> Source: [sk112633](https://support.checkpoint.com/results/sk/sk112633)

# sk112633 - "encryption failure: Security warning: received a cleartext packet within an encrypted connection" log from vSEC for Azure gateway

| Property | Value |
|----------|-------|
| Solution ID | sk112633 |
| Date Created | 2016-07-26 |
| Last Modified | 2019-09-05 |
| Technical Level | Advanced |
| Products | Cloud Firewall |
| Versions | R82.10, R81.20, R82 |
| OS | Gaia |
| Platform | Azure |

## Symptoms

- * Traffic sent over Site-to-Site VPN tunnel from a host behind Check Point Security Gateway to a host behind vSEC for Azure gateway does not pass.

* SmartView Tracker logs show the following:

  1. Source host generates the traffic
  2. Check Point Security Gateway encrypts the traffic
  3. vSEC for Azure gateway receives and decrypts the traffic
  4. vSEC for Azure gateway fails to encrypt the reply traffic:  
     `encryption failure: Security warning: received a cleartext packet within an encrypted connection`
  5. vSEC for Azure gateway drops the reply traffic on implied rule
* Kernel debug on vSEC for Azure gateway ('`fw ctl debug -m fw + drop`') shows:

  * `;fw_log_drop_conn: Packet ... dropped by vpn_verify, Reason: clear packet on encrypted connection;`
  * `;fw_log_drop_ex: Packet ... dropped by chain_ipsec_methods_ok Reason: No decryption message;`

## Cause

vSEC for Azure gateway is deployed with only one interface.

In the Azure cloud configurations, a static route was added in the *User Defined Routes* , which routes all the traffic destined to the vSEC for Azure gateway's encryption domain toward the external interface on vSEC for Azure gateway (as defined in the *Link Selection* mechanism in Check Point SmartDashboard).

This static route causes the traffic to be routed back to the external interface on vSEC for Azure gateway, from which the encrypted ESP packet arrived. As a result, the encrypted connection and the cleartext packet (after decryption) are both assigned to the same interface.

Note: The external interface on vSEC for Azure gateway is the non-public IP interface that is NATed by the Azure public IP interface toward the Internet.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content