TheGreenBow Support

	Login \| Contribute \| Search \| Careers \| Contacts
	Language

Products

IPSec VPN Client VPN Mobile CryptoMailer

Products FAQ

IPSec VPN Client VPN Mobile FAQ CryptoMailer

Contacts

Support form

Feature request

All contacts

You are trying to open a VPN tunnel and you are experiencing the following error:

Error VPN087: "No keystate" (Local ID mismatch or wrong PSK).

The message "No keystate" was received. It means either the pre-shared key is wrong or the Local ID of the IPSec VPN Client doesn't match the Remote ID of the VPN Gateway or peer.

Note: this message may also be received on various values mismatches, thus it is useful you check the whole VPN configuration.

Console message example:

20090429 115317 Default (SA Cnx-P1) SEND phase 1 Main Mode [KEY][NONCE]
20090429 115319 Default (SA Cnx-P1) RECV phase 1 Main Mode [KEY][NONCE]
20090429 115319 Default (SA Cnx-P1) SEND phase 1 Main Mode [ID][HASH][NOTIFY]
20090429 115319 Default ipsec_get_keystate: no keystate in ISAKMP SA 00B57C50

You may:

Check the preshared key (Phase 1) is correct and consistent on both sides of the VPN connection (Client and Gateway/peer).
Check in "Phase 1 advanced" the Local ID matches the value and type defined in the VPN Gateway.
Warning: the local ID on the router is the remote ID on the IPSec VPN Client and conversely !
Check also the logs of the remote VPN Gateway to get more information about this problem.
Check the IP address range.
Check the remote ID.
Check the PFS to be activated or not on both peers (Client and Router).
Restart the router.

Back