topic Re: Failed to enforce VPN policy (11) in Firewall and Security Management

Failed to enforce VPN policy (11)

Slavko_Kojic — Tue, 16 Nov 2021 08:01:30 GMT

Hello Checkmates,

Customer has request to establish a VPN tunnel over an existing VPN tunnel ( two miktotiks over existing VTI tunnel between CheckPoint R80.40 and Juniper).

When tunnel is initiated from Miktrotik behind CP, the IKE packet is dropped from CP with message:
"Failed to enforce VPN policy (11)".

Regard, sk106241.

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk106241#Scenario%202

I've changed setting fw ctl set int encrypt_non_gw_rdp_ike 1 , but without success

Please, do you have some suggestions about this problem, or is TAC necessary for this.

Re: Failed to enforce VPN policy (11)

_Val_ — Thu, 18 Nov 2021 09:13:43 GMT

Yes, please raise a TAC case. Also, the mentioned SK does not seem to be related to your specific case.

Re: Failed to enforce VPN policy (11)

_Val_ — Thu, 18 Nov 2021 09:19:36 GMT

Actually, it is relevant. the second case "Site to Site" seems to be your situation. Did you try setting up VPN debug, as SK recommends?

Re: Failed to enforce VPN policy (11)

Slavko_Kojic — Sat, 27 Nov 2021 23:42:46 GMT

Hi Val, thank you for answer, sorry for late response, meanwhile client has decided for other better solution. If we have same request in future, we will take debug.