> Source: [sk113837](https://support.checkpoint.com/results/sk/sk113837)

# sk113837 - New VPN tunnels are not being established with the peers 

| Property | Value |
|----------|-------|
| Solution ID | sk113837 |
| Date Created | 2016-10-10 |
| Last Modified | 2017-12-10 |
| Technical Level | Advanced |

## Symptoms

- * New VPN tunnels are not being established with peers.

* Traffic is not passing over multiple VPN tunnels.

* Problematic VPN tunnels are displayed as "Down" in SmartView Monitor.

* Debug of VPND daemon (per [sk89940](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk89940)) shows that it fails to add the entry for new IKE SA:

  `;make_ike2esp_queues: ERROR: Failed to add ike2ipsec entry for IKE SA <0x...,0x...>;`  
  `
  ;ike_esp_add_by_fields: ERROR: Failed to create new ike2esp record;`  
  `
  ;store_inbound_spi_in_table: ERROR: Failed to add SPI 0x... to inbound queue of its IKE SA;`  
  `
  ;store_spi_in_table_ex: failed to store inbound esp SA;`

## Cause

Flow of events:

1. IKE MM negotiation succeeds on Check Point Security Gateway - the peer's IKE SA is saved in the kernel table *IKE_SA_table*
2. QM1 packet never arrives
3. Check Point Security Gateway never deletes the SA
4. The peer starts IKE MM negotiation again, which ends with Check Point Security Gateway saving yet another IKE SA for this peer
5. Eventually this causes overflow in the kernel table *IKE_SA_table*, and all the other kernel tables related to it (the redundant IKE SA would be deleted only when the SA expires)

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content