> Source: [sk171312](https://support.checkpoint.com/results/sk/sk171312)

# sk171312 - Site-2-Site VPN tunnel down after DAIP (Dynamically Assigned IP) peer IP changed with DPD (Dead Peer Detection) enabled 

| Property | Value |
|----------|-------|
| Solution ID | sk171312 |
| Date Created | 2021-01-07 |
| Last Modified | 2021-01-13 |
| Technical Level | General |

## Symptoms

- * Site-2-Site VPN tunnel down after DAIP (Dynamically Assigned IP) peer IP changed with DPD (Dead Peer Detection) enabled
* When the IP of the DAIP device is changed, the next time the DAIP device initiates a new Phase2, the the non-DAIP peer fails the negotiation.  
  `$FWDIR/log/vpnd.elg` on the non-DAIP side shows the following errors:  
  `[tunnel] QMProcess1: KEY payload sent, but PFS is not set in community - Rejecting`  
  `
  [tunnel] extended_log_info_build_reason_from_list: list is empty,`  
  `
  [tunnel] isakmpd_log: calling isakmpd_log with original reason=(New DH key received during Quick Mode from peer, but Perfect Forward Secrecy is not set in the community.)`  
  `
  [tunnel] GetDAGIP: ID xxxxxxxx not in DAIP range`
* When the IP is changed, the user can see that DPD HELLO comes from the new IP and it is accepted by the Central Security Gateway:  
  `[tunnel] handle_dpd_notification_ikev1: received DPD_R_U_THERE message from peer x.x.x.x`  
  `
  [tunnel] handle_dpd_request_notification_ikev1: received sequence number xxxxxxxx`  
  `
  [tunnel] handle_dpd_request_notification_ikev1: check if the notification cookies are legal`  
  `
  findSAByPeer: Find SA with cookies xxxxxxxxxxxxxxxx,xxxxxxxxxxxxxxxx from packet`  
  `
  findSAByPeer: ISAKMP SA was found`  
  `
  find_ike_sa_by_cookies: copying cookies`  
  `
  get_dpd_resp_info_hash: search cookies xxxxxxxxxxxxxxxx,xxxxxxxxxxxxxxxx`  
  `
  get_dpd_resp_info_hash: found sequence number xxxxxxxx`

## Cause

"findSAByPeer" does not properly validate the peer IP address for a DAIP peer behind NAT.

<br />

## Solution

This problem was fixed. The fix is included in:

* [Check Point R81](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk166715)
* [Jumbo Hotfix Accumulator for R80.40](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk165456) - since *Take_91*
* [Jumbo Hotfix Accumulator for R80.30](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk153152) - since *Take_174*
* [Jumbo Hotfix Accumulator for R80.20](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk137592) - since *Take_182*
* [Jumbo Hotfix Accumulator for R80.10](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk116380) - since *Take_288*

<br />

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content