> Source: [sk106837](https://support.checkpoint.com/results/sk/sk106837)

# sk106837 - Troubleshooting Overlapping Encryption Domains Issues

| Property | Value |
|----------|-------|
| Solution ID | sk106837 |
| Date Created | 2015-07-13 |
| Last Modified | 2022-12-25 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81.20, R81.10 (EOS), R81 (EOS) |

## Solution

**Table of Contents**

* Overlapping Encryption Domains
* Various Scenarios
  * Scenario 1: "The gateways XXX and YYY have partial overlapping encryption domains" error during Policy Verification
  * Scenario 2: 'vpn overlap_encdom traditional -s' command hangs on Check Point installation with huge database of objects
  * Scenario 3: 'encryption failure: Wrong peer gateway for decrypted' log in SmartView Tracker
  * Scenario 4: VPN traffic is sent out in clear when traffic matches community criteria
  * Scenario 5: Partially overlapping encryption domain error on Policy install
  * Scenario 6: When configuring a Traditional Mode policy, the Allowed Peer Gateway setting is ignored
  * Scenario 7: Error: "There are at least two firewalls with partially overlapping encryption domains"
  * Scenario 8: SecureClient fails to create site: 'Error: Site has at least two gateways with a partially overlapping encryption domain'
  * Scenario 9: VPN client fails to set up a site to ClusterXL in MEP topology with error 'There are at least two firewalls with partially overlapping encryption domains'
  * Scenario 10: Remote Access users cannot connect to site after upgrading the Management Server to R76
* Related documentation

Click Here to Show the Entire Article

Overlapping Encryption Domains {#Overlapping Encryption Domains}
----------------------------------------------------------------

There are three basic types of overlapping VPN Domains:

*

  ### Full Overlap (Supported)

  **Check Point Security Gateway supports fully overlapping VPN Domains.** In a full overlap, the VPN Domains are identical.
*

  ### Partial Overlap (Not Supported)

  In certain instances, there may be a partial overlap between the VPN Domains of Security Gateways. In a partial overlap, there is at least one host in both VPN Domains, but there are other hosts that are not in both VPN Domains. **Check Point Security Gateway does not support partially overlapping VPN Domains.**
*

  ### Proper Subset (Supported for Remote Access)

  If one Security Gateway's VPN Domain is fully contained in another Security Gateway's VPN Domain, the contained VPN Domain is a proper subset.  
  For example, when:
  * The encryption domain of Gateway B is fully contained in the encryption domain of Gateway A,
  * But Gateway A also has additional hosts that are not in Gateway B,

  <br />

  Then Gateway B is a proper subset of Gateway A.  

  In order for a proper subset to work, each Security Gateway must have a valid, routable address, or use Static NAT. **Proper subset overlapping encryption domains within a single site are supported for Remote Access Clients.**

  For more information, refer to:
  * [sk105638: Traffic from Remote Access client failing to match any Security Gateway's encryption domain](http://supportcontent.checkpoint.com/solutions?id=sk105638)
  * [sk88780: Troubleshooting "No valid SA" error](http://supportcontent.checkpoint.com/solutions?id=sk88780)
  * [sk64060: 'Encryption Failure: according to the policy the packet should not have been decrypted' log in SmartView Tracker for VPN Tunnel Test packet](http://supportcontent.checkpoint.com/solutions?id=sk64060)

Various Scenarios {#Various Scenarios}
--------------------------------------

There are quite a number of scenarios, in which you may encounter "Overlapping Encryption Domains" issues. The scenarios that we have encountered and dealt with are detailed below.

