Description: This object specifies the state of the IKE connection between the peers. 1. closed - No IKE SA exists between peers because it was not negotiated yet, or because last IKE closed normally due to hard timeout, clear by admin, or DELETE received from the remote peer. This is also the initial state of the row when it is created. 2. inProgress - No IKE SA exists between peers, but it is currently being negotiated in Phase-1. 3. established - IKE SA exists between peers. 4. failed - No IKE SA exists between peers because of a failure. Possible reasons are: 1. Last time we tried to establish IKE the negotiation failed. 2. Last time we tried to establish IKE the remote peer DNS resolution failed. 3. During last connection DPD signaled a connection failure. 4. During last connection a track object signaled a connection failure. 5. The interface used for local-address does not have an IP address asigned to it 1 minute or more after this row was created. 6. Last time we negotiated Phase-2 the negotiation timed-out, and the current IKE was subsequently deleted.

NOTE: When continuous-channel IKE is used, the state shall remain 'established' during the normal transition time between one IKE SA and the next. However, if the IKE SA was deleted due to a suspected problem then the state will change normally during the transition (i.e. 'closed' and then 'inProgress'). [Suspected problem: if the last IKE SA was DELETEd by the remote peer after less then 5 minutes,or if it was deleted by local admin]