> Source: [sk181491](https://support.checkpoint.com/results/sk/sk181491)

# sk181491 - HTTPS and SSH traffic initiated from a Spark Firewall is not encrypted when sent through a VPN tunnel

| Property | Value |
|----------|-------|
| Solution ID | sk181491 |
| Date Created | 2023-10-21 |
| Last Modified | 2023-10-23 |
| Technical Level | General |
| Products | Spark Firewall (Locally Managed) |
| Versions | R81.10.X |
| Platform | 1570R, 1500, 1600, 1800, 1595R |

## Symptoms

- HTTPS and SSH traffic initiated from a Quantum Spark appliance is not encrypted when sent through a VPN tunnel.

## Cause

SCP traffic (as in periodic backups) sent to the remote backup server is dropped.  

This change was implemented with the aim of mitigating RMD (Reach My Device) traffic from causing undue strain on the VPN tunnels.

<br />

## Solution

Starting from R80.20.60, any HTTPS or SSH traffic that originates from the Quantum Spark / SMB appliance over a VPN tunnel is not encrypted, even when "Route all traffic through peer" is selected in the VPN site.

**To revert this behavior:**

1. Connect to the command line on the Security Gateway / each Cluster Member.

2. If your default shell is the Expert mode (`/bin/bash`), then go to Gaia Clish:

   `clish`
3. Disable the kernel parameter "accept_ssh_https_outgoing_clear". Run:

   `kernel-parameter set name accept_ssh_https_outgoing_clear type int value 0 `
4. Save the changes in the Gaia Database.

You can also control this global kernel parameter by following the instructions in [sk26202](https://support.checkpoint.com/results/sk/sk26202).

**Notes:**

* This is relevant to Quantum Spark / SMB appliances only.

* This change will survive reboots.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content