Then configuring an IPsec tunnel, I can usually set if the device should act as the initiator or the responder (or even both). However, what would happen if both endpoint are configured as the initiator and start the IKE negotiation at the same time? Will one of them switch to the responder role, or will the tunnel establishment fails?

More generally, should I always configure only one initiator and one responder or it does not matter if at least one device has the initiator role?

Thank you in advance.

1 Answer 1


I manage dozens of IPSEC tunnels with various equipment: Cisco ASA, Fortigate, Sophos, Juniper, linux based devices, etc... and I usually configure both endpoint as initiator and never had issue.

The one -obvious- case when you configure a device as responder only, is when the opposite site has a dynamic IP address, and so the peer IP address is unknown. In this case the dynamic site initiate the connection.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.