Site-to-Site VPN Problem Invalid SPI

Hi Trio Fandi,In your configs, both IPsec gateways (SFOS and NSX) are set with same Phase1 and Phase2 rekey timers; it is recommended to use lower values of Phase1 and Phase2 rekey timers on Initiator IPsec gateway; if your SFOS is Initiator, adjust P1/P2 timers to less than the P1/P2 values used on far end gw (responder) or vice-versa.

Hi Sreenivasulu Naidu 

Initiator are NSX side. So, should we set higher in SFOS ?

Note : I don't have privileged to adjust NSX side

Yes please. Higher values for both P1 and P2 to be used on SFOS side (Responder).

I've tried to set policy as you suggest :

1. Adjust P1/P2 timer

2. Change to IKEv2

Result is connection status now Established, but in NSX site still Down. So, I ask NSX team to further check it.

Thanks