### Scenario 1: *"The gateways XXX and YYY have partial overlapping encryption domains" error during Policy Verification* {#Scenario 1}

**Product:** IPSec VPN, SmartDashboard, Security Management, Multi-Domain Management / Provider-1

**Symptoms:**

Error during Policy Verification:

```
The gateways <Name_of_Gateway_1> and <Name_of_Gateway_2> have partial overlapping encryption domains.
Therefore, Endpoint Connect users will not support  MEP configuration
SecureRemote/SecureClient users will not be able to create site.
If any of the GWs should not be exported to SR/SC, please
remove it from the RemoteAccess community or uncheck the exportable for SR box.
The overlapping domain include :
x.x.x.x - x.x.x.x
The exclusive domain of <Name_of_Gateway_1> include:
y.y.y.y - y.y.y.y
The exclusive domain of <Name_of_Gateway_2> include:
z.z.z.z - z.z.z.z
```

Show / Hide this section  
> **Cause:**
>
> There is "partial overlapping encryption domain" between two or more Security Gateways that are included inside the Remote Access community.
>
> **Solution:**
>
> Starting in R76, SmartDashboard alerts about an unsupported configuration - "partial overlapping encryption domain" between two or more Security Gateways inside the Remote Access community.
>
> **This error message does not indicate any issue and it does not fail the policy installation.**
>
> When Remote Access clients connect to a Security Gateway, they download the topology of all Security Gateways in the Remote Access community.
>
> The clients need to know what is the Remote Access encryption domain of each Security Gateway for the MEP and Secondary Connect features - in what encryption domain each internal resource is located, in order to establish a tunnel with the relevant Security Gateway dynamically and transparently to the user.
>
> Officially, MEP is only supported when the Security Gateways have completely overlapping Remote Access encryption domains, and Secondary Connect is only supported when the Security Gateways have completely separate Remote Access encryption domains, with no overlap at all.
>
> When there are "partially overlapping encryption" domains, the configuration does not fully fit the MEP, and also the Secondary Connect Encryption domain requirements. Therefore, this warning message pops-up in order to warn the administrator that it might affect the use of these features.
>
> To prevent this error message and not to affect the MEP and Secondary Connect features, avoid configuring partial encryption domains inside the Remote Access community.

### Scenario 2: *'vpn overlap_encdom traditional -s' command hangs on Check Point installation with huge database of objects* {#Scenario 2}

***Product:***IPSec VPN, CPInfo

**Symptoms:**

* 'vpn overlap_encdom traditional -s' command hangs on Check Point installation with huge database of objects. It might take more than an hour for this command to complete.  

* CPinfo utility crashes when collecting CPinfo file.  

  CPinfo file ends with this section :  
  `==============================================`  
  `Overlapping Encryption Domains`  
  `==============================================`  

Show / Hide this section  
> **Cause:**
>
> In order for the 'vpn overlap_encdom traditional -s' command to produce an output, it must go over all objects and check specific attributes. If the database contain many objects, this process physically takes a very long time, which might cause unexpected behavior.
>
> **Solution:**
>
> [Contact Check Point Support](http://www.checkpoint.com/services/contact/index.html) to get a Hotfix for this issue.  
> A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.

### Scenario 3: *'encryption failure: Wrong peer gateway for decrypted' log in SmartView Tracker* {#Scenario 3}

**Product:** IPSec VPN

**Symptoms:**

* No traffic passing through VPN tunnel.
* "`encryption failure: Wrong peer gateway for decrypted`" log in SmartView Tracker.
* "`encryption failure: Wrong peer gateway for decrypted`" drop in kernel debug (`fw ctl debug -m fw + drop`).

Show / Hide this section  
> **Cause:**
>
> Two or more VPN tunnels with overlapping encryption domains are accessing the same host(s). The VPN Gateway flags the packet as VPN, but is unable to decide, to which tunnel to send the VPN traffic because the source and destination criteria would match to more than one tunnel.
>
> **Solution:**
>
> Follow these steps:
>
> 1. Check for overlapping encryption domains on Security Gateway:   
>
>    **`[Expert@HostName]# vpn overlap_encdom communities -s`**   
>
>    This command will display the VPN communities and the corresponding encryption domains. It will also specify any overlap.   
>
> 2. Check VPN rules to verify whether source and destination would cause conflicts.   
>
> 3. Correct any overlaps.   
>
> 4. Install the policy after any changes in SmartDashboard.

