encryption failure: Ike version: ikev2 not supported for peer

[Ron_N]

Hi,

I'm trying to setup a Site-to-Site connection between Azure VPN and Checkpoint vSec (R77.30) on AWS.

I was able to setup a connection using Azure Basic gateway with IKEv1.

Now I'm trying to setup between Azure VPN (High Performance) gateway and Checkpoint vSec (R77.30).

High Performance gateway uses IKEv2 and have applied the following IKE policy on Azure Gateway.

Phase 1: AES256, SHA384, DH14, SA 28800

Phase 2: AES256, SHA256, PFS2048, SA 3600

I'm getting the error: encryption failure: Ike version: ikev2 not supported for peer

I'm new to checkpoint. Would be great if someone could tell me what the error means and if IKEv2 is even supported for the above Phase 1 and 2 parameters.

Thanks

Ron

[Danny]

I'd recommend the following VPN configuration within Check Point for initial testing:

As Phase 1 SA Lifetime is expressed by Check Point in minutes, while the Phase 2 SA Lifetime is expressed in seconds please make sure to enter 480 min (28800 sec).

If that doesn't help as well, please perform a IKE debug as described in sk112139 together with sk33327.

[Ron_N]

Hi Danny,

I'll give your suggestions a try.

Thanks

Ron

[Ron_N]

Hi Danny, thanks for your suggestion, that got the VPN working.

Regards

Ron

[Danny]

Great. I updated our Site-to-Site VPN Compatibility Matrix accordingly.

[Timothy_Hall]

I'm pretty sure to use IKEv2 with Azure it must be a route-based VPN instead of domain-based.  If you have CoreXL enabled on your gateway (which it is by default), you cannot do a route-based VPN on R77.30.  Turning off CoreXL will slam all firewall inspection duties (not just VPN-related functions) onto one core no matter how many cores the firewall has.  The performance impact of disabling CoreXL will range from minimal to utterly catastrophic depending on the total number of cores on the firewall.

If you upgrade the gateway to R80.10, route-based VPNs and CoreXL can be used together.

--
My book "Max Power: Check Point Firewall Performance Optimization"
now available via http://maxpowerfirewalls.com.

[Ron_N]

Hi Tim,

Correct. I have route based VPN setup on Azure. The new gen VPN Gateways are only route based however applying IKE policy to the Azure connection enables gateway to establish connection to policy based devices.

I've also logged a support case with Azure support.

Thanks

Ron

[James_Mcintosh]

Hi Ron,

I was wondering if you were able to share the configuration you used connecting to the Azure Basic VPN?

Many thanks

James

[Ron_N]

Hey James,

Its been over a year, I don't really remember the configuration I had, but let me dig through my notes and see what I find out. I don't have access to checkpoint device at present but happy to spin up a quick trial on AWS to test it out with Azure Basic GW 🙂 

Thanks

Ron

[James_Mcintosh]

Hi Ron,

That would be amazing if you could help me out!
Many thanks

James