topic Re: encryption failure: Ike version: ikev2 not supported for peer in General Topics

encryption failure: Ike version: ikev2 not supported for peer

Ron_N — Sun, 15 Oct 2017 14:55:54 GMT

Hi,

I'm trying to setup a Site-to-Site connection between Azure VPN and Checkpoint vSec (R77.30) on AWS.

I was able to setup a connection using Azure Basic gateway with IKEv1.

Now I'm trying to setup between Azure VPN (High Performance) gateway and Checkpoint vSec (R77.30).

High Performance gateway uses IKEv2 and have applied the following IKE policy on Azure Gateway.

Phase 1: AES256, SHA384, DH14, SA 28800

Phase 2: AES256, SHA256, PFS2048, SA 3600

I'm getting the error: encryption failure: Ike version: ikev2 not supported for peer

I'm new to checkpoint. Would be great if someone could tell me what the error means and if IKEv2 is even supported for the above Phase 1 and 2 parameters.

Thanks

Ron

Re: encryption failure: Ike version: ikev2 not supported for peer

Danny — Sun, 15 Oct 2017 19:39:27 GMT

I'd recommend the following VPN configuration within Check Point for initial testing:

As Phase 1 SA Lifetime is expressed by Check Point in minutes, while the Phase 2 SA Lifetime is expressed in seconds please make sure to enter 480 min (28800 sec).

If that doesn't help as well, please perform a IKE debug as described in sk112139 together with sk33327.

Re: encryption failure: Ike version: ikev2 not supported for peer

Timothy_Hall — Sun, 15 Oct 2017 19:54:24 GMT

I'm pretty sure to use IKEv2 with Azure it must be a route-based VPN instead of domain-based. If you have CoreXL enabled on your gateway (which it is by default), you cannot do a route-based VPN on R77.30. Turning off CoreXL will slam all firewall inspection duties (not just VPN-related functions) onto one core no matter how many cores the firewall has. The performance impact of disabling CoreXL will range from minimal to utterly catastrophic depending on the total number of cores on the firewall.

If you upgrade the gateway to R80.10, route-based VPNs and CoreXL can be used together.

--
My book "Max Power: Check Point Firewall Performance Optimization"
now available via http://maxpowerfirewalls.com.

Re: encryption failure: Ike version: ikev2 not supported for peer

Ron_N — Sun, 15 Oct 2017 21:39:58 GMT

Hi Danny,

I'll give your suggestions a try.

Thanks

Ron

Re: encryption failure: Ike version: ikev2 not supported for peer

Ron_N — Sun, 15 Oct 2017 21:47:46 GMT

Hi Tim,

Correct. I have route based VPN setup on Azure. The new gen VPN Gateways are only route based however applying IKE policy to the Azure connection enables gateway to establish connection to policy based devices.

I've also logged a support case with Azure support.

Thanks

Ron

Re: encryption failure: Ike version: ikev2 not supported for peer

Ron_N — Mon, 16 Oct 2017 01:16:25 GMT

Hi Danny, thanks for your suggestion, that got the VPN working.

Regards

Ron

Re: encryption failure: Ike version: ikev2 not supported for peer

Danny — Mon, 16 Oct 2017 07:00:24 GMT

Great. I updated our Site-to-Site VPN Compatibility Matrix accordingly.

Re: encryption failure: Ike version: ikev2 not supported for peer

James_Mcintosh — Mon, 07 Jan 2019 23:35:03 GMT

Hi Ron,

I was wondering if you were able to share the configuration you used connecting to the Azure Basic VPN?

Many thanks

James

Re: encryption failure: Ike version: ikev2 not supported for peer

Ron_N — Tue, 08 Jan 2019 21:32:07 GMT

Hey James,

Its been over a year, I don't really remember the configuration I had, but let me dig through my notes and see what I find out. I don't have access to checkpoint device at present but happy to spin up a quick trial on AWS to test it out with Azure Basic GW 🙂

Thanks

Ron

Re: encryption failure: Ike version: ikev2 not supported for peer

James_Mcintosh — Tue, 15 Jan 2019 03:31:40 GMT

Hi Ron,

That would be amazing if you could help me out!
Many thanks

James