### Scenario 4: *VPN traffic is sent out in clear when traffic matches community criteria* {#Scenario 4}

**Product:** IPSec VPN

**Symptoms:**

* VPN traffic is being sent in clear, when source, destination and community settings all match the community criteria.
* Kernel debug shows that the local gateway chooses to not encrypt this traffic:  
  `get_tunnel_params: Failed to find the address 0a330016 in routing table.;`  
  ` get_tunnel_params: Found entry with gateway cb19e601 in routing table.;`

Show / Hide this section  
> **Cause:**
>
> Duplicate objects with the same main IP address, will cause the duplicate object to match for the Peer's encryption domain.
>
> The gateway will build the community based on the duplicate object and not the peer gateway object due to matching main IP addresses.
>
> **Solution:**
>
> 1. Run the *fwm -d gen \<policyname.W\> \>\& policy_gen_debug.txt \&* command
> 2. Look for the local gateway and peer's main IP addresses and ensure that there are no duplicate objects using that IP address.
> 3. If any are found, remove or re-address the objects as necessary.
> 4. Run the*fwm -d gen* command to ensure there are no overlapping encryption domains.

### Scenario 5: *Partially overlapping encryption domain error on Policy install* {#Scenario 5}

**Product:** SecureClient, Endpoint Connect, Edge, IPSec VPN, Security Management))

**Symptoms:**

* When installing policy in SmartConsole / SmartDashboard, or updating topology on SecureClient, an error appears stating that there is a partially overlapping encryption domain:  
  "`Site x.x.x.x has at least two gateways with a partially overlapping encryption domain`"

Show / Hide this section  
> **Cause:**
>
> **When using Simplified Configuration for SecureClient VPN, partially overlapping encryption domains are not supported.**
>
> **Notes:**
>
> * Fully overlapping encryption domains are supported, and considered as MEP.
> * For Site to Site VPN, partially overlapping encryption domains are supported.
>
> **Solution:**
>
> When a partially overlapping encryption domain error is displayed, the user can check what the partially overlapping domains are, as follows:   
>
> **For Site to Site VPN:**   
>
> On the CLI of the SmartCenter (Security Management) server, run: `vpn overlap_encdom`   
>
> **For SecureClient VPN:**   
>
> When SecureClient users are trying to download topology, and the partially overlapping encryption domain error is displayed, the user can check a text file that is generated via SmartDashboard:
>
> 1.
>    1. In SmartDashboard, from the **Policy** menu select **View Policy of** \> select the Security Gateway object \> click **OK** .  
>       **Note** - In R65.4 and above:
>       1. From the **Policy** menu select **View Policy of**
>       2. Select the Security Gateway object
>       3. Click **Add**
>       4. Click **Apply**
>    2. The policy file appears.  
>       **Note** - If the file does not appear, examine the `$FWDIR/conf/<Policy Name>.pf` file on the Management Server.  
>       The policy name should be specified, as it appears in SmartDashboard.
>    3. Copy the text using a text editor.
>    4. Search for this line:  
>       `VPN-1 tables`
>    5. Beneath this line, the name of the Security Gateway objects and their valid SecureClient encryption domains appear.
>    6. Compare the different encryption domains of each Security Gateway and find the overlapping objects.
>    7. Reconfigure the objects so that the domains no longer partially overlap.
>    8. In SmartDashboard, install the policy on each Security Gateway.

### Scenario 6: *When configuring a Traditional Mode policy, the Allowed Peer Gateway setting is ignored* {#Scenario 6}

**Product:** IPSec VPN

**Symptoms:**

* When configuring a Traditional Mode policy, where two or more peer Security Gateways have overlapping encryption domains, the "Allowed Peer Gateway" setting, beneath the Encrypt Action Properties in a rule is ignored, and instead, MEP resolution still occurs.
* The VPN-1 Security Gateway will still try to use RDP to probe the peer Security Gateway, instead of just sending VPN packets to the peer specified in the "Allowed Peer Gateway" setting.

