When phase two of a VPN does not establish a connection and the peer is using a policy-based VPN configuration, the critical part of the configuration to verify is the Proxy-IDs. Policy-based VPNs require that the Proxy-IDs, which define the traffic selector values, match exactly on both sides of the VPN tunnel. Incorrect or mismatched Proxy-IDs would cause phase two failures as the devices would be unable to properly negotiate and encrypt the traffic.