IKEv2 VTI tunnel up/down

[36223]

one of my IKEv2 tunnels is stuck in up/down but the other one is up/up and working.  Can someone help me fix this?  See configs and debugs below.  IP addresses have been modified but hopefully you can still follow.

[ashok_boin]

You have not specified which specific tunnel is down.

However, there is authentication issue for one which is taking one of this "down". Please refer the following link for further troubleshooting & provide more information of relevant "show" and 'debug" outputs.

19490: Nov 18 09:56:36.294 EST: IKEv2-ERROR:(SESSION ID = 42128,SA ID = 1):: Failed to locate an item in the database 019491: Nov 18 09:56:36.295 EST: IKEv2:(SESSION ID = 42128,SA ID = 1):Verification of peer's authentication data FAILED 019492: Nov 18 09:56:36.295 EST: IKEv2:(SESSION ID = 42128,SA ID = 1):Auth exchange failed

[36223]

interface tunnel 3 with peer IP x.x.229.152 is up/down

[ashok_boin]

Thank you. It looks Auth failure issue is not relevant for this peer then. 

Can you please post conditional debug (link below) of "debug crypto isakmp" at both ends of tunnels?

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_vpnips/configuration/xe-3s/sec-sec-for-vpns-w-ipsec-xe-3s-book/sec-crypto-debug-sup.html

Regards...

Ashok.

[36223 · Accepted solution]

I figured it out using debugs.  Auth failure was occurring b/c the remote peer was using incorrect source peer IP address.  Once the correct source peer IP was added to VPN tunnel configuration, the SVTI came up and established security association.

[ashok_boin]

Excellent. Glad to know that you could able to resolve

[BilalButt62333]

how did you apply to debug and how it shows it kindly let me know which commands you used, i also have some issues regarding IPsec ikev2