Show / Hide this section  
> **Solution:**
>
> Check Point can supply a **Hotfix** . [Contact Check Point Support](http://www.checkpoint.com/services/contact/index.html) to get a Hotfix for this issue.  
> A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix

### Scenario 7: *Error: "There are at least two firewalls with partially overlapping encryption domains"* {#Scenario 7}

**Product:** SecureClient, IPSec VPN

**Symptoms:**

* Error indicating overlapping encryption domains is seen on SecuRemote.

Show / Hide this section  
> **Cause:**
>
> When using Simplified Configuration for SecureClient VPN, partially overlapping encryption domains are not supported.
>
> **Solution:**
>
> Add both Security Gateways to the VPN/encryption domain.
>
> For detailed procedure, refer to:
>
> * For NGX R65: [Virtual Private Networks Administration Guide Version NGX R65](dc://ID/7261/FILE/CheckPoint_R65_VPN_AdminGuide.pdf)
> * For R70: [Virtual Private Networks Administration Guide Version R70](dc://ID/8751/FILE/CP_R70_VPN_AdminGuide.pdf)
> * For R71: [VPN R71 Administration Guide](dc://ID/10320/FILE/CP_R71_VPN_AdminGuide.pdf)
>
> **Important:** There are cases, in which a subnet in the VPN domain of one Security Gateway network object is overlapping with the internal interface IP address of another Security Gateway network object. (Both Security Gateways are managed by the same SmartCenter (Security Management) server or CMA.) Refer to [sk32252: SecureClient is unable to download site from the designated VPN-1 Gateway](primus://skcenter.checkpoint.comsk32252).  
>
> **Related Solution(s):**
>
> * [sk16158: In MEP Load Sharing configuration, fails to connect to Gateway specified in the Connect Profile](primus://skcenter.checkpoint.comsk16158).

### Scenario 8: *SecureClient fails to create site: 'Error: Site has at least two gateways with a partially overlapping encryption domain'* {#Scenario 8}

**Product:** SecureClient

**Symptoms:**

* SecureClient fails to create a VPN site with the error "`Site has at least two gateways with a partially overlapping encryption domain`".
* There is only one Security Gateway in the Remote Access VPN community.

Show / Hide this section  
> **Cause:**
>
> There is at least another Security Gateway that is not in the Remote Access VPN community and is managed by the same management server, has its information exportable to SecuRemote/SecureClient and its VPN domain is partially overlapping.
>
> **Solution:**
>
> Disable the 'Exportable for SecuRemote/SecureClient' flag on the Security Gateways that do not participate in the RemoteAccess community.
>
> In SmartDashboard:
>
> 1. Edit the relevant Check Point Gateway from the Network Objects tree: 'Right-click \> Edit'.
> 2. In the Check Point Gateway dialog box, select "IPSec VPN" from the left pane.
> 3. In the VPN page, click on the "Traditional mode configuration" button.
> 4. In the 'Traditional mode IKE properties' dialog box, uncheck the 'Exportable for SecuRemote/SecureClient' check box.
> 5. Click "OK" in the 'Traditional mode IKE properties' dialog box.
> 6. Click "OK" in the Check Point Gateway dialog box.
> 7. Click "Close" in the Network Objects dialog box.
> 8. Install the security policy on the VPN-1 Gateways.
> 9. In SecureClient, create the required VPN site.

### Scenario 9: *VPN client fails to set up a site to ClusterXL in MEP topology with error 'There are at least two firewalls with partially overlapping encryption domains'* {#Scenario 9}

**Product:** ClusterXL, Endpoint Connect, SecureClient

**Symptoms:**

* Attempt to set up a site to ClusterXL in MEP topology with SecureClient results in error message:  
  '`There are at least two firewalls with partially overlapping encryption domains`'

Show / Hide this section  
> **Solution:**
>
> Add objects of all cluster members (and not the cluster object) to the encryption domain of Remote Access.

