Why PA is Responder for Phase 1 and Initiator for Phase 2





 

Seems Phase 2 is down and system log shows below logs again and again

 

and ( description contains 'IKE phase-2 negotiation is failed as initiator, quick mode. Failed SA: 198.160.x.x[500]-173.182.x.x[500] message id:0xF55F380F. Due to negotiation timeout.' )

 

i do not have to device 173.182.x.x

 

 

When i run below command  i s

 

show vpn ike-sa

IKEv1 phase-1 SAs  
GwID/client IP Peer-Address Gateway Name Role Mode Algorithm Established Expiration V ST Xt Phase2

14 173.182.x.x CoC\_13 Resp Main PSK/DH14/A256/SHA1 May.10 10:29:52 May.10 11:29:52 v1 13 2 0

  
Show IKEv1 IKE SA: Total 6 gateways found. 5 ike sa found.

  
IKEv1 phase-2 SAs  
Gateway Name TnID Tunnel GwID/IP Role Algorithm SPI(in) SPI(out) MsgID ST Xt  
         -- --

CoC\_13 105 CoC-YYC\_13:YYC\_13 14 Init / / / 00000000 00000000 7A838C53 5 4

  
Show IKEv1 phase2 SA: Total 6 gateways found. 9 ike sa found.

 

Show IKEv2 SA: Total 2 gateways found. 2 ike sa found.

 

why my PA is responder for Phase 1 and Initator for Phase 2?



 MP
> 
> 
> 
> 
> [@MP18](/t5/user/viewprofilepage/user-id/75039) wrote:  
> why my PA is responder for Phase 1 and Initator for Phase 2?
> 
> 
> 
> 
> 
> 

Why not? :P

 

* How many proxy IDs do you have configured on that tunnel?
* What timeouts do you have configured for phase 1 and 2?

 

For example if you have only 1 phase 2 tunnel and a timeout of 8 hours in phase 1 and 1 hour for phase 2. At 2 am the other side establishes a connection so phase 1 and 2 will be setup. At that time your PA is responder for phase 1 and 2. After exchanging some packets there is no longer a connection so phase 2 will time out. For example at 4 am your side wants to connect to the remote network. As phase 2 already timed out a new one needs to be created but phase 1 is still up. --> your PA is responder in phase 1 and initiator of phase 2




[View solution in original post](/t5/general-topics/why-pa-is-responder-for-phase-1-and-initiator-for-phase-2/m-p/260632#M73879)
hi yerhu,

i could imagine, that one of the two following scenarios may cause the issue:

you’re using an outdated version of tk-core. check in your configuration: core/core\_api.yml

you’re using a pipelineconfiguration, which is pointing to a local-path and includes a file like python\_interpreter, i… answered here:

[image]

[acados error status 2 on python interface](https://discourse.acados.org/t/acados-error-status-2-on-python-interface/75)

hello,

i have been getting a lot of the following message “acados returned status 2. exiting”. this usually happens when tuning the weights and the problem hyper parameters, so it feels like it is somewha… sorry i took so long to respond on this post. i’ve had a busy week! so i found the issue. in my template for endpoints i realized i accidentally set them to provision using the external ip address of my pbx. changed it to internal and this fixed my issues :stuck\_out\_tongue: well, i raised an issue with id support whom escalated it with engineering or something and it's now working. they did say they'd text me updates and haven't received anything from them so whether they did anything or whether it just started working.. who knows. 

but yeah, looks like the answer is calling / talking to support. i suspect that the resource\_exhausted message may have originated from a back-pressuring committer node ([code](https://github.com/digital-asset/daml/blob/926fb5997a795e7f80443a9a3ba7898b1568d158/ledger/participant-integration-api/src/main/scala/platform/apiserver/services/apisubmissionservice.scala#l155-l157)). if that’s the case, i believe the approach should be the same: change the configuration if you need and make sure to handle those errors with the appropriate retry strategy. it looks like you are hitting lambda limit: 
<https://docs.aws.amazon.com/lambda/latest/dg/gettingstarted-limits.html> 
invocation payload (request and response) 
6 mb (synchronous) 
256 kb (asynchronous) 
can you please try to make chunks smaller and try again are you still forwarding dns requests to the old isp's dns servers?  that could slow things down...

 switch to google (8.8.8.8) or opendns (208.67.222.222 and 208.67.220.220) and see if that helps any, or find the dns servers for your new isp. it looks like the updater was running twice and wiped the kernel from your system.

you will find a backup in /var/ipfire/backup which you can restore after performing a fresh installation. It means for some reason the case could not proceed at the time it was set. You need to speak to the prosecutor or investigator as a witness hi gerryos,there are some network communication errors showing up. how are your sonos units connected to your network? are they wired into a switch or directly into your router?it may help to reboot your router, sonos units and any other network hardware you have connected. this may clear up the network errors and help with spotify playback and the 1002 timeout errors.