The ticket
Branch PC cannot reach HR. Rule 25: Branch_net → host_hr_app → Encrypt. Log: “Key exchange failed” or never encrypts. Peer is 198.51.100.10. Domains are wrong.
A VPN Community (Star or Meshed) defines which gateways encrypt to which, and which networks sit behind them (encryption domains). Phase-1 is IKE SA. Phase-2 is IPsec SA for those domains. vpn tu tlist shows tunnels. Encrypt fail is usually domain, proposal, or peer IP — not “add Accept.”
SMS sms-lab 10.10.10.5 · cluster VIP 10.10.10.1 (cp-gw-01 10.10.10.2 / cp-gw-02 10.10.10.3) · external 203.0.113.25 · internal LAN 10.20.30.0/24 · HR PC 10.20.30.80 TECHCLICK\priya.hr · HR app 10.20.30.41 hr.techclick-lab.in. Not a live customer.
Community + domains
Site-to-Site VPN Admin Guide: put gateways in a community, set encryption domains (often the topology behind each GW). Traffic between those domains with Action Encrypt (or community implicit) should IKE.
If HQ domain is only 10.10.10.0/24 and HR is 10.20.30.41, Phase-2 has nothing to propose for that pair.
Missing subnet in either oval = Phase-2 never builds for that pair.
Domain design
| Style | Use | Risk |
|---|---|---|
| Topology / “internal networks” | Simple star | Forgot a VLAN |
| Manual group of networks | Overlapping / precise | Stale group |
| 0.0.0.0/0 domain | Rare | Encrypts everything, breaks internet |
Star community HQ_to_Branch
How you bring it up
Side A — peer
Confirm peer public IP, PSK/cert, proposals. Same on both vendors if it is not Check Point–Check Point.
Side B — community + rule
Domains include both LANs. Rule Encrypt (or community). Install policy on HQ (and peer).
Side C — tunnels
vpn tu tlist(or currentvpn tumenu). Initiate interesting traffic. Phase-2 must list 10.20.30.0/24 ↔ branch LAN.
vpn tu tlist # Look for peer 198.51.100.10 # IKE SA: established # IPsec SA: 10.20.30.0/24 <-> 10.40.0.0/24 ← must exist # If IKE up and IPsec missing: domains / interesting traffic / PFS mismatch.
Four VPN failures
1 · Domain miss
Host not in domain. No Phase-2. Add the network object, install.
2 · Proposal mismatch
Phase-1 never establishes. Align encryption/hash/DH/lifetime with the peer vendor.
3 · Encrypt vs Accept
You Accept in clear. Traffic leaves unencrypted and dies on the peer or the internet.
4 · NAT-T / hidden peer
Peer behind Hide NAT. Enable NAT traversal; use the correct peer ID.
How to prove it
1) vpn tu shows IPsec for those two subnets. 2) Branch host reaches 10.20.30.41. 3) Log Action Encrypt (not Accept clear). 4) A packet to a non-domain IP does not create a surprise tunnel.
Traps
| Symptom | VPN story | Wrong fix |
|---|---|---|
| P1 up, P2 down | Domains / PFS | Any-Any Accept |
| No IKE | PSK / IP / UDP 500/4500 | Reset SIC |
| One host fails | Not in domain | New community |
Knowledge check
Judgment items. One best answer. Reasons send you back to the matching section.
Check Point class series: Architecture · Gaia first day · SIC reset · Objects + first match · Policy layers · Hide vs Static NAT · Identity Awareness · HTTPS Inspection · Threat Prevention · Find the drop · fw monitor · SecureXL · ClusterXL · VPN Community · Policy install lock · vs PA vs Forti · CCSA / CCSE interview
Sources
- Check Point Site to Site VPN Administration Guide — communities, encryption domains, IKE.
- CLI:
vpn tu/vpn tu tlist(confirm menu on your train).
Related: Check Point evidence desk · session factory · next lesson in the series above.