topic Re: encryption failed : clear text should be encrypted - tunnel between checkpoint firewall, fortiga in General Topics

encryption failed : clear text should be encrypted - tunnel between checkpoint firewall, fortigate

LeeBingKang — Thu, 06 Apr 2023 09:00:11 GMT

Hi All,

Recently, I face an issue whereby the vpn peer site (fortigate 60F fortiOS 6.2.4) need to restart tunnel manually to let traffic run normally.

Usually, there is a symptom whereby peer site's encrypted packet being drop by checkpoint firewall (R77.30) with the reason: "encryption failed : clear text should be encrypted" (refer to image below). Hence, appreciate if someeone able to share me the meaning of the message.

Thank you.

Re: encryption failed : clear text should be encrypted - tunnel between checkpoint firewall, fortiga

PhoneBoy — Thu, 06 Apr 2023 09:40:44 GMT

R77.30 is End of Support.
However, the message means the gateway received a cleartext packet that it expects to receive encrypted.
This is quite likely Scenario 3 in: https://support.checkpoint.com/results/sk/sk108600

Re: encryption failed : clear text should be encrypted - tunnel between checkpoint firewall, fortiga

LeeBingKang — Thu, 06 Apr 2023 10:03:59 GMT

Hi phoneboy,

Thanks for the explanation.

I have another things seek your suggestion. Based on the screenshot provided, i found out there is a "PFS" mentioned in the data encryption method and there is no PFS enable both sides based on the current vpn configuration on both site (fortigate and checkpoint).

Hence, is that possible cause checkpoint think that this packet is clear text as it being encrypted with PFS as well?

Re: encryption failed : clear text should be encrypted - tunnel between checkpoint firewall, fortiga

G_W_Albrecht — Thu, 06 Apr 2023 10:27:32 GMT

PFS use is very usual, so i do not think that it could be an issue here...

Re: encryption failed : clear text should be encrypted - tunnel between checkpoint firewall, fortiga

LeeBingKang — Thu, 06 Apr 2023 10:40:43 GMT

Hi @G_W_Albrecht ,

Hmm... PFS is usually use. However, I'm this PFS also use as data encryption is normal in my scenario whereby both sites dont have enable PFS...

Re: encryption failed : clear text should be encrypted - tunnel between checkpoint firewall, fortiga

the_rock — Thu, 06 Apr 2023 12:00:55 GMT

Can you get ike.elg file from $FWDIR/log directory on the fw and open it in ikeview and see where exactly the connection fails? What phase/packet?

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk30994

Andy

Re: encryption failed : clear text should be encrypted - tunnel between checkpoint firewall, fortiga

Timothy_Hall — Thu, 06 Apr 2023 12:02:16 GMT

All PFS does is compute a fresh encryption key via Diffie Hellman for the Phase2/IPSec tunnel instead of reusing the key calculated during Phase 1, the state of PFS should not affect whether traffic is encrypted or not on either side.