Site to Site VPN Authentication on reboots - Change PSK works

IPsec profiles on both sides match. Key times are good

Do you have wildcard tunnels? Using * for remote gateway? 

Yup! We do have 2 out of the 13 set with 0.0.0.0...
These 2 are ones we do notice more issues with.
What would the technical reason be for this?

Thanks!

Hello,

Are you running with v20 GA?

I have the same scenario, however we are unable to reproduce the issue in lab. Like you mentioned that, issue is reproduced with every reboot. I recommend raising the support case and provide me the ticket ID to take it further.

Hello,

In addition to above, could you also provide the details about the preshared key used. What's the total character size of it, does it include any special characters/symbols?

 Brennan Kostyniuk , Prior to v20 on SFOS, all IPsec (S2S - PBVPN and RBVPN and Remote Access) tunnels that has common local and remote gateways ("*" in the "remote gateway" field) should have same PSK. Changing PSK on any one of the connections or when new tunnel configured with existing common local and remote gateways (PortX, *) with a different PSK will overwrite the PSK of all the existing tunnels. 

If your SFOS is on v20 or above and IPsec tunnel uses IKEv2, to overcome such limitation, you can use IDs filed (Local ID/ Remote ID) in IPsec config. This helps having different PSKs for different tunnels when remote gateway=* .  Please try this and let us know if authentication issue resolves.

I just had a assumption, if i have 2 tunnels out of 20 configured with wildcards, those 2 tunnels should be the same PSK?.

Yes