When Phase fails, the tunnel never forms. Common causes:
Mismatched settings: Encryption, hash, or DH group don't match between peers. Both sides must agree on identical parameters.
Pre-shared key mismatch: The secret differs. Remember that PSKs are case-sensitive.
Identity mismatch: Main mode uses IP addresses for identity. If NAT changes the source IP, use Aggressive mode or NAT-T.
Check logs for ISAKMP errors indicating what failed.