> Source: [sk116453](https://support.checkpoint.com/results/sk/sk116453)

# sk116453 - IPSec VPN NAT-T traffic is sent to the MAC address of wrong next hop or old IP

| Property | Value |
|----------|-------|
| Solution ID | sk116453 |
| Date Created | 2017-03-21 |
| Last Modified | 2025-05-12 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81 (EOS) |
| OS | Gaia |

## Symptoms

- * IPSec VPN NAT-T traffic is sent to the MAC address of wrong next hop or old IP address.
* Site 2 Site VPN is established with a DAIP VPN peer using NAT-T.
* Clearing the `'orig_route_params'` on all cluster members with: `# fw tab -t orig_route_params -x -y`   
  resolve the issue until the NAT device IP changes again.

## Cause

The valid IP Address of the NAT device was changed to a new IP but still encrypted with the old SPI's associated with the previous IP before it was changed.

As a result, the reply packet from the Check Point Security Gateway is sent to the old "known" IP.

The entries contained in *orig_route_params* table are not taken from the ARP table or the source, but from the MAC address that appears on the packet that the Security Gateway got from the peer. Accordingly, it contains the real MAC address and not the VMAC as in the ARP table.

The entry in the *orig_route_params* table is not updated when only the next hop MAC is changed.

## Solution

This problem was fixed. The fix is included in:

* [Jumbo Hotfix Accumulator for R80.20](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk137592) starting from Take 202
* [Jumbo Hotfix Accumulator for R80.30](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk153152) starting from Take 235
* [Jumbo Hotfix Accumulator for R80.40](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk165456) starting from Take 119

<br />

**Important Note: In a cluster environment, Check Point strongly recommends to install this fix on all cluster members.**

The fix included in the above Jumbo Hotfixes adds a buffer to the values of the "*orig_route_params"* kernel table.   
This table is synchronized between Cluster members. Therefore, if you do not upgrade ALL cluster members to the same Jumbo Hotfix Take, the post sync fails because there is an incorrect number of values.   
The error displayed is "*post_sync_cln_orig_route_table: ERROR: wrong number of vals* ".  

Workaround

1. Delete the relevant entry in "*orig_route_params* " table.   
   To do so, run: *fw tab -t orig_route_params -x -e "<peer_HEX_ip>,0,0;"*

<!-- -->

1. Reset the VPN tunnel. To do so, run: "`vpn tu del <peer_ip>`"  

EXAMPLE: # fw tab -t orig_route_params -x -e "c0a80101,0,0;" would clear the entry for peer 192.168.1.1.  

****Note**: The issue is resolved automatically after you upgrade all cluster members to the same Jumbo Hotfix Take.**   

<br />

If you choose not to upgrade, Check Point can supply a **Hotfix** . [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.  
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case.

**Hotfix installation instructions:**   
Refer to [sk168597 - How to install a Hotfix](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk168597).

<br />

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content