R81.10 VPN encryption domain override

[Ryan_Ryan]

Hi,

I have used the encryption domain override on both the center and remote gateways in two different vpns on two r81.10 gateways. Everything worked fine to my Cisco router on the other end with matching encryption domains (I am using mainly /32 host addresses).

However I then noticed something was not right, when I tried to send traffic in the other direction, sourced from behind checkpoint to the far end it did not work, in the checkpoint logs it said no SA has been established, although there was a matching SA for these host pairs as I could run the same traffic in the opposite direction without issue.

I turned debugging on the Cisco phase 2 and found the checkpoint was trying to propose a  /16 mask for the local network address which is in the gateways encryption domain, the /16 was not in the override, I tested by temporarily adding a /16 to the enc domain on the cisco side and guess what it worked.

Is there any reason why checkpoint would not use its override domain for outgoing traffic?