB40000002001030000800100010002000400015180800400018005000280030002040000180E31980BD74551910DF7
A9B67597B1EF9AB4A56C05000084A567B9A69E5FD20C33DD1DA669B451D14B3DF54D5E083B0CA2833994F1E985CF80F4BDA8CA4E40332295611DC65EC221CE974B5E39F457
2D63FBE5CDF0B4959F3CF3C13D534481141BF406D12E3198661A370A4C1985F8AD87FCFD7DD4110CED4DA953AEDEAF18FF992D6CCBC7CA9ACCCBE7104B181DBBD51CBFD6E9
E4ED73C50500000C01000000AC1418D80B00000C010000000A5600140000002400000001030460004B323EB48001000180027080800100020002000400465000
ike 0:2ndReachTele:5128333: received p2 notify type RESPONDER-LIFETIME
ike 0:2ndReachTele:5128333:2ndReachTele:5398860: responder selectors 0:172.20.24.216:0->0:10.86.0.20:0
ike 0:2ndReachTele:5128333:2ndReachTele:5398860: my proposal:
ike 0:2ndReachTele:5128333:2ndReachTele:5398860: proposal id = 1:
ike 0:2ndReachTele:5128333:2ndReachTele:5398860: protocol id = IPSEC_ESP:
ike 0:2ndReachTele:5128333:2ndReachTele:5398860: PFS DH group = 2
ike 0:2ndReachTele:5128333:2ndReachTele:5398860: trans_id = ESP_3DES
ike 0:2ndReachTele:5128333:2ndReachTele:5398860: encapsulation = ENCAPSULATION_MODE_TUNNEL
ike 0:2ndReachTele:5128333:2ndReachTele:5398860: type = AUTH_ALG, val=SHA1
ike 0:2ndReachTele:5128333:2ndReachTele:5398860: incoming proposal:
ike 0:2ndReachTele:5128333:2ndReachTele:5398860: proposal id = 1:
ike 0:2ndReachTele:5128333:2ndReachTele:5398860: protocol id = IPSEC_ESP:
ike 0:2ndReachTele:5128333:2ndReachTele:5398860: PFS DH group = 2
ike 0:2ndReachTele:5128333:2ndReachTele:5398860: trans_id = ESP_3DES
ike 0:2ndReachTele:5128333:2ndReachTele:5398860: encapsulation = ENCAPSULATION_MODE_TUNNEL
ike 0:2ndReachTele:5128333:2ndReachTele:5398860: type = AUTH_ALG, val=SHA1
ike 0:2ndReachTele:5128333:2ndReachTele:5398860: RESPONDER-LIFETIME payload found, ESP life time is changed to 28800s.
ike 0:2ndReachTele:5128333:2ndReachTele:5398860: replay protection enabled
ike 0:2ndReachTele:5128333:2ndReachTele:5398860: SA life soft seconds=28501.
ike 0:2ndReachTele:5128333:2ndReachTele:5398860: SA life hard seconds=28800.
ike 0:2ndReachTele:5128333:2ndReachTele:5398860: IPsec SA selectors #src=7 #dst=1
ike 0:2ndReachTele:5128333:2ndReachTele:5398860: src 0 4 0:172.20.24.216/255.255.255.255:0
ike 0:2ndReachTele:5128333:2ndReachTele:5398860: src 1 4 0:172.19.255.7/255.255.255.255:0
ike 0:2ndReachTele:5128333:2ndReachTele:5398860: src 2 4 0:172.20.24.76/255.255.255.255:0
ike 0:2ndReachTele:5128333:2ndReachTele:5398860: src 3 4 0:172.20.112.98/255.255.255.255:0
ike 0:2ndReachTele:5128333:2ndReachTele:5398860: src 4 4 0:172.20.24.77/255.255.255.255:0
ike 0:2ndReachTele:5128333:2ndReachTele:5398860: src 5 4 0:172.20.24.75/255.255.255.255:0
ike 0:2ndReachTele:5128333:2ndReachTele:5398860: src 6 4 0:10.179.0.146/255.255.255.255:0
ike 0:2ndReachTele:5128333:2ndReachTele:5398860: dst 0 4 0:10.86.0.20/255.255.255.255:0
ike 0:2ndReachTele:5128333:2ndReachTele:5398860: add IPsec SA: SPIs=3d44d20f/4b323eb4
ike 0:2ndReachTele:5128333:2ndReachTele:5398860: IPsec SA dec spi 3d44d20f key 24:6D7A52DE5D55D56E64EE3074A788D3171EAFCB278DE8C8A6 auth 20
:70DAF439FD450BD6D59B08A19199D32CEDD14715
ike 0:2ndReachTele:5128333:2ndReachTele:5398860: IPsec SA enc spi 4b323eb4 key 24:F9AFB2532B7CEC3D5AF5DD1BD5684D66F738CD0714D38028 auth 20
:8F9CCDA7BEEAD04519946FE1EE30A65AA44DE5E1
ike 0:2ndReachTele:5128333:2ndReachTele:5398860: added IPsec SA: SPIs=3d44d20f/4b323eb4
ike 0:2ndReachTele:5128333:2ndReachTele:5398860: sending SNMP tunnel UP trap
ike 0:2ndReachTele:5128333: enc FEE4654DFDDF5C7FEA866476789D853608102001F981566D0000003400000018CB882425DF971B670BDA6863E6978C9856B95D86
ike 0:2ndReachTele:5128333: out FEE4654DFDDF5C7FEA866476789D853608102001F981566D0000003C9A46E95EB720599A3F1CA4CA8D628AAC5B885B9811D2660008
AAB9E72B19203F
ike 0:2ndReachTele:5128333: sent IKE msg (quick_i2send): 198.199.186.2:500->69.164.108.84:500, len=60, id=fee4654dfddf5c7f/ea866476789d853
6:f981566d
ike 0: comes 69.164.108.84:500->198.199.186.2:500,ifindex=16....
ike 0: IKEv1 exchange=Informational id=fee4654dfddf5c7f/ea866476789d8536:ccc0fd59 len=84
ike 0: in FEE4654DFDDF5C7FEA866476789D853608100501CCC0FD59000000541EBB8889B3DF84F48C6DB0438434335967A3534544EC82F1BD25B433F99F488B5A4E41B9
6C087ED417A34994E12E38FD7DCE1040DC1DAB7C
ike 0:2ndReachTele:5128333: dec FEE4654DFDDF5C7FEA866476789D853608100501CCC0FD59000000540B000018A1C492F08140E4BCEDCBF35B730A18FD7A3B03C700
0000200000000101108D28FEE4654DFDDF5C7FEA866476789D853654D08354
ike 0:2ndReachTele:5128333: notify msg received: R-U-THERE
ike 0:2ndReachTele:5128333: enc FEE4654DFDDF5C7FEA866476789D853608100501AC5D107E000000540B000018EC12651CE7770AAE45ED6F938DA068529B20D98F00
0000200000000101108D29FEE4654DFDDF5C7FEA866476789D853654D08354
ike 0:2ndReachTele:5128333: out FEE4654DFDDF5C7FEA866476789D853608100501AC5D107E0000005C553646DDC902AAEED2B08FC6BB89EE89070B6E71B1250FC294
5D748E60E3C8E1F1D2B28B35C887ED649683D8F56EF946BBA8CD54FBD55E3960838A09CDC73288
ike 0:2ndReachTele:5128333: sent IKE msg (R-U-THERE-ACK): 198.199.186.2:500->69.164.108.84:500, len=92, id=fee4654dfddf5c7f/ea866476789d85
36:ac5d107e
di de dis

Prod_SDWan-Primary # di de reset