> Source: [sk180433](https://support.checkpoint.com/results/sk/sk180433)

# sk180433 - VPN traffic cannot be encrypted and dropped with the message: dropped by vpn_drop_and_log Reason: Failed to enforce VPN policy (11)

| Property | Value |
|----------|-------|
| Solution ID | sk180433 |
| Date Created | 2022-12-21 |
| Last Modified | 2023-01-16 |
| Technical Level | Advanced |
| Products | Spark Firewall (Locally Managed) |
| Versions | R81.10.X |
| Platform | 1570R, 1500, 1600, 1800 |

## Symptoms

- * VPN traffic cannot be encrypted and dropped with the message *dropped by vpn_drop_and_log Reason: Failed to enforce VPN policy (11)*
* In VPN Kernel debugs, it shows this error: *@;815966390;20Dec2022 17:20:46.367845;\[cpu_1\];\[fw4_1\];vpn_enc_scheme_to_schemname: illegal scheme -1;
  > @;815966390;20Dec2022 17:20:46.367846;\[cpu_1\];\[fw4_1\];
  > vpnk_route_log: in the kernel - calling fwchainlog_delayed_rulebase_log with alert -1 ;
  > @;815966390;20Dec2022 17:20:46.367848;\[cpu_1\];\[fw4_1\];
  > action = 0 
  > dst schemename = NA 
  > dst user = ;
  > @;815966390;20Dec2022 17:20:46.367851;\[cpu_1\];\[fw4_1\];
  > dst methods = ESP: AES-256 + SHA256 
  > fail_reason = Failed to enforce VPN policy (11)*

## Cause

Policy Based Routing is configured on the gateway. PBR and VPN are not supported.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content