site to site vpn

Oussa — Fri, 28 Apr 2023 14:11:10 GMT

Hello,

We're trying to implement a site-to-site VPN, and i get the error "Encryption Failure: according to the policy the packet should not have been decrypted".

We tried the url:

URL 1 : https://support.checkpoint.com/results/sk/sk64060

URL 2 : https://support.checkpoint.com/results/sk/sk97612

We tried the solution of url 1 and 2 it doesn't work despite having vpn enabled on both sides.

We have tried using and inbound NAT, but error message persists.

Client A has shophs gateway and client B has checkpoint r80.40 gateway.

Have you encountered this problem before? And how did you solve this?

Thx

Re: site to site vpn

the_rock — Fri, 28 Apr 2023 14:34:16 GMT

Check out below:

https://support.checkpoint.com/results/sk/sk108600

Now, here is what I can tell you. Error you get, 99% of the time is related to phase 2, so something with enc. domains. Firewall is simply "telliong" you that packet SHOULD have been encrypted.

I gave below to few people here in the community and it always helped. If you check these valus in guidbedit, should be set to false. It simplty implies that CP would stop presenting largest possible subnet, even though its not supposed to. Not saying it would solve your issue, but it always helps.

ike_enable_supernet

ike_p2_enable_supernet_from_R80.20

ike_use_largest_possible_subnets

By the way, if you get confused, we can always do remote session.

Cheers,

Andy

topic site to site vpn in SASE and Remote Access

site to site vpn

Re: site to site vpn