> Source: [sk109853](https://support.checkpoint.com/results/sk/sk109853)

# sk109853 - Tunnels initiated with DAIP gateways cannot be re-established if the tunnel is reset

| Property | Value |
|----------|-------|
| Solution ID | sk109853 |
| Date Created | 2016-01-28 |
| Last Modified | 2022-07-21 |
| Technical Level | General |
| Products | Security Management Server |
| Versions | R82.10, R82, R81.20, R82.20 |

## Symptoms

- * The central gateway with tunnels to DAIP satellite gateways will not send a delete message when it receives an ESP packet from one of the DAIP gateways with an unknown SPI, despite having the option "Perform an organized shutdown of tunnels upon gateway restart" enabled.
* This will cause the tunnel between the central firewall and the DAIP satellites to remain down until the DAIP satellites delete their SAs and renegotiate the tunnel from their end.
* A VPN debug will show the following:   
  "InitiatorStart: Can't send delete SA to SR/DAIP with crash recovery disabled."

## Cause

If the central firewall receives an unknown SPI and is unable to resolve the peer to an object (in the event the peer has a dynamically assigned IP address) then it will try to pull the SPI from the crash recovery database to send the delete. The issue here is that the firewall is not properly storing the information in the crash recovery database and thus cannot send a delete message to inform the peer to delete the SA and renegotiate the tunnel.

## Solution

[Contact Check Point Support](http://www.checkpoint.com/services/contact/index.html) to get a Hotfix for this issue.   
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.   
For faster resolution and verification please collect [CPinfo](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92739) files from the Security Management and Security Gateways involved in the case.

* In SMB gateways (1100/1400/1200R), the issue has been resolved starting from R77.20.70 - refer to [sk120473](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk120473)

**Once the hotfix is installed, the option for "Perform an organized shutdown of tunnels upon gateway restart" must also be enabled for the gateway to send a delete message:**

![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk109853/vpn_advanced1603040736.PNG)

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content