Applies to: Seclore Cloud VPN

Are you facing issues with your AWS tunnel? Here are some common errors you might encounter and simple solutions to get things back on track.

List of errors:

AWS tunnel received DELETE for Phase 2 SA with SPI: xxxx

AWS tunnel received DELETE for IKE_SA from CGW

AWS tunnel detected a (CHILD_REKEY) collision as CHILD_DELETE

AWS tunnel (CHILD_SA) redundant SA is being deleted due to detected collision

No Proposal Match Found by AWS

No Proposal Match Found. Notifying with "No proposal chosen"

AWS tunnel Phase 2 was unable to establish while keeping Phase 1

AWS: Traffic Selector: TS_UNACCEPTABLE: received from responder

AWS tunnel is sending AUTHENTICATION_FAILED as the response

AWS tunnel Timeout: deleting un-established Phase 1 IKE_SA with cgw: xxxx

No Proposal Match Found. Notifying with "No proposal chosen"

No Proposal Match Found by AWS



Solution:

  • Ensure the Phase 1 and Phase 2 lifetimes are identical.


  • Check if there is no traffic inside the tunnel and if the key's lifetime has expired.


  • Verify if any configuration changes have been made related to the VPN tunnel.


  • Ensure the Phase 1 and Phase 2 parameters or attributes are similar at both ends of the gateway.


  • If you've modified the traffic selector/domain encryption or changed IPsec parameters, your Customer Gateway device might send a CHILD_SA deletion request to AWS, which can tear down the VPN tunnels. In this case, review the configurations and consider reaching out to your device’s TAC team if needed.


  • Another possible issue could be an incorrect proposal. For policy-based routing, AWS supports a single SA for inbound and outbound traffic. To resolve this, ensure the traffic selector/encryption domain is configured with identical and correct CIDRs.


  • Check the stability of your ISP link. A stable connection is crucial for a functioning AWS tunnel.



Other similar issues.

Peer is not responsive - Declaring peer dead (DPD issue)

Trouble Logging into PS Despite Working VPN

AWS tunnel detected a pre-shared key mismatch with cgw: xxxx



Need more help? 

Contact Seclore Support

 support@seclore.com | Chat Live