topic Re: Issue configuring VPN with VTI between Checkpoint and Azure in Firewall and Security Management

Issue configuring VPN with VTI between Checkpoint and Azure

Edu_Amores — Wed, 25 Mar 2020 21:35:58 GMT

Hello,

I am trying to make work a VPN tunnel between a Checkpoint Firewall (R80.10 Tale 259) and Azure but I am getting the following error:

Notify Payload

Critical: No
Length: 40
Next payload: Notify
Protocol: 0
Type: Quick Crash Detection Token
ndata: 1c 61 db 62 ad 9a 5b 98 3f 64 1b d1 c8 69 a2 b0 6f 0d c5 79 79 94 6c 15 02 3b 6a 16 df 1f be 43
spisize: 0

And then:

Notify Payload

Critical: No
Length: 8
Next payload: None
Protocol: IKE
Type: Invalid IKE SPI
spisize: 0

It is weird because Phase 1 and Phase 2 negotiate look ok at the begin but then I start to receive these messages and the tunnel does not get established.

My config parameters:

https://community.checkpoint.com/t5/Remote-Access-Solutions/Azure-Site-to-Site-VPn-fail/td-p/16102

I have tried to modify the timers following some Azure and Checkpoint documentation but without success. Adny idea about what coould be happening? Thank you very much. Best Regards.

Re: Issue configuring VPN with VTI between Checkpoint and Azure

PhoneBoy — Fri, 27 Mar 2020 23:23:08 GMT

You'll probably need to debug what's happening.
General debugging information for VPNs are here: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk63560

Re: Issue configuring VPN with VTI between Checkpoint and Azure

Trevor_Bruss — Sat, 06 Mar 2021 00:35:40 GMT

You ever get a resolution on this? We're seeing this same kind of error frequently with a Palo Alto peer on the other end of our tunnel. Just curious.

Re: Issue configuring VPN with VTI between Checkpoint and Azure

Wytoo — Fri, 15 Dec 2023 10:47:12 GMT

Would also be interested in the solution. Got the same issue here as well with a cisco device on the other end.

Re: Issue configuring VPN with VTI between Checkpoint and Azure

CIBC_Firewall_O — Wed, 27 Mar 2024 23:49:34 GMT

Anybody who had this with ASA and resolved it ? Same issue here R80.40.
worth pointing its IKEv2

Re: Issue configuring VPN with VTI between Checkpoint and Azure

Warhorse90 — Mon, 13 May 2024 01:00:37 GMT

I'm getting the same thing with R80.40 <> Azure Cloud VPN, has anyone found a solution to this? The SK listed above has also been deleted.