### Scenario 10: *Remote Access users cannot connect to site after upgrading the Management Server to R76* {#Scenario 10}

**Product:** Endpoint Security VPN, Security Management

**Symptoms:**

* Endpoint clients are unable to connect to a site, usually with the error message "Failed to download topology" on the client.
* R60 clients fail to update site or create a new site, with the error of overlapping encryption domains.

Show / Hide this section  
> **Cause:**
>
> In R76, when Mobile Access is enabled, it automatically adds the gateway to the Remote Access VPN community (this is done to allow Mobile VPN clients to work without having to enable the IPSec blade). This may cause the MEP and secondary-connect to include unwanted gateways, as they are part of Remote Access community and cannot be removed.
>
> **Solution:**
>
> SmartDashboard should allow to remove the Mobile Access-enabled gateways from the Remote Access community.
>
> [Contact Check Point Support](http://www.checkpoint.com/services/contact/index.html) to get a Hotfix for this issue. A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.

Related documentation {#Related documentation}
----------------------------------------------

* VPN Administration Guide ([R60](http://downloads.checkpoint.com/dc/download.htm?ID=5507), [R60A](http://downloads.checkpoint.com/dc/download.htm?ID=5584), [R61](http://downloads.checkpoint.com/dc/download.htm?ID=6360), [R62](http://downloads.checkpoint.com/dc/download.htm?ID=6823), [R65](http://downloads.checkpoint.com/dc/download.htm?ID=7261), [R70](http://downloads.checkpoint.com/dc/download.htm?ID=8751), [R71](http://downloads.checkpoint.com/dc/download.htm?ID=10320), [R75](http://downloads.checkpoint.com/dc/download.htm?ID=11675), [R75.40](http://downloads.checkpoint.com/dc/download.htm?ID=13961), [R75.40VS](http://downloads.checkpoint.com/dc/download.htm?ID=16210), [R76](http://downloads.checkpoint.com/dc/download.htm?ID=22927), [R77](http://downloads.checkpoint.com/dc/download.htm?ID=24849), [R80](http://downloads.checkpoint.com/dc/download.htm?ID=46536))
* Endpoint Security Clients for Windows User Guide ([E80.40](http://downloads.checkpoint.com/dc/download.htm?ID=17163), [E80.50](http://downloads.checkpoint.com/dc/download.htm?ID=24674), [E80.60](http://downloads.checkpoint.com/dc/download.htm?ID=36184), [E80.61](http://downloads.checkpoint.com/dc/download.htm?ID=40517), [E80.62](http://downloads.checkpoint.com/dc/download.htm?ID=45332), [E80.64](http://downloads.checkpoint.com/dc/download.htm?ID=51165), [E80.65](http://downloads.checkpoint.com/dc/download.htm?ID=53789))
* Endpoint Security Clients for Windows Release Notes ([E80.40](http://downloads.checkpoint.com/dc/download.htm?ID=17164), [E80.41](http://downloads.checkpoint.com/dc/download.htm?ID=23221), [E80.42](http://downloads.checkpoint.com/dc/download.htm?ID=30083), [E80.50](http://downloads.checkpoint.com/dc/download.htm?ID=24827), [E80.60](http://downloads.checkpoint.com/dc/download.htm?ID=36189), [E80.61](http://downloads.checkpoint.com/dc/download.htm?ID=40515), [E80.62](http://downloads.checkpoint.com/dc/download.htm?ID=45331), [E80.64](http://downloads.checkpoint.com/dc/download.htm?ID=51163), [E80.65](http://downloads.checkpoint.com/dc/download.htm?ID=53790))
