invalid ike sa

[Pavel88]

hello.

I have a vpn between checkpoint and a 3rd party with a dynamically assigned IP address,

I can establish a tunnel only from one way (from the 3rd party) but not from the checkpoint.

it uses a certificate.

from vpnd I can see a lot of massages : 

ikeSimpOrder::setPeer: peer is not a user (is user: 0) or invalid ike sa 

is this message relevant and something has to be checked? 

thank you.

[PhoneBoy]

That generally means your encryption domains are not subnetted/defined the same way on both sides.
See here to debug: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...