Site2Site VPN AWS Setup

[Technical_Servi]

Hi All

We have just configured our first vpn with vti's to aws as described in sk100726.

The tunnels are up and running. Traffic from aws to our location goes through the tunnels.

So far so good. But our gw drops the packets with

"dropped by vpn_drop_and_log Reason: According to the policy the packet should not have been decrypted"

Any ideas or hints are highly appreciated!

Thanx in advance

Marc

[G_W_Albrecht]

Have a look here:

sk64060: 'Encryption Failure: according to the policy the packet should not have been decrypted' log...

sk97612: Site to Site VPN going down frequently with error "encryption failure: According to the pol...

sk106627: "According to the policy the packet should not have been decrypted" drop while using Route...

sk106837: Troubleshooting Overlapping Encryption Domains Issues

[Technical_Servi]

OK, we are one step further!

We fixed one problem
"dropped by vpn_drop_and_log Reason: According to the policy the packet should not have been decrypted"
The peer name in the GAIA vpn tunnel interface and the object name in SmartConsole must exactly match!

But as I said above, we are just one stop further. We got another problem.
Tunnels are still up and running.
A packet from AWS to our site reaches its final destination. But the answer is dropped on the CP with
"dropped by vpn_encrypt_chain Reason: Could not change connection vpn interface"