I have a Cisco 2901 router that has an IKEv1 IPSec VPN with a Palo Alto firewall. We had a problem with our existing VPN setup where it takes a long time to get the tunnel to come back up when re-negotiating (around 30 minutes or so). Both ends have the same IKE profiles. We managed to fix it by explicitly setting both peers to main mode. Now getting the tunnel back up after re-negotiation takes around 10 minutes or so to complete.
But this message keeps popping up on the logs even when I have already disabled aggressive mode by setting
crypto isakmp aggressive-mode disable on my end.
%CRYPTO-5-IKMP_AG_MODE_DISABLED: Unable to initiate or respond to Aggressive Mode while disabled
Both peers can already establish the tunnel but it still does take a while to bring it up online. The message above keeps repeating for about 5 to 6 times and the IKEv1 negotiation fails during that time until after the 5th or 6th time the message above comes up then it brings the tunnel online.
This message kept popping up even before we explicitly set both peers to use main mode. It's better than before but still takes a while to get the tunnel back up and running.