topic Re: Negotiation with site failed in SASE and Remote Access

Negotiation with site failed

flachance — Tue, 27 Jan 2026 19:54:45 GMT

We're using Machine cert to authenticate. Client is 88.70.

I have one user that used to connect with no issues and now he is getting Negotiation with site failed.

His certificate looks fine so I'm not sure where it's failing.

What are the logs that we can check to possibly get more details on the failed negotiation? trac.log? Anything else?

thanks

Re: Negotiation with site failed

the_rock — Tue, 27 Jan 2026 20:47:44 GMT

Check the logs by filtering for the blade itself.

Re: Negotiation with site failed

israelfds95 — Tue, 27 Jan 2026 21:39:12 GMT

This user was working and then stopped. However, this raises some questions:

Is this situation occurring only with this single user, or are others experiencing the same issue?
If it is an isolated case, is the user’s internet connection working properly?
Verify whether the user’s machine certificate has expired.
Update the GPO if necessary, or renew the certificate.
If this is a more global issue, it is also worth checking whether there was any problem with the ISP link.
Collect the endpoint logs from the affected machine, gather the vpnd.elg logs, and review the authentication logs for this user shown in SmartConsole for understand what is happening with this authentication.
How to collect VPN logs from the Endpoint Security Client / Endpoint Security VPN
https://support.checkpoint.com/results/sk/sk169258
Open a TAC case and send the log collected if necessary.

Best regards

Re: Negotiation with site failed

the_rock — Wed, 28 Jan 2026 03:54:48 GMT

All super valid points @israelfds95

Re: Negotiation with site failed

flachance — Wed, 28 Jan 2026 13:28:10 GMT

Great stuff thanks. 1-Issue is with one single user. 2-Internet connection working properly. 3-Machine cert is valid.

4- User works remotely full time, so no VPN = no GPO update or cert renewal. For the time being he's using Citrix. I could get him to come in but if possible I'd like to know what's going on in case it happens again to someone else. If the only solution is to come in and update the GPO and renew the cert that'll be it but I'd like to try and find another way if there is one.

5-not a global issue

6- That's where I am. There is a lot of logs when you collect them from the endpoint. Is there some that correspond more to the vpn negotiation?

Re: Negotiation with site failed

israelfds95 — Wed, 28 Jan 2026 13:59:41 GMT

Ok, so it seems to be an isolated issue. The trac.log usually provides more information, but it’s also worth checking the other .log files. I don’t know all of them in detail, so it’s a good idea to try to reproduce the issue, collect the logs, and send them to TAC for analysis.

In SmartConsole, did you find any relevant logs about this user’s failed authentication attempt? If so, please let us know what they show.

Is the number of Office Mode IPs within limits? Sometimes it can reach the maximum.

When the user tries to authenticate, what error message is shown on the endpoint?

It would be helpful to schedule a new call with the user and collect evidence while they try to connect. Try to capture as many logs as possible at the moment of the error, check them in SmartConsole and in trac.log, and make sure that Enable logging – Extended is enabled when running it️

Re: Negotiation with site failed

the_rock — Wed, 28 Jan 2026 14:05:50 GMT

Totally valid point. @flachance Any way you can have that user reinstall the VPN client, then create vpn site brand new and test? Have them install latest version, E89.10

Re: Negotiation with site failed

flachance — Wed, 28 Jan 2026 14:25:01 GMT

No seeing anything that looks useful in smartconsole logs. But I just got a new element to the story. This started after the user installed an out of band windows update (Update for Windows (KB5077797)). Someone else also just did that and got the same issue. They uninstalled the update but the issue is still there.

One will connect at work and try a gpupdate. If it fails he'll try uninstall/reinstall.

I'll add updates after they tried

Re: Negotiation with site failed

the_rock — Sat, 31 Jan 2026 18:31:22 GMT

K, fair enough...so, it sounds most likely was a windows update issue. Are they able to uninstall it, reboot and test?

Re: Negotiation with site failed

the_rock — Sun, 01 Feb 2026 17:33:47 GMT

Hey @flachance

I was actually able to replicate your issue in the lab with that windows update, had exact same problem.

Re: Negotiation with site failed

flachance — Mon, 02 Feb 2026 14:32:30 GMT

Just as I was ruling out that windows update 😆. The second user who reported the issue actually had a different issue (trouble with his Internet connection). The first one tried to uninstall the update/reboot but still has the issue. I tried installing the update myself and everything works fine. Back to gathering logs...

Re: Negotiation with site failed

the_rock — Mon, 02 Feb 2026 14:39:46 GMT

I dont really believe in life coincidences, but hey, this could have been one of those : - )

Anyway, if it did not happen for you, maybe different processor type? Just a guess...

Re: Negotiation with site failed

flachance — Tue, 03 Feb 2026 13:57:47 GMT

No we have the exact same laptop model. He did try to uninstall the Windows update and it didn't work. Where you able to make it work by uninstalling the Windows update?

Re: Negotiation with site failed

the_rock — Tue, 03 Feb 2026 14:14:48 GMT

Just uninstalled it from windows update options, from settings.

Re: Negotiation with site failed

flachance — Tue, 03 Feb 2026 15:54:56 GMT

did the remote access vpn starts working again after you uninstalled the Windows update?

Re: Negotiation with site failed

the_rock — Tue, 03 Feb 2026 16:32:40 GMT

It did, yes.

Re: Negotiation with site failed

the_rock — Thu, 05 Feb 2026 15:36:21 GMT

Hey mate,

Any luck with this? Did uninstalling the latest windows update work?

Re: Negotiation with site failed

flachance — Thu, 05 Feb 2026 15:50:48 GMT

No uninstalling the Windows update didn't work. User will go to the office and connect on the network. We'll see if the problem remains after.

Re: Negotiation with site failed

the_rock — Thu, 05 Feb 2026 15:52:29 GMT

K, keep us posted.

Re: Negotiation with site failed

flachance — Thu, 26 Feb 2026 13:40:44 GMT

So the user was finally able to go onsite and connect to the network which apparently fixed the issue. Still not sure why it happened tough is certificate was valid and all. Anyway it works now.