> Source: [sk144094](https://support.checkpoint.com/results/sk/sk144094)

# sk144094 - VPN tunnels with 3rd party peers fail because of mismatched IDs

| Property | Value |
|----------|-------|
| Solution ID | sk144094 |
| Date Created | 2019-01-08 |
| Last Modified | 2026-02-18 |
| Technical Level | General |

## Symptoms

- * VPN tunnels with 3rd party peers fail because of mismatched IDs.
* *user.def* granular encryption ranges tables: *subnet_for_range_and_peer* and *max_subnet_for_range* , are not affecting encryption IDs in R80.20, once *ike_enable_supernet* is set to "false". This causes VPN tunnels with 3rd party peers to fail because of mismatched IDs.

## Cause

The issue occurs when the R80.20 feature "supernetting per community" is enabled.

## Solution

This problem was fixed. The fix is included starting from:

* [Check Point R80.30](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk144293)
* [Jumbo Hotfix Accumulator for R80.20 with Gaia 3.10 for CloudGuard and Open Server Security Gateways (R80_20_3_10_jumbo_hf)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk146212)
* [Jumbo Hotfix Accumulator for R80.20](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk137592) - from *Take_43*

Check Point recommends to always upgrade to the most recent version ([upgrade Security Gateway](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=435) / [upgrade Cluster](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=428)).

**In R80.20 and R80.20 Jumbo Hotfix Accumulator Takes lower than 43, you can disable the feature "supernetting per community" to resolve the issue.**

**Note:** The feature "supernetting per community" continues to work when you configure the value of the parameter "*ike_enable_supernet*" to "true" in the management database using the GuiDBedit Tool.

1. Connect to the command line on the Security Gateway / each Cluster Member.

2. Configure the value of the kernel parameter "enable_supernet_per_community" to "0":

   `fw ctl set -f int enable_supernet_per_community 0`

   **Notes:**
   * This command configures the required parameter value in the current session, and also in the *$FWDIR/boot/modules/fwkern.conf* file (to survive reboot).

   * It can take some time before the new configuration applies because the existing connections can still establish VPN tunnels using the old IP address ranges.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content