> Source: [sk1000139](https://support.checkpoint.com/results/sk/sk1000139)

# sk1000139 - Site-to-site IPsec VPN traffic fails when IP Compression is enabled

| Property | Value |
|----------|-------|
| Solution ID | sk1000139 |
| Date Created | 2026-09-11 |
| Last Modified | 2026-09-17 |
| Technical Level | Advanced |
| Products | Security Gateway, Check Point Firewall |
| Versions | R82.10, R82, R82.20 |
| OS | Gaia |

## Symptoms

- * A site-to-site Internet Protocol Security (IPsec) VPN tunnel between Check Point gateways is established successfully, but traffic does not pass correctly when IP compression is enabled.  
* Small TCP control packets without payload (for example, SYN, SYN-ACK, FIN, and RST packets) pass through the VPN tunnel successfully.
* TCP packets carrying application data fail when they traverse the VPN tunnel.
* Packet captures show non-compliant UDP port 4500 Network Address Translation Traversal (NAT-T) encapsulated IPsec packets.
* Packet analysis tools report the affected ESP-over-UDP packets as truncated IP packets.
* The UDP and IP length headers do not match the actual payload size.
* Packet analysis shows that approximately 40 bytes of payload are missing from affected packets.
* Turning off IP compression immediately restores normal traffic flow.

## Cause

A code logic issue affects IPsec VPN IP compression handling when SecureXL/UPPAK acceleration is involved.

In this scenario, compressed NAT-T IPsec packets are constructed incorrectly. The Security Gateway generates UDP port 4500 encapsulated ESP packets whose IP and UDP length fields do not match the actual payload size.

As a result, packets carrying application data may appear truncated during packet analysis, and traffic fails to pass correctly through the VPN tunnel.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content