Site-to-Site VPN Problem Invalid SPI

Hi Trio Fandi,In your configs, both IPsec gateways (SFOS and NSX) are set with same Phase1 and Phase2 rekey timers; it is recommended to use lower values of Phase1 and Phase2 rekey timers on Initiator IPsec gateway; if your SFOS is Initiator, adjust P1/P2 timers to less than the P1/P2 values used on far end gw (responder) or vice-versa.

Hi Sreenivasulu Naidu 

Initiator are NSX side. So, should we set higher in SFOS ?

Note : I don't have privileged to adjust NSX side

Yes please. Higher values for both P1 and P2 to be used on SFOS side (Responder).

Yes please. Higher values for both P1 and P2 to be used on SFOS side (Responder).

I've tried to set policy as you suggest :

1. Adjust P1/P2 timer

2. Change to IKEv2

Result is connection status now Established, but in NSX site still Down. So, I ask NSX team to further check it.

Thanks