> Source: [sk178205](https://support.checkpoint.com/results/sk/sk178205)

# sk178205 - "Negotiation with Site failed" error message when trying to authenticate through SAML

| Property | Value |
|----------|-------|
| Solution ID | sk178205 |
| Date Created | 2022-03-24 |
| Last Modified | 2022-04-13 |
| Technical Level | General |
| Products | Endpoint Security |
| Versions | Cloud, E89.X, E88.X |
| OS | Windows |

## Symptoms

- * The "Negotiation with Site failed" error message shows when SAML authentication is used (Username and Password work correctly).
* In some scenarios, the connection process with Endpoint Security stops at 47%.
* `netstat -ano` output on the Endpoint Security Client shows a different process uses port 7779 (this can be checked with collect.log from the client debugs).
* On the affected machine, there's a software that uses local port 7779 (Example: CapaInstaller from CapaSystems).
* *TRGui.log:* `[TrGUI] TrCsrfProtection::initializeTcpServer: Could not start TCP Server For SAML authentication.`

## Cause

Endpoint VPN Client uses the 7779 port for SAML implementation, which a different process blocks.

## Solution

[Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue - improved Endpoint Security Client package.

A Support Engineer will make sure the Endpoint Security Client is compatible with your environment before providing it. For faster resolution and verification, collect the [CPinfo](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk90445) file from the Endpoint Security Client involved in the case.  

This hotfix will allow the user to configure an alternative local port for SAML implementation.

**After the hotfix installation:**

1. Decide on an alternative local port for SAML.
2. Sync this value for the Security Gateway and client sides.
3. The custom build has a predefined 7776 port (the previous port was 7779) in the *trac.defaults* file "*saml_port* " config:` `  
   `saml_port INT 7776 GW_USER 0`
4. On the Security Gateway side, backup and edit the */opt/CPSamlPortal/phpincs/spPortal/saml-vpn/redirect.php* file:  
   Change *http://127.0.0.1:**7779*** to *http://127.0.0.1:**7776*** :  
   ` <img src="http://127.0.0.1:7776/&lt;?php echo urlencode($cookie_hex); ?>" width="1" height="1">`
5. Save the file.
6. Install the Security policy.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content