* Endpoint Security Client for Mac User Guide ([E80.40](http://downloads.checkpoint.com/dc/download.htm?ID=20541). [E80.50](http://downloads.checkpoint.com/dc/download.htm?ID=24675), [E80.60](http://downloads.checkpoint.com/dc/download.htm?ID=36185), [E80.61](http://downloads.checkpoint.com/dc/download.htm?ID=43057), [E80.62](http://downloads.checkpoint.com/dc/download.htm?ID=47283), [E80.64](http://downloads.checkpoint.com/dc/download.htm?ID=51804))
* Endpoint Security Clients for Mac Release Notes ([E80.40](http://downloads.checkpoint.com/dc/download.htm?ID=17164), [E80.41](http://downloads.checkpoint.com/dc/download.htm?ID=22001), [E80.42](http://downloads.checkpoint.com/dc/download.htm?ID=30085), [E80.50](http://downloads.checkpoint.com/dc/download.htm?ID=24827), [E80.50.03](http://downloads.checkpoint.com/dc/download.htm?ID=31925), [E80.60](http://downloads.checkpoint.com/dc/download.htm?ID=36189), [E80.61](http://downloads.checkpoint.com/dc/download.htm?ID=43056), [E80.62](http://downloads.checkpoint.com/dc/download.htm?ID=47284), [E80.64](http://downloads.checkpoint.com/dc/download.htm?ID=52743))
* Remote Access VPN Clients for Windows Administration Guide ([E75](http://downloads.checkpoint.com/dc/download.htm?ID=11816), [E75.10](http://downloads.checkpoint.com/dc/download.htm?ID=11992), [E75.20](http://downloads.checkpoint.com/dc/download.htm?ID=12320), [E75.30](http://downloads.checkpoint.com/dc/download.htm?ID=20401), [E80.41](http://downloads.checkpoint.com/dc/download.htm?ID=23222), [E80.50](http://downloads.checkpoint.com/dc/download.htm?ID=24859), [E80.60 / E80.61 / E80.62 / E80.64 / E80.65](http://downloads.checkpoint.com/dc/download.htm?ID=36186))
* Remote Access VPN Clients for Windows Release Notes ([E80.41](http://downloads.checkpoint.com/dc/download.htm?ID=23361), [E80.42](http://downloads.checkpoint.com/dc/download.htm?ID=30087), [E80.50](http://downloads.checkpoint.com/dc/download.htm?ID=24979)/[E80.50](http://downloads.checkpoint.com/dc/download.htm?ID=24858)/[E80.50](http://downloads.checkpoint.com/dc/download.htm?ID=24857)/[E80.50](http://downloads.checkpoint.com/dc/download.htm?ID=24856)/[E80.50](http://downloads.checkpoint.com/dc/download.htm?ID=24854), [E80.60](http://downloads.checkpoint.com/dc/download.htm?ID=36187), [E80.61](http://downloads.checkpoint.com/dc/download.htm?ID=40524), [E80.62](http://downloads.checkpoint.com/dc/download.htm?ID=45337), [E80.64](http://downloads.checkpoint.com/dc/download.htm?ID=51208), [E80.65](http://downloads.checkpoint.com/dc/download.htm?ID=54106))
* Endpoint Security VPN for Mac Administration Guide ([E80.50](http://downloads.checkpoint.com/dc/download.htm?ID=25498), [E80.60 / E80.61 / E80.62](http://downloads.checkpoint.com/dc/download.htm?ID=37115), [E80.64](http://downloads.checkpoint.com/dc/download.htm?ID=52905))
* Endpoint Security VPN for Mac Release Notes ([E80.41](http://downloads.checkpoint.com/dc/download.htm?ID=22002), [E80.42](http://downloads.checkpoint.com/dc/download.htm?ID=30086), [E80.50](http://downloads.checkpoint.com/dc/download.htm?ID=25541), [E80.60](http://downloads.checkpoint.com/dc/download.htm?ID=36188), [E80.61](http://downloads.checkpoint.com/dc/download.htm?ID=40525), [E80.62](http://downloads.checkpoint.com/dc/download.htm?ID=47285), [E80.64](http://downloads.checkpoint.com/dc/download.htm?ID=52743), [E80.65](http://downloads.checkpoint.com/dc/download.htm?ID=54106))

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content