Site-to-site VPN
Gateway log
This page is for the IT administrator comparing what the gateway saw with what their firewall logged. It covers the Gateway log tab of Network, Site-to-site VPN in the Computle Portal.
The tab shows the gateway’s own IPsec log for this connection. Only entries about the negotiation with your firewall are kept: establishing, authenticating, agreeing proposals and traffic selectors, key renewals, dead peer detection and deletions. The last 60 entries are shown, newest first. A repeated entry is shown once with a count such as x12.
Click Refresh to fetch the latest copy. Last read shows when the gateway last sent the log. No entries yet. means the gateway has not reported a log for this connection.
Reading the entries
Section titled “Reading the entries”Each row has the time, the source on the gateway, and the text. The text comes from the gateway’s IKE daemon and matches what most firewalls log in their own words. The table lists the entries you will see and what to check for each.
| Entry contains | What it means | What to check |
|---|---|---|
initiating IKE_SA, establishing | The gateway is starting the negotiation with your firewall. | Nothing; expected at every connection attempt. |
IKE_SA … established between | Phase 1 is up. | Nothing. If the status still reads Not connected, read on for a Phase 2 entry. |
CHILD_SA … established or installed | A tunnel for one of your office networks is up. | Nothing. |
CHILD_SA … rekeyed | Keys renewed. | Nothing; normal every hour. |
retransmit n of request, giving up after n retransmits, peer did not respond | Your firewall did not answer. | Your public IP address on the Connection tab, and that your firewall accepts IKE from our public IP address. |
authentication of … failed, AUTHENTICATION_FAILED | The pre-shared key or the peer identity does not match. | The pre-shared key on your firewall is the one shown in the portal. Generate a new key and enter it on both sides if in doubt. |
no acceptable proposal, no acceptable ENCRYPTION_ALGORITHM, NO_PROPOSAL_CHOSEN | The two sides offer different algorithms. | Encryption settings on the Connection tab against your firewall’s Phase 1 and Phase 2 proposals. |
INVALID_KE_PAYLOAD | The Diffie-Hellman group differs. | The dhGroup values on the Connection tab against your firewall. |
traffic selectors … unacceptable, TS_UNACCEPTABLE, failed to establish CHILD_SA | Phase 1 is up but the networks do not match. | Your office networks on the Connection tab against your firewall’s local networks, and our internal networks against its remote networks. |
received … notify error, INVALID_SYNTAX | Your firewall rejected a message. | Your firewall’s own log at the same time. |
remote host is behind NAT | Your firewall’s address is being translated. | Tick My firewall is behind NAT on the Connection tab. |
DPD check timed out, deleting IKE_SA, received DELETE for | Your firewall stopped answering, or one side closed the tunnel. | Whether your firewall or its internet connection restarted. The gateway reconnects on its own. |
selected peer config | The gateway matched your firewall to this connection. | Nothing. |