> Source: [sk145473](https://support.checkpoint.com/results/sk/sk145473)

# sk145473 - Traffic from Large-Scale VPN peer is dropped with reason: "decryption failure: Could not get SAs from packet"

| Property | Value |
|----------|-------|
| Solution ID | sk145473 |
| Date Created | 2019-01-23 |
| Last Modified | 2022-06-01 |
| Technical Level | Advanced |
| OS | Gaia |

## Symptoms

- * VPN tunnel with Large-Scale VPN (LSV) peer is established successfully. The Encrypted traffic with a recently negotiated SPI, arriving from a Large Scale VPN (LSV) peer to a central gateway, is dropped.
* Kernel debug (-m fw + drop) shows:  
  ` 
  fw_log_drop_ex: Packet proto=50 1.1.1.1:57190 -> 100.0.0.1:16328 dropped by vpn_ipsec_decrypt Reason: decryption failure: Could not get SAs from packet;`
* Kernel debug (-m VPN + all) shows:  
  `
  date timestamp;[cpu_1];[fw4_0];update_lsv_routing: Error. Range X.X.X.X - X.X.X.Y is wider than max IPs allowed.;`

## Cause

Phase 2 of IPSEC VPN negotiates IDs, which represent networks behind peers. The range X.X.X.X - X.X.X.Y, which is presented in the kernel debug - is the LSV peer's encryption domain (internal network) and its ID.

The LSV profile configuration process considers a limited number of IP addresses in a peer's VPN domain, and the range X.X.X.X - X.X.X.Y contains a number of IP addresses that exceeds the limit. This makes the central gateway remove the negotiated SPI from the database.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content