> Source: [sk182721](https://support.checkpoint.com/results/sk/sk182721)

# sk182721 - SIC initialization fails due to routing over VTI interface

| Property | Value |
|----------|-------|
| Solution ID | sk182721 |
| Date Created | 2024-10-01 |
| Last Modified | 2024-10-06 |
| Technical Level | General |
| Products | Security Gateway, Security Management Server |
| Versions | R81.20, R81.10 (EOS), R81 (EOS) |

## Symptoms

- * SIC initialization fails when trying to establish SIC between standalone devices.
* **TCPdump Capture Analysis**

  TCPdump captures indicate that traffic is being translated from the Security Management (MGMT) interface IP address to the Virtual Tunnel Interface (VTI) address/network. The captured packets are as follows:
  > `IPv4 (0x0800), length 76: .18211 > .10200 lags [S.], seq Out ethertype IPv4 (0x0800), length 76: .10200 > .18211 lags [S.], seq`

  <br />

  * **Packet 1:**
    * Ethertype: IPv4 (0x0800)
    * Length: 76 bytes
    * Source IP: \[MGMT Interface IP\].18211
    * Destination IP: \[VTI IP\].10200
    * Flags: \[S.\] (SYN)
    * Sequence Number: \[seq\]
  * **Packet 2:**
    * Ethertype: IPv4 (0x0800)
    * Length: 76 bytes
    * Source IP: \[VTI IP\].10200
    * Destination IP: \[MGMT Interface IP\].18211
    * Flags: \[S.\] (SYN)
    * Sequence Number: \[seq\]
* Standalone is configured with a VTI interface.
* The `show routes` command does not display any configured routes from the Security Management MGMT to the VTI.
* Communication between the member interfaces functions as expected, with both members Security Management interfaces able to ping and communicate successfully.

## Cause

SIC a core feature in Check Point products that provides secure, encrypted communication between components such as the Security Management Server and Security Gateways.

**Important -** SIC depends on specific conditions to function correctly, and one key requirement is the type of interface used for communication.

It is important to note that SIC relies on specific conditions to function properly, and one of the most critical requirements is the type of interface over which the communication occurs.  

To ensure proper SIC functionality, traffic must pass through a physical interface with direct IP configuration. The use of VTI or NAT for SIC communication is unsupported and will result in failure.

## Solution

**To resolve SIC establishment issues, ensure that your SIC communication does not route through a VTI interface.**   

1. Verify there are no static or dynamic routes that direct MGMT (SIC) traffic to the VTI address or network.
2. Analyze the traffic flow. Capture the SIC initialization process using `cppcap`, `fw monitor`, or `tcpdump`. In the capture, confirm that the MGMT interface address is not NATed to the VTI network or address. If NAT is present, then must fix it.
In general, it is best not to perform any NAT on SIC communication, it can cause complications and issues.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content