topic Re: Why is my BGP (TCP 179) traffic getting blocked by Check Point when set up vpn to AWS in Firewall and Security Management

Why is my BGP (TCP 179) traffic getting blocked by Check Point when set up vpn to AWS

vanhieuptit4 — Sun, 18 May 2025 06:47:06 GMT

Hi all,

I’ve successfully established a VTI-based VPN tunnel between my Check Point firewall and AWS. Phase1 up, phase2 down beacause rule block for connect ip 169.254.x.11 (AWS point) --> 169.254.x.10 (Onprem point) service bgp tcp/179. I’m seeing logs that say:

"According to the policy the packet should not have been decrypted"

I have already:

Set VPN domains to 0.0.0.0/0 (Empty Group) on both ends.
Enabled "VPN Directional Match in VPN Column" and configured the VPN column accordingly. "Choose "Add" to add directional match rules as follows:
a. internal_clear --> vpn-02f8b875e8179c57b
b. vpn-02f8b875e8179c57b --> vpn-02f8b875e8179c57b
c. vpn-02f8b875e8179c57b --> internal_clear"
Created rules to allow communication between AWS and on-prem subnets.

Still, the traffic for BGP (port 179) seems to get blocked — and the log shows it's being dropped on the external interface (eth0), not on the VTI interface (vpnt1). I suspect the stealth rule might be affecting this traffic.

Thanks in advance for any help!

Re: Why is my BGP (TCP 179) traffic getting blocked by Check Point when set up vpn to AWS

_Val_ — Mon, 19 May 2025 07:25:05 GMT

According to your VPN settings, all traffic between the GWs should be encrypted, yet BGP is sent in clear text. You may want to tackle this by excluding BGP form the VPN and reinstalling policy

Re: Why is my BGP (TCP 179) traffic getting blocked by Check Point when set up vpn to AWS

the_rock — Mon, 19 May 2025 20:24:26 GMT

Apart from great point @_Val_ made, which tells you that packet should have been encrypted, you can also try zdebug and see if same failure occurs.

Andy

Re: Why is my BGP (TCP 179) traffic getting blocked by Check Point when set up vpn to AWS

vanhieuptit4 — Mon, 19 May 2025 21:45:05 GMT

Hi,

Thanks for the suggestions. I’ve followed the recommendation to exclude BGP (TCP 179) from the VPN community and reinstalled policy, but I still see the same log:

"According to the policy the packet should not have been decrypted"

The traffic is still being dropped,

I added TCP 179 (BGP) under “Excluded Services” in the VPN community and pushed policy.

I allowd bgp in policy rule.

I see traffic BGP going out interface vpnt1, but traffic arrive to interface eth0,

Re: Why is my BGP (TCP 179) traffic getting blocked by Check Point when set up vpn to AWS

the_rock — Tue, 20 May 2025 00:15:26 GMT

K, one sec...now that I think about it, seems as if BGP range should be in vpn domain, since it should be encrypted, according to the message.

Technically, CP domain does not need to be empty group, only AWS one.

Maybe change that and test.

Andy

Re: Why is my BGP (TCP 179) traffic getting blocked by Check Point when set up vpn to AWS

the_rock — Tue, 20 May 2025 00:31:49 GMT

Also, if you think stealth rule might be the culprit, just try disable it temporarily and test. FWIW, I always found BGP works way better when using unnumbered VTIs.

Andy

Re: Why is my BGP (TCP 179) traffic getting blocked by Check Point when set up vpn to AWS

emmap — Tue, 20 May 2025 03:22:33 GMT

I believe 'should not have been decrypted' means that it came in encrypted, the gateway decrypted it to see what was inside, then thinks 'hey this should have been sent in the clear'. BGP in this case should be encrypted, so don't exclude it from the tunnel.

Have you checked this: https://support.checkpoint.com/results/sk/sk106627

Re: Why is my BGP (TCP 179) traffic getting blocked by Check Point when set up vpn to AWS

the_rock — Tue, 20 May 2025 03:25:51 GMT

That was my thinking as well.

Re: Why is my BGP (TCP 179) traffic getting blocked by Check Point when set up vpn to AWS

vanhieuptit4 — Tue, 20 May 2025 07:30:58 GMT

Yes, It's work when set vpnt1 to peer name

Thanks for solution

Re: Why is my BGP (TCP 179) traffic getting blocked by Check Point when set up vpn to AWS

the_rock — Tue, 20 May 2025 12:06:23 GMT

I assumed you had that already. Glad you got it now!