> Source: [sk116416](https://support.checkpoint.com/results/sk/sk116416)

# sk116416 - "IKE: Main Mode Sent Notification to Peer. unsupported exchange type" log when trying to establish a Site-to-Site VPN tunnel with Dynamic IP (DAIP) peer

| Property | Value |
|----------|-------|
| Solution ID | sk116416 |
| Date Created | 2017-03-29 |
| Last Modified | 2023-02-05 |
| Technical Level | Advanced |

## Symptoms

- * "`IKE: Main Mode Sent Notification to Peer. unsupported exchange type`" log in SmartView Tracker / SmartLog when trying to establish a Site-to-Site VPN tunnel between a Check Point Security Gateway and a Dynamic IP (DAIP) peer.

* VPND and IKE debug ([sk180488](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk180488)) on the Check Point Security Gateway shows:

  * In *$FWDIR/log/ike.elg\**:

    `no negotiation, Notify Type: 29 (UNSUPPORTED-EXCHANGE-TYPE)`
  * In *$FWDIR/log/vpnd.elg\**:

    `
    AggProcess1: aggressive mode not supported by me`  
    ` 
    ...`  
    `
    Sent Notification to Peer xxx: unsupported exchange type`  
    `
    Sent Notification to Peer: unsupported exchange type`  
    `
    GetDAGIP: ID xxx not in DAIP range
    `

## Cause

Aggressive Mode is enabled for IKE (Phase 1) in the VPN Community properties. To confirm this, do the following:

1. In SmartDashboard, go to the **IPSec VPN** tab.
2. In the left upper tree, click on **Communities**.
3. Select the relevant community - click on the **Edit...** button.
4. Expand the **Advanced Settings** - go to **Advanced VPN Properties**.
5. In the **IKE (Phase 1)** section, refer to the **User aggressive mode** checkbox.

> **Example**:
>
> [![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk116416/IKE_Aggressive_Mode.png)](https://sc1.checkpoint.com/sc/SolutionsStatics/sk116416/IKE_Aggressive_Mode.png "Click the image to see it in full size in a new tab/window")

Using Aggressive Mode with a Dynamic IP (DAIP) peer is ***not*** supported by Check Point. This mode should be selected only if it is the only mode supported by the peer. The reason is the same as for using a Pre-Shared key with a DAIP peer--lack of security:

When using Aggressive Mode for IKE, a Check Point Security Gateway receives a proposal packet from the DAIP peer, which includes all the information except the certificate itself. This means, first, that the Check Point Security Gateway cannot initialize the VPN peer gateway in its own database and, second, that all information from the VPN peer is in clear text, so the VPN peer gateway could already be compromised.

As a result, the Check Point Security Gateway cannot understand which VPN peer is located on the other side and cannot trust it. Accordingly, in response to the proposal request, the Check Point Security Gateway logically sends the "`Unsupported Exchange Type`" notification.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content