invalid ike sa

Pavel88 — Fri, 12 Jun 2020 11:13:27 GMT

hello.

I have a vpn between checkpoint and a 3rd party with a dynamically assigned IP address,

I can establish a tunnel only from one way (from the 3rd party) but not from the checkpoint.

it uses a certificate.

from vpnd I can see a lot of massages :

ikeSimpOrder::setPeer: peer is not a user (is user: 0) or invalid ike sa

is this message relevant and something has to be checked?

thank you.

Re: invalid ike sa

PhoneBoy — Mon, 15 Jun 2020 03:07:39 GMT

That generally means your encryption domains are not subnetted/defined the same way on both sides.
See here to debug: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk108600