> Source: [sk100323](https://support.checkpoint.com/results/sk/sk100323)

# sk100323 - VPN Site creation on a Client fails due to mismatch in versions of TLS protocol

| Property | Value |
|----------|-------|
| Solution ID | sk100323 |
| Date Created | 2014-05-05 |
| Last Modified | 2020-01-06 |
| Technical Level | Advanced |
| Products | Security Gateway, Endpoint Security |
| Versions | R82.10, R82, R81.20, Cloud, E89.X, E88.X |

## Symptoms

- * Debug of VPND daemon on Security Gateway (per [sk89940](http://supportcontent.checkpoint.com/solutions?id=sk89940)) shows:

  ```
  
  ClientHello: finished parsing
  ClientHello: >>>>>>>>>>>>>>>>
  cptlsChooseVer: Client supports up to version 301.
  cptlsChooseVer: I support between version 302 and 303.
  cptlsChooseVer: Cannot choose version
  invalidate_session: called.
  invalidate_session: did not find any session to invalidate.
  ```

* VPN Site creation on Client fails.

* `trac.log` file from the Client shows the following failure:

  ```
  
  [cpwssl] cpWinSSL_fwasync_connected: SSL failure: SSL negotiation error. 
  [cpwssl] cpWinSSL_fwasync_close: closing - conn - 0x... 
  [] fwasync_close: close(...): Unknown Winsock error (10038) 
  [talkssl] talkssl::end_handler: ending connection
  ```

* Traffic capture on Security Gateway shows that TCP handshake is complete on TCP port 443, but then the Security Gateway resets the connection:

  1. **Client Hello:**

     ```
     
     Secure Sockets Layer
       TLSv1 Record Layer: Handshake Protocol: Client Hello
         Content Type: Handshake (22)
         Version: TLS 1.0 (0x0301)
         Length: ...
         Handshake Protocol: Client Hello
           Handshake Type: Client Hello (1)
           Length: ...
           Version: TLS 1.0 (0x0301)
     ```

  2. **Security Gateway response (which is followed by 'FIN-ACK' packet):**

     ```
     
     Secure Sockets Layer
       TLSv1 Record Layer: Alert (Level: Fatal, Description: Protocol Version)
         Content Type: Alert (21)
         Version: TLS 1.0 (0x0301)
         Length: 2
         Alert Message
           Level: Fatal (2)
           Description: Protocol Version (70)
     ```

## Cause

Client sends TLS v1.0, but Security Gateway is configured to support TLS v1.1 or TLS v1.2 only.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content