# Error establishing VPN

**URL:** <https://forum.sierrawireless.com/t/error-establishing-vpn/13242>\
**Category:** AirLink Routers\
**Created:** [July 23, 2018, 10:20am UTC](https://forum.sierrawireless.com/t/error-establishing-vpn/13242 "2018-07-23T10:20:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![miki\_teleco](https://avatars.discourse-cdn.com/v4/letter/m/46a35a/32.png) [@miki\_teleco](https://forum.sierrawireless.com/u/miki_teleco)\
**Post date:** [July 23, 2018, 10:20am UTC](https://forum.sierrawireless.com/t/error-establishing-vpn/13242/1 "2018-07-23T10:20:55Z")

</div>

Hi all,

I have configured a VPN against a FortiGate device. All configuration is the same in both sides but i’m getting this error in the sierra device (I copy all log because I don’t know how many lines are necessary).

8 Hash  
Decoding t 1 SA  
Attr 1 - Encyption 1  
Attr 2 - Hash len 4  
Attr 4 - Grp Desc 61443  
Attr 6 - Grp Prime 256  
Attr 5 - Grp Type 2  
Attr 3 - Auth 2  
Decoding t 10 Nonce  
Decoding t 4 Key Exchange  
Decoding t 5 ID

- type 4 addr 10.0.0.0, mask 255.0.0.0  
Decoding t 5 ID
- type 4 addr XX.XX.XX.XX, mask 255.255.255.248  
IP\_B\_ID select src ip 10.0.0.0, dest ip XX.XX.XX.XX  
Get IPsec Policy for Src 10.0.0.0 Dest XX.XX.XX.XX 1 2 -found  
Add\_SA2  
\<-- Sending phase 2 IKE message  
Encoding t 8 Hash  
Encoding t 1 SA  
Attr 1 - Encyption 1  
Attr 2 - Hash len 4  
Attr 4 - Grp Desc 61443  
Attr 6 - Grp Prime 256  
Attr 5 - Grp Type 2  
Attr 3 - Auth 2  
Encoding t 10 Nonce  
Encoding t 4 Key Exchange  
Encoding t 5 Identification
- type 4 addr 10.0.0.0, Mask 255.0.0.0  
Encoding t 5 Identification
- type 4 addr XX.XX.XX.XX, Mask 255.255.255.248  
Received from IPSec Gateway XX.XX.XX.XX  
Received from IPSec Gateway XX.XX.XX.XX  
–\> Received NATT message  
Get IKE Policy for Type 1, IP XX.XX.XX.XX xx 1 -found - policy found  
Dispatching Phase 2 message  
Exchange type 32 -quick  
Quick mode  
\*\*\* mode handlers  
Quick Mode State 3  
Decoding t 8 Hash  
Decoding t 1 SA  
Attr 6 - Grp Prime 256  
Attr 4 - Grp Desc 61443  
Attr 3 - Auth 2  
Attr 5 - Grp Type 2  
Attr 1 - Encyption 1  
Attr 2 - Hash len 4  
Decoding t 10 Nonce  
Decoding t 4 Key Exchange  
Decoding t 5 ID
- type 4 addr XX.XX.XX.XX, mask 255.255.255.248  
Decoding t 5 ID
- type 4 addr 10.0.0.0, mask 255.0.0.0  
IKE\_IPS: type 17 17 src . XX.XX.XX.XX, dst . 10.0.0.0  
IPSEC Add SA Pair  
IPSEC Add Out SA  
IPSEC Add Inbound SA  
Showing out SA’s  
SPI src dst – Tunnel src dst  
d0d2cf1a XX.XX.XX.XX 10.0.0.0- XX.XX.XX.XX XX.XX.XX.XX  
In Bound  
b45ed914 XX.XX.XX.XX XX.XX.XX.XX  
\<-- Sending phase 2 IKE message  
Encoding t 8 Hash  
Quick mode exchange completed  
\*\*\*\* Finalizing Phase 2 Handle - Tunnel established \*\*\*\*\*\*\*\*\*  
–\> Received NATT message  
Get IKE Policy for Type 1, IP XX.XX.XX.XX xx 1 -found - policy found  
Dispatching Phase 2 message  
Exchange type 32 -quick  
Quick mode  
Received from IPSec Gateway XX.XX.XX.XX  
Received from IPSec Gateway XX.XX.XX.XX  
–\> Received NATT message  
Get IKE Policy for Type 1, IP XX.XX.XX.XX xx 1 -found - policy found  
Dispatching Phase 2 message  
Exchange type 32 -quick  
Quick mode  
\*\*\* mode handlers  
Quick Mode State 4  
Decoding t 8 Hash  
IKE\_IPS: type 17 17 src . XX.XX.XX.XX, dst . 10.0.0.0  
IPSEC Add SA Pair  
IPSEC Add Out SA  
IPSEC Add Inbound SA  
Showing out SA’s  
SPI src dst – Tunnel src dst  
d0d2cf19 XX.XX.XX.XX 10.0.0.0- XX.XX.XX.XX XX.XX.XX.XX  
d0d2cf1a XX.XX.XX.XX 10.0.0.0- XX.XX.XX.XX XX.XX.XX.XX  
In Bound  
b45ed914 XX.XX.XX.XX XX.XX.XX.XX  
b45ed915 XX.XX.XX.XX XX.XX.XX.XX  
Quick mode exchange completed  
\*\*\*\* Finalizing Phase 2 Handle - Tunnel established \*\*\*\*\*\*\*\*\*  
–\> Received NATT message  
Get IKE Policy for Type 1, IP XX.XX.XX.XX xx 1 -found - policy found  
Dispatching Phase 2 message  
Exchange type 32 -quick  
Quick mode  
\*\*\* mode handlers  
Quick Mode State 2  
Decoding t 8 Hash  
Quick Mode failed - aborting status -4908  
\<-- Sending phase 2 IKE message  
Encoding t 8 Hash  
Encoding t 11 Notify  
Error notification sent  
Received from IPSec Gateway XX.XX.XX.XX  
Received from IPSec Gateway XX.XX.XX.XX  
–\> Received IKE message  
Get IKE Policy for Type 1, IP XX.XX.XX.XX xx 1 -found - policy found  
IKE message contains invalid payload  
Error in incoming message - message ignored

By this way, VPN is never up. What is happening?

Thanks.

---

<div class="post-metadata">

**Author:** ![miki\_teleco](https://avatars.discourse-cdn.com/v4/letter/m/46a35a/32.png) [@miki\_teleco](https://forum.sierrawireless.com/u/miki_teleco)\
**Post date:** [July 26, 2018, 1:57pm UTC](https://forum.sierrawireless.com/t/error-establishing-vpn/13242/2 "2018-07-26T13:57:42Z")

</div>

Hi again,

after too many tries I got the problem. It was that the VPN can’t be established using a PSK of 20 chars. It is weird but if I use PSK up to 15 chars, the VPN is correctly established. Do someone know why this happen? Is this a limitation of Sierra?

Regards.

---

<div class="post-metadata">

**Author:** ![George\_Glick](https://avatars.discourse-cdn.com/v4/letter/g/43a26b/32.png) [@George\_Glick](https://forum.sierrawireless.com/u/George_Glick)\
**Post date:** [July 31, 2018, 1:04pm UTC](https://forum.sierrawireless.com/t/error-establishing-vpn/13242/3 "2018-07-31T13:04:35Z")

</div>

Sometime its depends on VPN. Which VPN are you using, I’m using StrongVPN and its working good, never got any issue about using it. If you want to know about StrongVPN check the details about [StrongVPN review](https://www.reviewsdir.com/strongvpn-review/)