topic Re: Site2Site VPN AWS Setup in Firewall and Security Management

Site2Site VPN AWS Setup

Technical_Servi — Thu, 12 Dec 2019 10:56:40 GMT

Hi All

We have just configured our first vpn with vti's to aws as described in sk100726.

The tunnels are up and running. Traffic from aws to our location goes through the tunnels.

So far so good. But our gw drops the packets with

"dropped by vpn_drop_and_log Reason: According to the policy the packet should not have been decrypted"

Any ideas or hints are highly appreciated!

Thanx in advance

Marc

Re: Site2Site VPN AWS Setup

G_W_Albrecht — Thu, 12 Dec 2019 11:19:24 GMT

Have a look here:

sk64060: 'Encryption Failure: according to the policy the packet should not have been decrypted' log in SmartView Tracker for VPN Tunnel Test packet

sk97612: Site to Site VPN going down frequently with error "encryption failure: According to the policy the packetshould not have be

sk106627: "According to the policy the packet should not have been decrypted" drop while using Route Based VPN

sk106837: Troubleshooting Overlapping Encryption Domains Issues

Re: Site2Site VPN AWS Setup

Technical_Servi — Fri, 10 Jan 2020 13:18:48 GMT

OK, we are one step further!

We fixed one problem
"dropped by vpn_drop_and_log Reason: According to the policy the packet should not have been decrypted"
The peer name in the GAIA vpn tunnel interface and the object name in SmartConsole must exactly match!

But as I said above, we are just one stop further. We got another problem.
Tunnels are still up and running.
A packet from AWS to our site reaches its final destination. But the answer is dropped on the CP with
"dropped by vpn_encrypt_chain Reason: Could not change connection vpn interface"