topic Re: IKE failure : Reason unsupported encryption algorithm in Firewall and Security Management

IKE failure : Reason unsupported encryption algorithm

Ob1lan — Tue, 15 Feb 2022 14:33:24 GMT

Hi,

I'm trying to establish and IPSEC (S2S) tunnel between 2 managed Check Point firewalls. I previously succeeded with the same kind of HW/version. This one throws an error I've never seen before :

Main Mode Failed to match proposal: Transform: SHA1, Certificate, Group 2 (1024 bit); Reason: unsupported encryption algorithm -1 (NA)

I've tried lowering the algorithm, still the same issue.

Any idea how to troubleshoot that ? I'm currently planning on upgrading that remote GW to the latest available firmware, and rebooting it.

Thanks !

Re: IKE failure : Reason unsupported encryption algorithm

the_rock — Tue, 15 Feb 2022 15:42:21 GMT

I cant say 100% this is related, but just see what you have there. I changed mine, so yours would look different if you never touched it.

Andy

Re: IKE failure : Reason unsupported encryption algorithm

Ob1lan — Tue, 15 Feb 2022 15:48:18 GMT

Hi, thanks for your answer. In my case I don't have the same screen as yours, all should be set in the Community:

And in the said community (I tried various combination):

This works for more than 10 gateways in the same community (as Satellite), but doesn't work for a new one I wanted to add. 😞

Re: IKE failure : Reason unsupported encryption algorithm

the_rock — Tue, 15 Feb 2022 16:36:58 GMT

Ok, so just to make sure I get this right, apologies if I had wrong assumption. Are you saying there are multiple satellite gateways with one centre gateway? If so, is it the case that this new firewall you added is also a satellite, correct? And thats where you get the error?

Re: IKE failure : Reason unsupported encryption algorithm

Ob1lan — Wed, 16 Feb 2022 08:27:28 GMT

Exactly, this community is used for many of our remote offices, and I just want to add a new one into it. The Centre gateway is our main cluster, and the Satellites are the remote offices' firewalls. The one that I didn't succeed in adding is a remote office, so a Satellite. That's where I get the error.

Re: IKE failure : Reason unsupported encryption algorithm

Timothy_Hall — Wed, 16 Feb 2022 14:49:04 GMT

SHA1 has been deprecated for awhile now, is the new gateway perhaps running a newer version of code that is blocking the use of SHA1? DH Group 2 is pretty old but should still be supported by all code versions.

Re: IKE failure : Reason unsupported encryption algorithm

the_rock — Wed, 16 Feb 2022 15:07:47 GMT

I get what @Timothy_Hall is saying...though, I had seen customer running on R81.10 use sha1 and works perfectly fine. I would definitely confirm with TAC to get official statement/answer.

Re: IKE failure : Reason unsupported encryption algorithm

Ob1lan — Mon, 14 Mar 2022 15:07:01 GMT

Hi,

I actually updated the firmware to the latest version available, and it solved it.

Thanks for your help.

Regards.

Re: IKE failure : Reason unsupported encryption algorithm

G_W_Albrecht — Tue, 15 Mar 2022 11:46:32 GMT

These were SMB GWs ?

Re: IKE failure : Reason unsupported encryption algorithm

Ob1lan — Mon, 04 Apr 2022 07:13:56 GMT

Yes it was 🙂