Description

This article describes the issue of the IKE Phase-1 Failure: Received delete notification error message being periodically generated in the log messages on SRX. However, there are no issues with the VPN tunnel and traffic.

Symptoms

Two SRX devices establish a site to site VPN. At first, the VPN tunnel and traffic are good. After a period of time, the following message is periodically generated in log messages:

Sep 17 16:48:03.000 SDTR01 (FPC Slot 1, PIC Slot 0) SPC1_PIC0 kmd[212]: IKE Phase-1 Failure: Received delete notification [spi=75ffd110, src_ip=a.a.a.a, dst_ip=b.b.b.b]
Sep 18 01:04:45.000 SDTR01 (FPC Slot 1, PIC Slot 0) SPC1_PIC0 kmd[212]: IKE Phase-1 Failure: Received delete notification [spi=75ffd110, src_ip=a.a.a.a, dst_ip=b.b.b.b]
Sep 18 09:22:20.000 SDTR01 (FPC Slot 1, PIC Slot 0) SPC1_PIC0 kmd[212]: IKE Phase-1 Failure: Received delete notification [spi=75ffd110, src_ip=a.a.a.a, dst_ip=b.b.b.b]
Sep 18 17:39:03.000 SDTR01 (FPC Slot 1, PIC Slot 0) SPC1_PIC0 kmd[212]: IKE Phase-1 Failure: Received delete notification [spi=75ffd110, src_ip=a.a.a.a, dst_ip=b.b.b.b]
Sep 19 01:54:26.000 SDTR01 (FPC Slot 1, PIC Slot 0) SPC1_PIC0 kmd[212]: IKE Phase-1 Failure: Received delete notification [spi=75ffd110, src_ip=a.a.a.a, dst_ip=b.b.b.b]
Sep 19 10:09:57.000 SDTR01 (FPC Slot 1, PIC Slot 0) SPC1_PIC0 kmd[212]: IKE Phase-1 Failure: Received delete notification [spi=75ffd110, src_ip=a.a.a.a, dst_ip=b.b.b.b]
Sep 19 18:26:12.000 SDTR01 (FPC Slot 1, PIC Slot 0) SPC1_PIC0 kmd[212]: IKE Phase-1 Failure: Received delete notification [spi=75ffd110, src_ip=a.a.a.a, dst_ip=b.b.b.b ]
a.a.a.a and b.b.b.b are VPN gateway addresses. When the message is generated, the VPN tunnel and traffic are not influenced.

Solution

spi=75ffd110 does not indicate SPI; but SPIs memory address. This message is generated, when the old VPN is expired and new IKE/IPSEC SA negotiate. You can ignore it because it is a cosmetic log and harmless.

Modification History

2020-07-27: Article reviewed for accuracy; no changes required.