IPsec S2S VPN between Check Point ( on premise ) and Huawei Cloud

[Sarm_Chanatip]

Click to Expand

Hi Experts!


We are encountering about setting up IPsec Site-to-Site VPN between Check Point Cluster and Huawei Public Cloud, the tunnel is being up, but the internal clients of both sides are not able to be communicating each other.
I found the logs dropped and got a message description said "Encryption Failure: according to the policy the packet should not have been decrypted"






Here are VPN setting on Check Point and Huawei Cloud


Check Point IPsec VPN configuration

















Huawei Cloud IPsec VPN configuration





Remark, in regards to Transfer Protocol this option does not have on checkpoint side.



For VPN rule, we have configured as below.





Does anyone here have experience about this before?



Really appreciate every comments. 



Regards,

Sarm

[PhoneBoy]

The error message generally means one side or another is not configured correctly.
More specifically, the configuration is related to what network(s) and subnets are reachable behind the VPN peers.
This must match on both ends, otherwise you will see errors like this.

[Sarm_Chanatip]

Hi Admin,

Thank you for comment.

The tunnel is up now, but I've got a new problem that is the host from HW Could cannot ping to some of the subnets, in this case from 10.3.1.97 <> 10.10.2.3, for an example. look at a red arrow.

We tried to traceroute command and found the packet was stuck at Check Point but not sure where steps I'm missing configuration

Please kindly advise.

Regards,

Sarm