> Source: [sk122133](https://support.checkpoint.com/results/sk/sk122133)

# sk122133 - "encryption failure: Authentication failure. Sequence Number X (Expected XXXX)" error when Site to Site VPN fails 

| Property | Value |
|----------|-------|
| Solution ID | sk122133 |
| Date Created | 2018-01-09 |
| Last Modified | 2018-01-14 |
| Technical Level | Advanced |

## Symptoms

- * "encryption failure: Authentication failure. Sequence Number X (Expected XXXX)" error when Site to Site VPN fails
* *fw ctl zdebug* drop:  
  "dropped by vpn_ipsec_decrypt Reason: Decryption failure"

## Cause

The errors may be caused for the following reasons:

* The gateway expects Sequence Number 'XXXX', but receives a value higher than 'XXXX', and this then results in the decryption failure.
* The ESP standard defines a way to detect packets which were changed while traveling from the encryption side to the decryption side. When encrypting, the packet is hashed and the resulting digest is added to the packet. When decrypting, the packet is hashed again and the digest is compared to the digest on the packet. If they are different, then you will know that the packet was changed somewhere on the way. This suggests that the packet was either malformed on the way, or simply changed.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content