I'm having connection problems with a site to site VPN. My site uses Forefront TMG box, the remote site a Cisco VPN concentrator. The connection is dropping frequently.
The only entry that shows up in the logs is 4654 with the following text.
An IPsec quick mode negotiation failed.
…Additional Information:
Protocol: 0
Keying Module Name: IKEv1
Virtual Interface Tunnel ID: 0
Traffic Selector ID: 0
Mode: Tunnel
Role: Initiator
Quick Mode Filter ID: 119435Main Mode SA ID: 39
Failure Information:
State: Sent first (SA) payload
Message ID: 2147483651
Failure Point: Local computer
Failure Reason: Main mode SA assumed to be invalid because peer stopped responding.
What causes the entry described in failure reason?
Local phase 1: 86400 seconds Local phase 2: 28800 seconds, 4608000 kilobytes
Remote phase 1: 86400 seconds Remote phase 2: 28800 seconds, 4608000 kilobytes
There is no dead peer detection configured on either side of the tunnel.
An additional point of interest is the lifetime detected on the remote side for our tunnel is only 7200 seconds.
Best Answer
Based on the comments about the lifetime mismatch I managed to determine the underlying cause. Although the Forefront configuration indicates 86400 seconds the key lifetime that shows in the IP Security Monitor MMC shows 0KB / 7200 seconds, corresponding to the value our remote peer is detecting. It looks like I'll need to open a case with MS to determine why this value is being used.