I’ve seen a lot of people complaining about getting this error in Phase 2, but if you get this during Phase 1 – you probably forgot to add a rule for the IPSEC traffic to the firewall policy.