This article explains why spoke creation fails with an IPSec/IKE ​negotiation failed error in CSO 5.0.2, and what must be done to resolve the issue.

The following errors are observed in the var/log/messages file of the SRX device:

IPSec negotiation failed with error:Authentication failed. IKE Version: 2, VPN: <vpn> Gateway:<gateway>, Local: X.X.X.X, Remote: X.X.X.X, Local IKE-ID: Not-Available, Remote IKE-ID: Not-Available, VR-ID: 0
IPSec negotiation failed with error:Authentication failed. IKE Version: 2, VPN: <vpn>  Gateway:<gateway>, Local: X.X.X.X, Remote: X.X.X.X, Local IKE-ID: Not-Available, Remote IKE-ID: Not-Available, VR-ID: 0
IKE negotiation failed with error: Authentication failed. IKE Version: 2, VPN: <vpn>  Gateway: <gateway>, Local: X.X.X.X, Remote: X.X.X.X, Local IKE-ID: Not-Available, Remote IKE-ID: Not-available, VR-ID: 0: Role: Initiator

This issue is due to the local-identity name (generated by CSO) in the stage-1 template exceeding 64 characters. This matches the limitation on SRX devices where IKE Auth failure is observed if local identity/dynamic hostname (FQDN) name length is >= 64 characters.

If tenants/sites are created in CSO 5.0.1 and 5.0.2 where validations are not in place, users can easily run into this problem.

To resolve the issue, look into stage-1 and ensure that the local-identity name (generated by CSO) is within the limit of 64 characters.

CSO combines the tenant+oamhub+spokename+wan link name, which can be seen in the stage-1 template as shown below:

<local-identity>
<hostname>
<identity-hostname>tenant+oamhub+spokename+wan

Use the following limits for reference to ensure that the local-identity name does not exceed 64 characters:

OpCo Name:  15
Tenant Name: 15
Site (Spoke) Name: 10
Enterprise HUB Name: 10
Provider HUB Name: 10

Note: These limits are not enforced in Admin Portal in versions 5.0.1 and 5.0.2. The above validations have been added in CSO version 5.0.3.