Description

For every VPN tunnel there is an Initiator device triggering the IKE negotiation and the Responder device accepting the first IKE exchange packets. Understanding the roles is helpful when troubleshooting VPN issues.

This article explains how to identify whether the gateway is acting as Responder or Initiator for the specific VPN.

Solution

Identify the role with ' show security ike security-associations ' as shown below: 

root@Corporate> show security ike security-associations
Index   State  Initiator cookie  Responder cookie  Mode           Remote Address   
6695410 UP     4f61f68dcad7bd87  e3a72e5385d72fcc  Main           192.168.1.1     

root@Corporate> ...ity-associations index 6695410 detail                     
IKE peer 192.168.1.1, Index 6695410, Gateway Name: Gateway
  Role: Initiator, State: UP ==> Here
  Initiator cookie: 4f61f68dcad7bd87, Responder cookie: e3a72e5385d72fcc

If outputs are not seen under ' show security ike security-associations ', then use the following methods to determine the roles:
  1. Check the equivalent output on peer side and verify the role of peer.
  2. If using Aggressive Mode VPN, the site with dynamic IP will be the Initiator.