L2TP Remote Access VPN - Can't Connect on SMB 2550 R82.00.10

CEEJAY — Tue, 21 Jul 2026 05:35:55 GMT

I have configured a Remote Access VPN in my Check Point Firewall 2550 using L2TP. I also setup the VPN on my windows laptop. But whenever I am trying to connect, the connection failed. I already double checked the configuration and settings. I also checked the logs from my firewall. I see Key Exchange logs and Informational Exchange Received Deleted IKE-SA from Peer. Is there any way to check the L2TP settings of my firewall?

Re: L2TP Remote Access VPN - Can't Connect on SMB 2550 R82.00.10

jorgeluiznim — Tue, 21 Jul 2026 12:22:21 GMT

Hi @CEEJAY ,

That screenshot is really useful — it narrows this down a lot. Two details stand out:

The log carries an IKE phase2 message ID, so Phase 1 completed and the failure is at/after Phase 2.
Interface direction: inbound means the Delete IKE-SA is coming from the peer — i.e. your Windows client is tearing the SA down, not the appliance rejecting it.

"Client deletes the SA right after Phase 2 completes" is a well-documented L2TP behaviour, and there's an SK that matches it exactly.

Most likely cause: NAT-T (sk98656)

sk98656 describes precisely this: "When NAT-T is used, the L2TP client sends a 'delete' packet after every successful Phase 2 completion." The cause is that Windows by default does not support IPsec NAT-T when the VPN server is behind a NAT device (also shows as error 809 on the client).

Fix, on the Windows client:

Open regedit as Administrator
Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent
Create a new DWORD (32-bit) value named AssumeUDPEncapsulationContextOnSendRule
Set the value to 2
Reboot the machine, then retry the connection

(Microsoft reference: kb926179.) If your 2550 sits behind any NAT — or the laptop is behind NAT — this is very likely your issue.

Second thing to check: Phase 2 encryption (sk87523)

sk87523 (the official L2TP-on-Spark guide) has an important note: "Starting from the R81.10.10 Jumbo Hotfix and higher versions, the Remote Access Encryption algorithm for phase 2 was changed from 3DES to AES-256. As a result, selecting the Data encryption setting as 'Require encryption (disconnect if server declines)' in the Windows OS Client will result in L2TP connection failure."

You're on R82.00.10, so you're on AES-256 for Phase 2. So on the Windows client make sure:

Data encryption → "Optional encryption (connect even if no encryption)" (not Require encryption)
Authentication → only "Unencrypted password (PAP)", clear all other options

Alternatively, if the client can't do AES-256, you can change the appliance advanced setting "Remote Access VPN - Encryption algorithm used for phase 2" to AES-128.

To answer your actual question — where to check the L2TP settings on the firewall

In the Spark WebUI:

Left panel → VPN
Remote Access section → Blade Control
VPN Remote Access Control must be On
Under VPN Remote Access users can connect via, the Windows VPN Client checkbox must be selected
On the Windows VPN Client line, the L2TP Pre-Shared Key link shows/sets the PSK — this must match exactly what's configured on the Windows client
On that same line there's a "How to connect" link — it opens an L2TP VPN Client Usage popup with the exact server IP, PSK and settings to use on the Windows side. That's the fastest way to confirm the firewall side matches the client side.

One more thing worth ruling out

If anyone has applied the CVE-2026-50751 mitigations (sk185033) on this appliance, be aware they can break L2TP by design:

Option 1 ("remove support for legacy Remote Access clients") is explicitly documented to prevent StrongSWAN, L2TP and legacy clients from connecting.
Option 2 for Spark sets Device > Advanced Settings > Remote Access VPN - Encryption Method to IKEv2 — and L2TP/IPsec is IKEv1-based, so it would stop working.

Worth a quick check of that advanced setting if the mitigations were applied recently.

Suggested order: apply the sk98656 registry fix + reboot → set Data encryption to Optional and PAP-only → retest. If it still fails, check the Encryption Method advanced setting for the IKEv2 mitigation.

References: sk98656, sk87523, sk185033.

Hope this helps!

Best regards,
Jorge Dias Junior

Re: L2TP Remote Access VPN - Can't Connect on SMB 2550 R82.00.10

Max_Leorne — Tue, 21 Jul 2026 12:37:15 GMT

Nice Job!
Congratulations!

topic L2TP Remote Access VPN - Can't Connect on SMB 2550 R82.00.10 in Spark Firewall (SMB)

L2TP Remote Access VPN - Can't Connect on SMB 2550 R82.00.10

Re: L2TP Remote Access VPN - Can't Connect on SMB 2550 R82.00.10

Most likely cause: NAT-T (sk98656)

Second thing to check: Phase 2 encryption (sk87523)

To answer your actual question — where to check the L2TP settings on the firewall

One more thing worth ruling out

Re: L2TP Remote Access VPN - Can't Connect on SMB 2550 R82.00.10