> Source: [sk179844](https://support.checkpoint.com/results/sk/sk179844)

# sk179844 - Tunnel initiation fails "dropped by vpn_encrypt_chain Reason: no encryption key for destination"

| Property | Value |
|----------|-------|
| Solution ID | sk179844 |
| Date Created | 2022-08-22 |
| Last Modified | 2022-11-26 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R81.20, R81.10 (EOS), R81 (EOS) |

## Symptoms

- * User tries to initiate a VPN tunnel with peer and fails.  

* IKE logs show that the first packet that was sent with no answer from peer.  

* fw ctl zdebug + drop show:   

  `"[vs_0];[tid_0];[fw4_0];fw_log_drop_ex: Packet proto=17 `:500 -> :500 dropped by vpn_encrypt_chain Reason: no encryption key for destination;"  

* The Implied rules show that there is no "accept" rule form local machine. as in any with service IKE or an accept the other way around.

## Cause

1. IKE and IKE_NAT services are not accepted in the rule base.
2. The VPN tunnel establishment is initiated with an Main Mode IKE packet and hits the Security Gateways chains.
3. The Security Gateway thinks that it is necessary to encrypt the first Main Mode IKE packet.
4. As there is no tunnel established yet, it has no agreed-upon key to encrypt the traffic with.
5. The Security Gateway decides to drop the packet before egressing it. It thinks that the packet must be encrypted.
Note: The main mode must be clear text by design, and not encrypted.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content