dst = 10.2.1.1/500Failed to get IPsec policy for phase 2 responder. Delete IPsec SA.该报错主要由于ike profile配置不对称， debug信息会提示没有ike profile匹配上。 ike profile的查找失败后还会进行一次全局查找。 全局查找也失败了的话，协商ike sa失败； 查找成功，可以协商起ike sa。 当全局查找ike profile成功协商成ike sa后，IPsec策略中却绑定了一个ike profile的话，会有如下错误，该错误发生在二阶段。 此时查看ike sa的详细信息，查看协商出来匹配的ike sa使用的IKE Profile是否与IPsec绑定的一样，如果使用了全局的ike profile，在ike sa的详细信息中，‘Profile’的值是空。

Failed to establish phase 2 SA in IKE_P2_STATE_SEND1 state. Reason: Retransmission of phase 2 packet timed out. 这个是啥原因？ 希望给出专业的指导 检查两端的IPsec安全提议参数、IPsec认证算法、IPsec加密算法、IPsec封装模式是否一致，若不一致请修改为一致 · 检查两端的IPsec policy配置是否一致，若不一致请修改为一致 · 检查两端引用的ACL配置是否为镜像配置，若不为镜像配置请修改为镜像配置 · 检查物理链路状态和对等体网络是否可达，若物理链路状态不佳或对等体网络不可达请排查网络故障 执行以上检查后，若问题仍未解决，则请收集配置文件、日志信息和告警信息，并联系技术支持

Failed to establish phase 2 SA in IKE_P2_STATE_GETSPI state.Reason: Failed to get SPI from proposal.SA information:· Role: Responder· Local address: 2.2.2.2· Remote address: 1.1.1.1· Sour addr: 192.168.2.0/255.255.255.0 Port: 0 Protocol: IP· Dest addr: 192.168.1.0/255.255.255.0 Port: 0 Protocol: IP· Inside VPN instance: aaa· Outside VPN instance: bbb· Inbound AH SPI: 192365458· Outbound AH SPI:

Failed to establish IPsec SA.Reason: Getting SP by L3 interface: Failed to match SP because IKE profile was while IPsec used profile IPSEC_EIS_H3C. Failed to establish IPsec SA.Reason: The policy contains incorrect ACL or IKE profile configuration. Failed to establish phase 2 SA in IKE_P2_STATE_GETSP state.Reason: Failed to get IPsec policy as phase 2 responder.1. IKE Profile 不匹配日志明确提示：Failed to

Failed to get IPsec policy for phase 2 responder.没找到策略，把ike sa重置一下吧。

昨天反映过ipsecvpn不稳定的情况，重启到现在还没断（但实际是周期重连两到三次就会莫名的连不上了），生命周期到了会重连，但是细看时间发现有问题，我的两端的ipsec sa周期都设置的是12小时，但实际日志记录里只有10小时就到期了。另外我有个问题就是，IKE对等体的周期和IPSEC策略的周期设置成一样？还是一个长一个短，有没有要求？我现在设置的是IKE对等体的周期是IPSEC策略周期的2倍 IPSEC

IPsec tunnel. %Aug 27 19:09:31:687 2024 H3C IKE/6/IKE_P1_SA_ESTABLISH_FAIL: Failed to establish phase 1 SA in Main mode IKE_P1_STATE_SEND2 state. Reason: Retransmission timeout. SA information: Role: responder Local IP: 119.145.197.195 Local ID type: Unknown Local ID: Local port: 500 Retransmissions: 5 Remote IP: 120.237.131.66 Remote ID type: Unknown Remote ID: Remote port: 500 Recived

dst = 10.194.3.42/500 Failed to get IPsec policy for phase 2 responder. Delete IPsec SA. *Jun 22 14:16:58:133 2016 LNS IKE/7/ERROR: vrf = 0, src = 10.194.3.33, dst = 10.194.3.42/500 Failed to negotiate IPsec SA. *Jun 22 14:16:58:133 2016 LNS IKE/7/EVENT: Delete IPsec SA. *Jun 22 14:16:58:134 2016 LNS IKE/7/PACKET: vrf = 0, src = 10.194.3.33,

设备上开启了IPSEC相关的日志，看到如下日志想要确认产生的原因： %Nov 20 17:41:34:401 2022 H3C IPSEC/6/IPSEC_SA_TERMINATE: -COntext=1; The IPsec SA was deleted. Reason: An IKE SA deletion message was received. 产生原因：两端在ike sa均在的情况下，一...

dst = 10.194.3.42/500 Failed to get IPsec policy for phase 2 responder. Delete IPsec SA. *Aug 12 14:16:58:133 2016 H3C IKE/7/ERROR: vrf = 0, src = 10.194.3.33, dst = 10.194.3.42/500 Failed to negotiate IPsec SA. *Aug 12 14:16:58:133 2016 H3C IKE/7/EVENT: Delete IPsec SA. *Aug 12 14:16:58:134 2016 H3C IKE/7/PACKET: vrf = 0, src = 10.194.3.33,