> Source: [sk173510](https://support.checkpoint.com/results/sk/sk173510)

# sk173510 - IPSEC VPN Border Gateway Protocol (BGP) stuck in Idle state

| Property | Value |
|----------|-------|
| Solution ID | sk173510 |
| Date Created | 2021-05-13 |
| Last Modified | 2024-02-14 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |
| Platform | 5000 |

## Symptoms

- * The Security Gateway fails to run Border Gateway Protocol (BGP) over IPSec VPN with Virtual Router Redundancy Protocol (VRRP) setup and Virtual Tunnel Interface (VTI) tunnels. The Security Gateway shows an idle state.
* Ipsec works with Amazon Web Services (AWS), but BGP peers do not appear and the Security Gateway still shows an idle state.
* Netstat port 179 is listening but *tcpdump -nni* on any port does not show any packets traveling through port 179.
* BGP debug shows: "`May 1 11:14:03.602572 bgp_ifaddr_change(7076): interface 14.142.124.198(eth7) changed
  May 1 11:14:03.602572 bgp_ifaddr_change(7101): Checking if interface change affects any peers
  May 1 11:14:03.602572 bgp_set_nexthop_addresses(9735): 169.254.189.45 [eBGP AS 64512] No IPv4 address found to connect
  May 1 11:14:03.602572 bgp_set_peer_ifaps(5383): 169.254.189.45 [eBGP AS 64512] Setting local nexthop addresses failed`"
* External EGP (EBGP) Setup Peers have different Autonomous System (AS) numbers:

  ```
  > show bgp peers-------Show BGP state in IDLE.
  ```

## Cause

BGP over VTIs with VRRP is not supported. VTIs and VRRP are not supported together because VRRP cannot work with point to point interfaces.  

This is a limitation of VRRP. VRRP requires layer 2 connectivity between cluster members, but a VTI is a point-to-point link between VPN peers, meaning that it is not possible for cluster members to exchange VRRP hello packets on a VTI.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content