IPsec phases

IPsec tunnels are based on two components. Phase 1 of the IPsec protocol defines the remote peer and how the tunnel is authenticated. One or more Phase 2 entries of the IPsec protocol define how traffic is carried across the secure tunnel. It is very important to configure these two phases carefully. If the information is incorrect in either section, the tunnel will likely fail to successfully negotiate Phase 1 and/or Phase 2. You need to make sure that both VPN servers have exactly the same settings for all of the IPsec configuration fields, with only a few exceptions to that rule. For example, both sides will have different identifiers and remote gateways. The subnet definitions, timeouts, encryption settings, and so on all need to match.