No relevant resource is found in the selected language.

This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Read our privacy policy>Search


To have a better experience, please upgrade your IE browser.


CLI-based Configuration Guide - VPN

AR650, AR1600, and AR6100 V300R003

This document describes VPN features on the device and provides configuration procedures and configuration examples.
Rate and give feedback:
Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).
IKE SA Negotiation Failed

IKE SA Negotiation Failed


The IPSec service cannot be normally transmitted. The output of the display ike sa command shows that IKE SA negotiation failed.

The following shows an example of the command output. If the Flag parameter is displayed as RD or RD|ST, an SA is established successfully. ST indicates that the local end is the IKE initiator.

    Conn-ID  Peer            VPN   Flag(s)                Phase                 
    13118        0     RD                     v1:2  
    12390        0     RD                     v1:1

   Number of IKE SA : 2
  Flag Description:    

If IKE SA negotiation fails, the Flag parameter is empty, the Peer parameter is, or the command output contains no record.


  1. Run the display ike proposal command to check whether the IKE peer uses the same IKE proposal.

    If not, change IKE proposals on the peer to be the same. If the authentication algorithms in the IKE proposals are different, perform the following operations.

    On the IKE initiator:

    ike proposal 10
     authentication-algorithm sha2-256

    On the IKE responder:

    ike proposal 10
     authentication-algorithm sha2-384

  2. Run the display ike peer command to check whether the configuration in the peer view is correct.

    • Check whether the remote IP address is configured.

      When the ACL mode is used for IPSec tunnel establishment, the remote IP address must be specified for the device in IKE main negotiation mode. In addition, the remote IP addresses specified for the IKE peer must match each other.

      If the IP addresses of the IKE initiator and responder are and, the configuration is as follows.

      On the IKE initiator:

      ike peer mypeer1

      On the IKE responder:

      ike peer mypeer2

      If the IKE responder uses the policy template mode, you do not need to configure the remote IP address for the responder.

    • Check whether the pre-shared keys of the IKE peer are the same.

      ike peer mypeer
       pre-shared-key cipher %^%#JvZxR2g8c;a9~FPN~n'$7`DEV&=G(=Et02P/%\*!%^%#   //The key is Huawei@123.

      If not, change the pre-shared keys to be the same.

    • Check whether the IKE proposals referenced by the IKE peer are the same.

      For example, the IKE initiator references IKE proposal 10.

      ike peer mypeer
       ike-proposal 10

      The related configuration of IKE proposal 10 is as follows.

      ike proposal 10
       encryption-algorithm aes-128
       authentication-algorithm sha2-256 

      If the configurations in the IKE proposals are different, change them to be the same.

Updated: 2019-04-12

Document ID: EDOC1100041799

Views: 31746

Downloads: 45

Average rating:
This Document Applies to these Products
Related Documents
Related Version
Previous Next