Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted
Explorer

encryption failure: Ike version: ikev2 not supported for peer

Hi,

I'm trying to setup a Site-to-Site connection between Azure VPN and Checkpoint vSec (R77.30) on AWS.

I was able to setup a connection using Azure Basic gateway with IKEv1.

Now I'm trying to setup between Azure VPN (High Performance) gateway and Checkpoint vSec (R77.30).

High Performance gateway uses IKEv2 and have applied the following IKE policy on Azure Gateway.

Phase 1: AES256, SHA384, DH14, SA 28800

Phase 2: AES256, SHA256, PFS2048, SA 3600

I'm getting the error: encryption failure: Ike version: ikev2 not supported for peer

I'm new to checkpoint. Would be great if someone could tell me what the error means and if IKEv2 is even supported for the above Phase 1 and 2 parameters.

Thanks

Ron

0 Kudos
Reply
9 Replies
Highlighted
Champion
Champion

I'd recommend the following VPN configuration within Check Point for initial testing:

As Phase 1 SA Lifetime is expressed by Check Point in minutes, while the Phase 2 SA Lifetime is expressed in seconds please make sure to enter 480 min (28800 sec).

If that doesn't help as well, please perform a IKE debug as described in sk112139 together with sk33327.

0 Kudos
Reply
Highlighted
Explorer

Hi Danny,

I'll give your suggestions a try.

Thanks

Ron

0 Kudos
Reply
Highlighted
Explorer

Hi Danny, thanks for your suggestion, that got the VPN working.

Regards

Ron

0 Kudos
Reply
Highlighted
Champion
Champion

Great. I updated our Site-to-Site VPN Compatibility Matrix accordingly.

0 Kudos
Reply
Highlighted
Champion
Champion

I'm pretty sure to use IKEv2 with Azure it must be a route-based VPN instead of domain-based.  If you have CoreXL enabled on your gateway (which it is by default), you cannot do a route-based VPN on R77.30.  Turning off CoreXL will slam all firewall inspection duties (not just VPN-related functions) onto one core no matter how many cores the firewall has.  The performance impact of disabling CoreXL will range from minimal to utterly catastrophic depending on the total number of cores on the firewall.

If you upgrade the gateway to R80.10, route-based VPNs and CoreXL can be used together.

--
My book "Max Power: Check Point Firewall Performance Optimization"
now available via http://maxpowerfirewalls.com.

Gaia 3.10 Immersion Self-paced Video Series
now available at http://www.maxpowerfirewalls.com
0 Kudos
Reply
Highlighted
Explorer

Hi Tim,

Correct. I have route based VPN setup on Azure. The new gen VPN Gateways are only route based however applying IKE policy to the Azure connection enables gateway to establish connection to policy based devices.

I've also logged a support case with Azure support.

Thanks

Ron

0 Kudos
Reply
Highlighted
Explorer

Hi Ron,

I was wondering if you were able to share the configuration you used connecting to the Azure Basic VPN?

Many thanks

James

0 Kudos
Reply
Highlighted
Explorer

Hey James,

Its been over a year, I don't really remember the configuration I had, but let me dig through my notes and see what I find out. I don't have access to checkpoint device at present but happy to spin up a quick trial on AWS to test it out with Azure Basic GW 🙂 

Thanks

Ron

0 Kudos
Reply
Highlighted
Explorer

Hi Ron,

That would be amazing if you could help me out!
Many thanks

James

0 Kudos
Reply