Buy or Renew
Buy or Renew
Duo Security forums now LIVE! Get answers to all your Duo Security questions. Learn more
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
739
Views
0
Helpful
2
Replies

VPN 3000 Concentrator

Go to solution
wgranada1
Level 1
Level 1

‎10-28-2008 07:57 AM - edited ‎02-21-2020 03:04 AM

Does anyone know where I can find the meaning of this message?

465 10/28/2008 14:48:06.640 SEV=4 IKEDBG/97 RPT=410 208.96.196.242

Group [208.96.196.242]

QM FSM error (P2 struct &0x6810ef4, mess id 0xeb16b91f)!

466 10/28/2008 14:48:06.640 SEV=7 IKEDBG/65 RPT=39116 208.96.196.242

Group [208.96.196.242]

IKE QM Initiator FSM error history (struct &0x6810ef4)

<state>, <event>:

QM_DONE, EV_ERROR

QM_WAIT_MSG2, EV_TIMEOUT

QM_WAIT_MSG2, NullEvent

QM_SND_MSG1, EV_SND_MSG

0 Helpful
1 Accepted Solution

Accepted Solutions

Go to solution
ajagadee
Cisco Employee
Cisco Employee

‎10-28-2008 08:35 AM

Hi,

QM FSM Error

The IPsec L2L VPN tunnel does not come up on the PIX firewall or ASA, and the QM FSM error message appears.

One possible reason is the proxy identities, such as interesting traffic, Access Control List (ACL) or crypto ACL, do not match on both the ends. Check the configuration on both the devices, and make sure that the crypto ACLs match.

http://www.cisco.com/en/US/tech/tk583/tk372/technologies_tech_note09186a00800949c5.shtml#qms

Regards,

Arul

*Pls rate if it helps*

View solution in original post

0 Helpful
2 Replies 2

Go to solution
ajagadee
Cisco Employee
Cisco Employee

‎10-28-2008 08:35 AM

Hi,

QM FSM Error

The IPsec L2L VPN tunnel does not come up on the PIX firewall or ASA, and the QM FSM error message appears.

One possible reason is the proxy identities, such as interesting traffic, Access Control List (ACL) or crypto ACL, do not match on both the ends. Check the configuration on both the devices, and make sure that the crypto ACLs match.

http://www.cisco.com/en/US/tech/tk583/tk372/technologies_tech_note09186a00800949c5.shtml#qms

Regards,

Arul

*Pls rate if it helps*

0 Helpful

Go to solution
wgranada1
Level 1
Level 1
In response to ajagadee

‎10-29-2008 06:54 AM

Yes this makes it clearer, just a fyi found out the the distant end didn't have a route back. Thanks for your help!!!!

0 Helpful
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Customers Also Viewed These Support Documents
Review Cisco Networking products for a $25 gift card