I'm having connection problems with a site to site VPN. My site uses Forefront TMG box, the remote site a Cisco VPN concentrator. The connection is dropping frequently.

The only entry that shows up in the logs is 4654 with the following text.

An IPsec quick mode negotiation failed.

Additional Information:
Protocol: 0
Keying Module Name: IKEv1
Virtual Interface Tunnel ID: 0
Traffic Selector ID: 0
Mode: Tunnel
Role: Initiator
Quick Mode Filter ID: 119435

Main Mode SA ID: 39
Failure Information:
State: Sent first (SA) payload
Message ID: 2147483651
Failure Point: Local computer
Failure Reason: Main mode SA assumed to be invalid because peer stopped responding.

What causes the entry described in failure reason?

Local phase 1: 86400 seconds Local phase 2: 28800 seconds, 4608000 kilobytes

Remote phase 1: 86400 seconds Remote phase 2: 28800 seconds, 4608000 kilobytes

There is no dead peer detection configured on either side of the tunnel.

An additional point of interest is the lifetime detected on the remote side for our tunnel is only 7200 seconds.

  • Has it been working in the past? Seems like the remote system's not responding to your attempt to start an IKE session. – Shane Madden Aug 10 '11 at 18:25
  • It kind of works now. About every 15 minutes the session reestablishes itself. The phase 1 settings are every 24 hours, the phase 2 every 8. – Tim Brigham Aug 10 '11 at 18:35
  • 1
    Can you give us more config info - ideally from both ends? Lifetime mismatch between your end and the remote end would be my suspicion at this point. – Shane Madden Aug 10 '11 at 18:41
  • Configured any dead peer detection on either/both ends? – Shane Madden Aug 10 '11 at 19:22

Based on the comments about the lifetime mismatch I managed to determine the underlying cause. Although the Forefront configuration indicates 86400 seconds the key lifetime that shows in the IP Security Monitor MMC shows 0KB / 7200 seconds, corresponding to the value our remote peer is detecting. It looks like I'll need to open a case with MS to determine why this value is being used.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.