medium

Troubleshooting IPsec IKE error: could not locate phase1 configuration

Q: Troubleshooting IPsec IKE error: could not locate phase1 configuration

1. Review the IPsec tunnel status and determine whether multiple tunnels point to the same remote gateway: 2. Inspect the phase 1 configurations. In this example, uses a static remote gateway: The second tunnel, , uses a DDNS gateway that resolves to the same address: 3. If only one tunnel is required, remove either IPsec tunnel configuration. The remaining tunnel should then be able to establish. 4. If both site-to-site tunnels must use the same remote gateway IP, enable network overlay on each tunnel and assign a different network ID to each phase 1 configuration: 5. Check the IPsec-bound interface. If the selected interface, such as port2, has no IP address, assign an IP address to that interface. 6. If the preceding corrections are already in place but the error continues, explicitly configure in the phase 1 interface settings:

Confirmed 8/8/2026

Problem

FortiGate cannot establish an IPsec tunnel to the remote VPN gateway, and IKE debugging reports that it cannot find the corresponding phase 1 configuration.

Symptoms

The IPsec tunnel list may show multiple tunnels to the same resolved remote gateway in a down state. Example: ``` get ipsec tunnel list ``` ``` NAME=VPN_to_WQD REMOTE-GW=60.50.220.14:0 P2NAME=VPN_to_WQD PROXY-ID-SOURCE=0.0.0.0/0.0.0.0 PROXY-ID-DESTINATION=0.0.0.0/0.0.0.0 STATUS=down NAME=VPN_WQD REMOTE-GW=60.50.220.14:0 P2NAME=VPN_WQD PROXY-ID-SOURCE=172.27.16.0/255.255.240.0 PROXY-ID-DESTINATION=172.27.0.0/255.255.240.0 STATUS=down ``` IKE debugging displays messages such as: ``` ike V=root:0:VPN_to_WQD:VPN_to_WQD: IPsec SA connect 62 180.74.240.29->60.50.220.14:0 ike V=root:0:VPN_to_WQD: could not locate phase1 configuration. ike V=root:0:VPN_to_WQD:VPN_to_WQD: IPsec SA connect 62 180.74.240.29->60.50.220.14:0 ike V=root:0:VPN_to_WQD: could not locate phase1 configuration. ike V=root:0:VPN_WQD:VPN_WQD: IPsec SA connect 62 180.74.240.29->60.50.220.14:0 ike V=root:0:VPN_WQD: could not locate phase1 configuration. ike V=root:0:VPN_WQD:VPN_WQD: IPsec SA connect 62 180.74.240.29->60.50.220.14:0 ike V=root:0:VPN_WQD: could not locate phase1 configuration. ``` The same error can occur when the interface selected by the IPsec phase 1 configuration has no IP address. Example debug output: ``` FG5H1E-1 # ike V=root:0:500E-GURUGRAM:IPSEC: IPsec SA connect 10 10.5.52.80->10.5.205.176:0 ike V=root:0:500E-GURUGRAM: could not locate phase1 configuration. ```

Environment

FortiGate IPsec. Example configurations include two site-to-site tunnels using `wan1`, where one tunnel has the static remote gateway `60.50.220.14` and the other uses `RPG2-WQD.fortiddns.com`, which resolves to the same IP address. The issue can also affect an IPsec configuration bound to an interface such as port2 when that interface has no IP address.

Root Cause

The error can have the following causes: - Two IPsec phase 1 configurations reach the same remote gateway IP. In the example, `VPN_WQD` uses the static address `60.50.220.14`, while `VPN_to_WQD` uses the DDNS name `RPG2-WQD.fortiddns.com`, which resolves to `60.50.220.14`. - The interface configured under the IPsec phase 1 settings has no IP address. - If the other corrective measures are already applied, the local gateway may need to be explicitly defined with `local-gw`.

Solution

Review the IPsec tunnel status and determine whether multiple tunnels point to the same remote gateway:

get ipsec tunnel list

Inspect the phase 1 configurations. In this example, VPN_WQD uses a static remote gateway:

config vpn ipsec phase1-interface
    edit "VPN_WQD"
        set interface "wan1"
        set peertype any
        set net-device disable
        set proposal aes256-sha256
        set remote-gw 60.50.220.14
        set psksecret ENC xxxxxxx
    next
end

The second tunnel, VPN_to_WQD, uses a DDNS gateway that resolves to the same address:

config vpn ipsec phase1-interface
    edit "VPN_to_WQD"
        set type ddns
        set interface "wan1"
        set peertype any
        set net-device disable
        set proposal aes256-sha256
        set dhgrp 14
        set remotegw-ddns "RPG2-WQD.fortiddns.com"
        set psksecret ENC xxxxxxx
    next
end

If only one tunnel is required, remove either IPsec tunnel configuration. The remaining tunnel should then be able to establish.
If both site-to-site tunnels must use the same remote gateway IP, enable network overlay on each tunnel and assign a different network ID to each phase 1 configuration:

config vpn ipsec phase1-interface
    edit "VPN_WQD"
        set network-overlay enable
        set network-id 100
    next
    edit "VPN_to_WQD"
        set network-overlay enable
        set network-id 200
    next
end

Check the IPsec-bound interface. If the selected interface, such as port2, has no IP address, assign an IP address to that interface.
If the preceding corrections are already in place but the error continues, explicitly configure local-gw in the phase 1 interface settings:

config vpn ipsec phase1-interface
    edit "IPSec-VPN"
        set interface "WAN"
        set local-gw x.x.x.x
    next
end

Verification

Run the tunnel status command again and confirm that the intended IPsec tunnel is no longer shown as down:

get ipsec tunnel list

Review IKE debugging and verify that could not locate phase1 configuration. no longer appears and that the tunnel establishes successfully.

Community rating

— / 5 (0)

Discussion (0)

No comments yet.