> Source: [sk112139](https://support.checkpoint.com/results/sk/sk112139) # sk112139 - IKEv2 negotiation for Site-to-Site VPN tunnel with 3rd party peer fails if IKEv2 SA payload contains more than 8 proposals | Property | Value | |----------|-------| | Solution ID | sk112139 | | Date Created | 2016-06-26 | | Last Modified | 2023-02-05 | | Technical Level | General | ## Symptoms - * IKEv2 negotiation for Site-to-Site VPN tunnel between Check Point Security Gateway and 3rd party peer fails. * IKE debug on Check Point Security Gateway (per [sk180488](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk180488)) shows: ``` [ PID][Date Time][ikev2] Message::decodeAllPayloads: payload 1: SecurityAssociation (next=KeyExchange) [ PID][Date Time][ikev2] ikeProposalList::add_prop: Proposal List full [ PID][Date Time][ikev2] ikeProposalList::add_prop: Proposal List full [ PID][Date Time][ikev2] ikeProposalList::add_prop: Proposal List full [ PID][Date Time][ikev2] ikeProposalList::add_prop: Proposal List full ... [ PID][Date Time][ikev2] SAValidator::createCommonProp: my methods are different from peer's prop 0 [ PID][Date Time][ikev2] SAValidator::createCommonProp: my methods are different from peer's prop 1 [ PID][Date Time][ikev2] SAValidator::createCommonProp: my methods are different from peer's prop 2 [ PID][Date Time][ikev2] SAValidator::createCommonProp: my methods are different from peer's prop 3 [ PID][Date Time][ikev2] SAValidator::createCommonProp: my methods are different from peer's prop 4 [ PID][Date Time][ikev2] SAValidator::createCommonProp: my methods are different from peer's prop 5 [ PID][Date Time][ikev2] SAValidator::createCommonProp: my methods are different from peer's prop 6 [ PID][Date Time][ikev2] SAValidator::createCommonProp: my methods are different from peer's prop 7 [ PID][Date Time][ikev2] SAValidator::createCommonProp: No common proposal [ PID][Date Time][ikev2] SAValidator::isValidSA: failed to get a prop common to me and peer. ``` ## Cause Check Point Security Gateway supports up to 8 proposals in IKEv2 SA payload. The IKEv2 SA payload sent by 3rd party VPN peer contains more than 8 proposals. Relevant proposal is one of those not processed. ## Solution This problem was fixed. The fix is included starting from: * [Check Point R80.10](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk111841) * [Jumbo Hotfix Accumulator for R77.30](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk106162) starting from Take 338 Check Point recommends to always upgrade to the [Recommended version](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk95746) ([Security Gateway](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=435) / [VSX](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=359) / [Security Management Server](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=184) / [Multi-Domain Security Management Server](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=166) / [SmartConsole](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=191)). **Code was improved:** Check Point Security Gateway supports up to 16 proposals in IKEv2 SA payload. **Hotfix installation instructions:** 1. Hotfix has to be installed on ***Security Gateway / each cluster member***. **Note:** In cluster environment, this procedure must be performed on *all* members of the cluster. 2. Procedure: * Using CPUSE on Gaia OS: Refer to [sk92449: CPUSE - Gaia Software Updates (including Gaia Software Updates Agent)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How to work with CPUSE): * Section "[(4-A-c)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How to work with CPUSE - How to download and import a CPUSE package - Import instructions for Offline procedure - Gaia Portal)" / "[(4-A-d)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How to work with CPUSE - How to download and import a CPUSE package - Import instructions for Offline procedure - Gaia Clish)" - refer to import instructions for *Offline procedure* * Section "[(4-B-a)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How to work with CPUSE - How to install a CPUSE package - Installing a Hotfix package / Minor Version package)" - refer to installation instructions for *Hotfixes* **Note:** Machine will be rebooted automatically. * Using Legacy CLI on Gaia/SecurePlatform/IPSO OS: 1. Transfer the hotfix package to the machine (into some directory, e.g., */some_path_to_fix/*). 2. Unpack and install the hotfix package: ***\[Expert@HostName:0\]# cd /some_path_to_fix/*** ***\[Expert@HostName:0\]# tar -zxvf fw1_wrapper_\.tgz*** ***\[Expert@HostName:0\]# ./fw1_wrapper_\*** **Note:** The script will stop all of Check Point services (*cpstop*) - read the output on the screen. 3. Reboot the machine. --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content