> Source: [sk165697](https://support.checkpoint.com/results/sk/sk165697)

# sk165697 - NAT-T traffic being routed out the wrong interface when encrypted

| Property | Value |
|----------|-------|
| Solution ID | sk165697 |
| Date Created | 2020-04-02 |
| Last Modified | 2022-03-24 |
| Technical Level | General |
| OS | Gaia |

## Symptoms

- * NAT-T traffic being routed out the wrong interface, when encrypted.
* Phase 1 and Phase 2 tunnel completed, but some traffic does not reach the remote peer.   
  Doing a traffic capture for the specific SPI - show no NAT_T ESP traffic towards the peer.  

  Checking the route that would be used by the peers traffic if not encrypted (ie defautl route), and then performing a traffic capture on that interface - shows the encrypted traffic leaving this interface instead of the interface which faces the peer.

## Solution

This problem was fixed. The fix is included in:

* [Jumbo Hotfix Accumulator for R80.30](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk153152) since Take 210

<br />

<br />

**As a temporary workaround:**   
Add a static route for the peer encryption domain traffic, and configure the next-hop IP Address with the router reachable on that interface. This will direct the next hop towards the VPN peer.  

**Example:**   
Default route is eth8; but route to the VPN peer is via a router on eth2. Use eth2's nexthop for the static route.

<br />

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content