Policy-Based VPN (PBVPN) Fails to Establish IKE SA with OnPrem Checkpoint Device
book
Article ID: 334969
calendar_today
Updated On:
Products
VMware Cloud on AWSVMware Cloud on Dell EMCVMware NSXVMware NSX-T Data Center
Issue/Introduction
Symptoms:
OnPrem VPN Endpoint is a Checkpoint brand device.
VMC Networking & Security Console UI displays IKE SA Error for the PBVPN. The Tunnel will continually attempt to re-establish the IKE SA pairs and report a failure.
PBVPN is configured to use IKEv2.
The NSX Logs will contain errors mentioning "IKE_AUTH packet is missing IDr or AUTH payload"
IKE Fail Reason in the UI says "Invalid syntax"
Cause
Misconfiguration of a Checkpoint device-level setting.