This article provides the command to capture the IKE PCAP during the time when phase 1 is down to understand IKE message failures.

The following command can be used to capture an IKE packet trace when Phase 1 is down, to help determine the point at which the IKE negotiation is failing.
The capture must be taken on the external interface configured for the IKE gateway:

user@host> monitor traffic interface <external-int-name> no-resolve matching "host <remote-gateway-ip>" write-file /var/tmp/capture.pcap

The captured PCAP file can then be exported from the device and analyzed using Wireshark for detailed troubleshooting of the IKE exchange.