If the SA negotiation was locally activated, verify that the IP address is local to this stack. Use the Netstat HOME/-h command to view the list of IP addresses local to this stack. See the information about the Netstat HOme/-h in z/OS Communications Server: IP System Administrator's Commands for information about displaying the Netstat HOME/-h report.

When configured without the IBM® Configuration Assistant for z/OS® Communications Server, check for LocalDynVpnRule statements with LocalIp or LocalIpRef parameters that specify an IP address that is not local to this stack and, if necessary, correct the policy. See the information about the Policy Agent and policy applications in z/OS Communications Server: IP Configuration Reference for more information about configuring policy.

When configured with the IBM Configuration Assistant for z/OS Communications Server, edit the corresponding Connectivity Rule in the GUI and verify that the local IP address is local to this stack. If your local data endpoint is a single IP address, verify that it is local to this stack. If the local data end point value is an asterisk (*), verify that your Advanced IPSec: Dynamic Tunnels: Local Activation Settings are correct and contain only IP addresses local to this stack. See the online helps in the GUI for additional information.