Hello,
On SSG350M, the state of 'get sa' output is A/D which is Active/Down. So on SSG350, Phase 2 is down.
From ISG logs, it looks like on ISG phase 2 is complete, but SSG350M does not bring Phase 2 up & instead continues sending ike messages to ISG resulting in VPN flaps.
Use following debubg on both sides to get 'ike related logs' which will give more information:
On SSG350M:-
undebug all
set db size 4096
clear db
set sa-filter <IP address of ISG>
debug ike detail
On ISG:
undebug all
set db size 4096
clear db
set sa-filter <IP address of SSG>
debug ike detail
Regards,
Rushi