> Source: [sk160672](https://support.checkpoint.com/results/sk/sk160672)

# sk160672 - VPN tunnel fails to establish when the Security Gateway/Cluster has multiple external interfaces

| Property | Value |
|----------|-------|
| Solution ID | sk160672 |
| Date Created | 2019-08-18 |
| Last Modified | 2026-01-26 |
| Technical Level | Advanced |
| Products | Security Gateway, Scalable Platforms |
| Versions | R82.10, R82, R81.20, R81.10 (EOS), R82.10, R82, R81.20, R81.10 (EOS) |
| OS | Gaia |

## Symptoms

- * Remote users cannot connect to resources behind the Security Gateway using Remote Access VPN when the Security Gateway/Cluster has multiple external interfaces.

* The Security Gateway does not start a VPN tunnel negotiation.

* The *vpnd.elg* file on the Security Gateway does not show an attempted IKE negotiation. No IKE packets leave the Security Gateway.

* Output of the `fw ctl zdebug drop` command shows:   
  "`dropped by fwha_vpn_sticky_tunnel_fwd_chain_h Reason: fwha vpn forwarding failure;`"

* Kernel debug output (`fw ctl debug -m cluster; fw ctl debug -m VPN all`) shows:

  ```
  
  ;vpn_get_peerGW_for_stickyDF_key_cpip: Clear packet that will encrypted at the outbound to the peer: xxx.xxx.xxx.xxx;
  ;vpn_get_sticky_sa_tunnel_ips: Before resolving source 0.0.0.0 destination xxx.xxx.xxx.xxx;
  ;vpn_get_sticky_sa_tunnel_ips: found entry in static_interface_resolve: ;
  ;vpn_get_sticky_sa_tunnel_ips: resolve source IP local_src_ip = outgoing_single_IP = 0.0.0.0 ;
  ;vpn_get_tunnel_ips: packet should be encrypted (local src ip 0.0.0.0, remote peer xxx.xxx.xxx.xxx);
  ;fwha_vpn_sticky_tunnel_df_forwarding: encryption needed for this packet (chain ffffc2005a0826f0);
  ;fwha_vpn_get_tunnel_zone: fwha_get_ifn_by_ip failed (src 0.0.0.0);
  ;fwha_vpn_sticky_tunnel_fwd_chain_h: VPN forwarding failure;
  ;fw_log_drop_ex: Packet proto=6 172.21.xxx.xxx:50080 -> 10.152.xxx.xxx:80 dropped by fwha_vpn_sticky_tunnel_fwd_chain_h Reason: fwha vpn forwarding failure;
  ```

## Cause

Starting from R81, the **Support Gateway with Multiple External Interfaces** was removed from SmartConsole. When you use a Security Gateway that has multiple external interfaces, and the setting in Security Gateway/Cluster object properties \> **IPsec VPN** \> **Link Selection** is **Main Address** / **Selected address from topology** /**Calculate IP based on network topology** / Use DNS resolving, you must change the value of the `ipsec_use_p1_src_ip` parameter from `0` to `1`.  

Do not be use this option with the **Static NATed IP** or **Link Redundancy** Link Selection Options.  
(Static NATed IP uses the interface that leads to that NATed IP, and you cannot use it for Link Redundancy because then the interface is not one interface but two or more.)  

**Note:**In a VSX environment, the issue can occur when each VS has 1 external interface and uses a virtual switch or router.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content