| Description |
This article describes that tunnel fails to come up with 'Peer SA proposal not match local policy' message in logs. |
| Scope | FortiGate. |
| Solution |
The VPN configuration is identical on both local and remote ends but the VPN still fails to come up and negotiation errors are seen in the logs.
This is often because of a missing FW policy Inbound/Outbound for the tunnel. Creating the respective policy should make the negotiation successful.
It is possible to gather addition information about the negtiations using the following debugs:
# diagnose vpn ike log-filter dst-addr4 (X.X.X.X) <----- IP address of the remote peer. # diagnose debug application ike -1 # diagnose debug enable |
