- Products
- Learn
- Local User Groups
- Partners
- More
Introduction to Lakera:
Securing the AI Frontier!
Quantum Spark Management Unleashed!
Check Point Named Leader
2025 Gartner® Magic Quadrant™ for Hybrid Mesh Firewall
HTTPS Inspection
Help us to understand your needs better
CheckMates Go:
SharePoint CVEs and More!
Hi All,
We have a requirement to setup Site-to-Site vpn between our Checkpoint FW and customer Palo Alto FW. I have created one, but the issue is IKE phase 2 fails. I have confirmed the negotiation parameters with my customer engineer and it looks like everything is in order. What could be the possible issue?
I used VPN tu and SmartView monitor to view but to no success. Any advices will be highly appreciated
Thank you so much
We are not using 10.10.10.10 internally nor it is used externally. Our extenal IP ,for example : 192.168.1.2.
The 10.10.10.10/32 is the IP configured at customer site and they need us to use that IP, as it is set as an encryption domain( at Palo Alto side they have configured the remote IP in Proxy ID side as 10.10.10.10/32). So during IKE phase 2 the subnet will fail if I use my subnet ie, 172.31.1.0/24.
The error is ,
": IKE phase-2 negotiation failed when processing proxy ID. cannot find matching phase-2 tunnel for received proxy ID. received local id: 11.0.0.0/8 type IPv4_subnet protocol 0 port 0, received remote id: 192.168.1.2/32 type IPv4_address protocol 0 port 0. "
Let us say for the Primary GW(customer side) : the remote IP is 10.10.10.10/32 and for the secondary GW(cust side) : the remote IP is 10.10.11.10/32
May be they choose these IPs to segregrate the network as for both the Gateways, the domain is 11.0.0.0/8
What will be the best way to accomodate the requirement.
Pardon me, still not clear enough. Proxy ID is the IP address of the remote GW. PAN has to use your main IP address for the tunnel to work. Now, that 10.10.10.10, does it belong to one of your GW interfaces?
No. I have no interface with that IP. Customer have their Palo Alto like that.
as per their proxy ID settings,
Proxy ID Local Remote Protocol
PID.10 11.0.0.0/8 10.10.10.10/32 any
Ask them to change remote proxy ID IP to your address. There no way you can build a VPN with a dummy IP
They have Cisco and Fortinet firewall setup with this configuration but they don't have any Checkpoint where we can refer the setup.
Check out this video: VPN PSK - Check Point & Palo Alto Networks - YouTube
Finally the issue got resolved. We added the encryption domain to Checkpoint Gateway and NATed the Public IP(or NAT IP) customer provided.
(For information purpose): we used a Mesh community for the configuration.
Thank you so much guys ! Really appreciate your help and support.
No problem, I am glad the issue is resolved
Hi Tim/Valeri,
I have same problem. Establishing tunnel between Checkpoint FW & Palo Alto (It is in Azure). Tunnel is UP at both end but traffic is not passing. We Can see traffic is encrypting in tunnel but not reaching at peer end. I have done all scenarios which are suggested in this thread.
Checkpoint side : Domain Based VPN
Palo Alto side : Route Based VPN
In checkpoint side, Toggled between subnet pair & gateway pair in tunnel management.
In Palo Alto side, Given specific proxy IDs
But still traffic is not passing even though tunnel is UP.
Please provide the Key Exchange logs indicating that IKE Phase 1 has completed (Main Mode) and the log indicating that IKE Phase 2 has completed (Quick Mode). My guess is you won't find the latter one as only the Phase 1 tunnel is up, which is why traffic is not passing.
I am attempting a site to site VPN with a Palo Alto and Check Point R80.10 in a lab before trying in production and I am still stuck on trying to get phase 2 to negotiate.
On the Check Point I am using a start VPN topology, "One VPN tunnel per subnet pair", and the encryption domain contains the one and only network behind the Check Point - 10.10.10.0 / 24.
On the Palo Alto side I have a static route configured to 10.10.10.0/24 with the router interface being the VPN tunnel. I have tried with a proxy id of local 10.30.30.0 /24 (behind palo alto) remote 10.10.10.0 /24, and without any proxy ID. I tried to configure a proxy id of 0.0.0.0/0 0.0.0.0/0 with a protocol of 0 (Palo Alto won't accept this config) as well as "any".
On the Check Point side I get "IKE failure" , "Encryption Failure: no response from peer.", and on the Palo Alto
2020-01-22 15:18:17.480 -0500 [PNTF]: { 2: }: ====> PHASE-2 NEGOTIATION STARTED AS RESPONDER, (QUICK MODE) <====
====> Initiated SA: 172.16.1.30[500]-172.16.1.10[500] message id:0xBEC56C26 <====
2020-01-22 15:18:17.480 -0500 [ERR ]: { 2: }: can't find matching selector
2020-01-22 15:18:17.480 -0500 [PERR]: { 2: }: failed to get sainfo.
2020-01-22 15:18:17.480 -0500 [ERR ]: failed to pre-process packet.
Any ideas?
Hi All,
We have a requirement to setup Site-to-Site vpn between our Checkpoint FW and customer Palo Alto FW. I have created one, but the issue is IKE phase 2 fails. I have confirmed the negotiation parameters with my customer engineer and it looks like everything is in order. What could be the possible issue?
I used VPN tu and SmartView monitor to view but to no success. Any advices will be highly appreciated
Thank you so much
Leaderboard
Epsum factorial non deposit quid pro quo hic escorol.
User | Count |
---|---|
15 | |
12 | |
8 | |
6 | |
6 | |
6 | |
5 | |
5 | |
4 | |
3 |
Tue 30 Sep 2025 @ 08:00 AM (EDT)
Tips and Tricks 2025 #13: Strategic Cyber Assessments: How to Strengthen Your Security PostureTue 07 Oct 2025 @ 10:00 AM (CEST)
Cloud Architect Series: AI-Powered API Security with CloudGuard WAFTue 30 Sep 2025 @ 08:00 AM (EDT)
Tips and Tricks 2025 #13: Strategic Cyber Assessments: How to Strengthen Your Security PostureThu 09 Oct 2025 @ 10:00 AM (CEST)
CheckMates Live BeLux: Discover How to Stop Data Leaks in GenAI Tools: Live Demo You Can’t Miss!Wed 22 Oct 2025 @ 11:00 AM (EDT)
Firewall Uptime, Reimagined: How AIOps Simplifies Operations and Prevents OutagesAbout CheckMates
Learn Check Point
Advanced Learning
YOU DESERVE THE BEST SECURITY