> Source: [sk171832](https://support.checkpoint.com/results/sk/sk171832)

# sk171832 - Traffic stops on VPN tunnel between Check Point and AWS due to different PES groups: "Packet was decrypted with methods which are different from the methods according to the security policy": PFS between Check Point and AWS

| Property | Value |
|----------|-------|
| Solution ID | sk171832 |
| Date Created | 2021-02-22 |
| Last Modified | 2021-04-05 |
| Technical Level | Advanced |
| OS | Gaia |

## Symptoms

- * Traffic through the VPN tunnel stops.
* "Packet was decrypted with methods which are different from the methods according to the security policy - Gateway and Peer use different DH groups."
* In the log, the "Methods" section shows which PFS group the peer uses when encrypting the traffic. This PES group is different from the one that the community sets.
* $FWDIR\\log\\vpnd.elg shows which group is sent by AWS peer: \[vpnd 58154 4083821312\]@Hostname\[2 Feb 20:16:02\]\[tunnel\] ESP_SA_FromTransformList: HMAC alg: 2, HMAC keylen: 32 \[vpnd 58154 4083821312\]@Hostname\[2 Feb 20:16:02\]\[tunnel\] compute_keymat: DH group = 2; Peer type = non-CP; dhlen = 128

## Cause

The two peers agree on a Diffie-Hellman Group.

By default, traffic passes through the VPN tunnel for one hour.

Phase 2 starts. The Quick Mode key lifetime applies to phase 2.

During phase 2 negotiation, the two ends take a long time to agree on which Diffie-Hellman Group to use.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content