Description

This article provides information about the rules to follow when configuring a pre-shared key. At times, customers have issues with configuring the IPSEC tunnel across the devices; even after having the similar proposal, policy, and pre-shared key on both of the peer devices.

Symptoms

The output of the ike security-associations shows Phase-1 as DOWN ; even after receiving the responder cookie.

[edit]
root# run show security ike security-associations
Index State Initiator cookie Responder cookie Mode Remote Address
3052057 DOWN ee02735b2b594ef8 a3fa84c4338944a5 Main 10.10.10.1
3052056 DOWN bbccd36c7ee446ad 36f5fe01d20bdf88 Main 12.12.12.1



Solution

This issue occurs when the pre-shared key is not properly configured.

  • Check if the pre-shared key contains any symbols, such as '@', '+', '=', and so on. For use of symbols in pre-shared key, refer KB21159 [juniper.net] .

  • The pre-shared key can be one of the following:

    • ASCII text key - With the des-cbc option , the key contains 8 ASCII characters. With the 3des-cbc option , the key contains 24 ASCII characters.

  • Hexadecimal key - With the des-cbc option , the key contains 16 hexadecimal characters. With the 3des-cbc option, the key contains 48 hexadecimal characters.

  • Reconfigure the pre-shared key on the devices and the tunnel will come up. To configure an IKE policy preshared key, include the pre-shared-key statement and a key at the [edit services ipsec-vpn ike policy policy-name] hierarchy level:

    pre-shared-key (ascii-text key | hexadecimal key);

Related Information