Policy-Based VPN (PBVPN) Fails to Establish IKE SA with OnPrem Checkpoint Device

Products

• VMware Cloud on AWS
• VMware Cloud on Dell EMC
• VMware NSX
• VMware NSX-T Data Center

Issue/Introduction

Symptoms:

• OnPrem VPN Endpoint is a Checkpoint brand device.
• VMC Networking & Security Console UI displays IKE SA Error for the PBVPN. The Tunnel will continually attempt to re-establish the IKE SA pairs and report a failure.
• PBVPN is configured to use IKEv2.
• The NSX Logs will contain errors mentioning "IKE_AUTH packet is missing IDr or AUTH payload"
• IKE Fail Reason in the UI says "Invalid syntax" 

Cause

Misconfiguration of a Checkpoint device-level setting.

Resolution

Refer to Checkpoint Support KB - Site to Site using IKEv2 fails with "None of the traffic selectors match the connection" to find the Checkpoint approved method of resolving this issue.

Workaround:
Switch to using a Route Based VPN.