we are having an issue with VPN gateway, connection shows not connected

Question

we are having issue with Azure VPN connection which is showing as not connected, we have configured it using default settings and error message says as below.

IKEv2-S2S [ICookie] 0xB11A0743A19163DE [RCookie] 0x0 [TunnelId] 0x0 [IkeEvent] SA_NEGOTIATION_FAILED For [SA_type] MM_SA [SAEstablished] false [SA_CREATION_DIRECTION] Inbound [FailureDirection] Outbound [ErrorCode] 0x363A [ErrorMessage] Max number of established MM SAs to peer exceeded.

Thank you in advance.

Answer 1

Hello Soma Sekhara Viswanath Bottu

We understood that you are facing issue with Azure VPN connectivity.

Based on the error message you shared indicates that there's an issue with established IKEv2 Security Associations (SAs), specifically a "Max number of established MM SAs to peer exceeded" error.

This typically happens when the on-prem VPN device does not properly clear old or stale SAs or the Azure VPN Gateway has reached its limit for MM SAs from a single peer.

Here are steps you can validate and check :

1.Reset the Azure VPN Gateway Connection, by Resetting the connection clears existing MM SAs and forces a fresh IKE negotiation, which can resolve issues caused by stale or excessive SAs.

• In the Azure portal, navigate to the Virtual Network Gateway resource.
• Select the Connections blade and locate the affected site-to-site connection.
• click Reset to reset the connection.
• https://learn.microsoft.com/en-us/azure/vpn-gateway/reset-gateway

2.Verify the On-Prem VPN Device IKE Logs to Ensure it is not initiating too many simultaneous connections or failing to clean up old SAs.

3.Restart the On-Prem VPN Device: This can help clear stale SAs and reset the negotiation state.

4.Limit the Number of Simultaneous Connections to ensure that only one active tunnel is being negotiated at a time from the on-prem device.

5.Check Limits on Security Associations: The error suggests that you may have reached the maximum number of Security Associations. Investigate your on-premises VPN settings to see if there’s a limit on how many SAs can be established. You may need to adjust this.

1. If you have user-defined routes (UDRs) or network security groups (NSGs) applied on the gateway subnet, try temporarily removing them to see if they are causing the issue.

Refer: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-troubleshoot-site-to-site-error-codes

https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-troubleshoot

---

I hope this information is helpful! If my answer helped you resolve your issue, please consider marking it as the correct answer or Upvote. This helps others in the community find solutions more easily. Thanks!