> Source: [sk181612](https://support.checkpoint.com/results/sk/sk181612)

# sk181612 - IKEv1 tunnel to a DAIP peer using ID_DER_ASN1_DN fails on Quick Mode Packet 1

| Property | Value |
|----------|-------|
| Solution ID | sk181612 |
| Date Created | 2023-11-03 |
| Last Modified | 2023-11-14 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81.20, R81.10 (EOS) |
| OS | Gaia |

## Symptoms

- * VPN tunnel to a DAIP peer successfully completes phase 1 / Main Mode, but fails on phase 2 / Quick Mode packet 1 for INVALID-KEY-INFORMATION .
* The Security Gateway is also part of the Remote Access VPN community, and the "generic"\* user profile has been created.
* The DAIP peer has ID_DER_ASN1_DN as the ID type in the IKE negotiation in Phase 1 / Main Mode packets 5/6.
* The VPN community with the DAIP gateway has PFS (Perfect Forward Secrecy) enabled.

## Cause

When receiving an `ID_DER_ASN1_DN ID` type from a DAIP peer using IKEv1, our initial step involves attempting to retrieve the user object using the received Distinguished Name (DN) as the username.  

When the generic\* user profile is set up, it retrieves the user object associated with that specific username.  

The negotiation process progresses through Remote Access flow but encounters a failure at QMProcess1 when PFS (Perfect Forward Secrecy) is configured within the VPN community.

## Solution

This problem was fixed. The fix is included starting from:

* [Integrated in R81.10](https://support.checkpoint.com/results/sk/sk170416)
* [Jumbo Hotfix Accumulator for R81](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81/Default.htm) starting from Take 34
* [Jumbo Hotfix Accumulator for R80.40](https://sc1.checkpoint.com/documents/Jumbo_HFA/R80.40/Default.htm) starting from Take 119

Check Point recommends to always upgrade to the [Recommended version](https://support.checkpoint.com/results/sk/sk95746) ([Security Gateway](https://support.checkpoint.com/product/73) / [VSX](https://support.checkpoint.com/product/359) / [Security Management Server](https://support.checkpoint.com/product/184) / [Multi-Domain Security Management Server](https://support.checkpoint.com/product/166) / [SmartConsole](https://support.checkpoint.com/product/191)).

If you choose not to upgrade, [contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for your version.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing it.  
For faster resolution and verification, collect [CPinfo](https://support.checkpoint.com/results/sk/sk92739) files from the Management Server and Security Gateways / Cluster Members involved in the case.

**Hotfix installation instructions:**   
Refer to [sk168597 - How to install a Hotfix](https://support.checkpoint.com/results/sk/sk168597).

The fix is integrated in the mentioned versions, but it is disabled by default.  

The fix must be enabled using this registry edit.  

`ckp_regedit -a SOFTWARE/CheckPoint/VPN1 ikev1_daip_der_asn1_dn_id -n 1 `  

You can verify the registry edit has taken place with this command.  

`ckp_regedit -p SOFTWARE/CheckPoint/VPN1`  

After changing the registry, you must either install policy from the Management Server, or run the command `fw fetch local` to reload the policy.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content