site to site vpn

[Oussa]

Hello,

We're trying to implement a site-to-site VPN, and i get the error  "Encryption Failure: according to the policy the packet should not have been decrypted".

We tried the url:

URL 1 : https://support.checkpoint.com/results/sk/sk64060

URL 2 : https://support.checkpoint.com/results/sk/sk97612

We tried the solution of url 1 and 2 it doesn't work despite having vpn enabled on both sides.

We have tried using and inbound NAT, but error message persists.

Client A has shophs gateway and client B has checkpoint r80.40 gateway.

Have you encountered this problem before? And how did you solve this?

Thx

[the_rock]

Check out below:

https://support.checkpoint.com/results/sk/sk108600

Now, here is what I can tell you. Error you get, 99% of the time is related to phase 2, so something with enc. domains. Firewall is simply "telliong" you that packet SHOULD have been encrypted. 

I gave below to few people here in the community and it always helped. If you check these valus in guidbedit, should be set to false. It simplty implies that CP would stop presenting largest possible subnet, even though its not supposed to. Not saying it would solve your issue, but it always helps.

ike_enable_supernet

ike_p2_enable_supernet_from_R80.20

ike_use_largest_possible_subnets

By the way, if you get confused, we can always do remote session.

Cheers,

Andy