> Source: [sk177715](https://support.checkpoint.com/results/sk/sk177715)

# sk177715 - Encryption of IKE packets \ IKE over VPN is not enabled

| Property | Value |
|----------|-------|
| Solution ID | sk177715 |
| Date Created | 2022-02-01 |
| Last Modified | 2022-02-06 |
| Technical Level | Advanced |
| OS | Gaia |

## Symptoms

- * IKE packet leaves in clear towards a VPN peer hitting explicit rule
* Other traffic is being encrypted and sent to a VPN peer per the same rule as the non-encrypted IKE packet
* In a Route-Based VPN environment IKE packet is being sent to VPN via vpnt interface, but not encrypted
* The GW in question is NOT the originator of the IKE packet, but parses them between VPN peer
* Kernel debugs shows: `;get_vpn_if_mspi_cpip: RDP/IKE should not be encrypted.;`

## Cause

Parameter encrypt_non_gw_rdp_ike is disabled by default. It enables encryption of RDP and IKE packets NOT originating from the GW.   

Example of a topology scheme for such scenario:  
![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk177715/image-2022-02-02-12-23-15-737202202021937541.png)  
Traffic flow explanation:  

![](https://sc1.checkpoint.com/sc/SolutionsStatics/NEW_SK_NOID1643726559613/IKE202202011709421.png)

1. There is a VPN tunnel between peers 1 and 2, where all IKE and ESP packets should be encrypted and sent into another VPN tunnel between peers A and B.
2. An IKE packet sent from peer 1 is received by peer A; however, Peer A does not encrypt it as it should. In some cases it is sent in clear mode (non-encrypted) into the tunnel.
3. Kernel debug shows: `'get_vpn_if_mspi_cpip: RDP/IKE should not be encrypted'.`
4. System logs on peer 2 indicate the IKE is dropped as a cleartext (non-encrypted) packet.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content