> Source: [sk185047](https://support.checkpoint.com/results/sk/sk185047) # sk185047 - snmpwalk for OID .1.3.6.1.4.1.2620.500.9002.1.3 returns 130 (Phase 1 State) while the VPN tunnel appears up | Property | Value | |----------|-------| | Solution ID | sk185047 | | Date Created | 2026-07-01 | | Last Modified | 2026-07-19 | | Technical Level | Advanced | | Products | Security Gateway | | Versions | R82.10, R82, R81.20 | | OS | Gaia | ## Symptoms - * Performing the SNMP walk as described in [sk63663](https://support.checkpoint.com/results/sk/sk63663) shows "130", for example, when you run on the Security Gateway in Expert mode: `[Expert@GW-01:0]# snmpwalk -Cc -v 2c -c public 10.201.0.101 .1.3.6.1.4.1.2620.500.9002.1.3` ` SNMPv2-SMI::enterprises.2620.500.9002.1.3..0 = Gauge32: 130` --\> IPsec is in phase 1 `SNMPv2-SMI::enterprises.2620.500.9002.1.3..0 = Gauge32: 3` ---\> IPsec is active * Tunnel status is shown as up, for example: ``` [Expert@GW-01:0]# vpn tu list ike Peer 10.199.8.168 , GW-01:0 SAs: IKEv2 SA <336e78cbe8ee2018,2fde99f41b9884cc> [Expert@GW-01:0]# vpn tu list ipsec Peer 10.199.8.168 , GW-01:0 SAs: IKEv2 SA <336e78cbe8ee2018,2fde99f41b9884cc> INBOUND: 1. 0xa9288437 (i: 7) OUTBOUND: 1. 0x6a75c3e4 (i: 7) ```
## Cause This behavior can be expected for a regular site-to-site VPN tunnel. A regular tunnel is considered up when both Phase 1 and Phase 2 keys are present on the peer gateway. The SNMP OID .1.3.6.1.4.1.2620.500.9002.1.3.\.0 reflects the real-time state of the IPsec tunnel. Phase 2 is traffic-driven for regular tunnels. If no traffic that matches the VPN encryption domain passes through the tunnel, the gateway can keep only the IKE security association (Phase 1) and not build or keep the IPsec security association (Phase 2). When matching traffic starts, Phase 2 is negotiated, and the tunnel becomes fully active. SNMP Status Code Reference Value \| Meaning ------\|-------- 3 \| Active -- IPsec tunnel is up with traffic flowing 4 \| Destroyed -- Tunnel has been torn down 129 \| Idle -- Tunnel established, but no traffic passing 130 \| Phase 1 -- IKE Phase 1 complete; Phase 2 not yet negotiated (no interesting traffic) 131 \| Down -- Tunnel is not established 132 \| Initializing -- Tunnel bring-up triggered but not yet complete Scenario 1 -- Tunnel up, no traffic: With Phase 1 established but no interesting traffic flowing, the SNMP walk returned: .9002.1.3.\.0 = **Gauge32: 130** Scenario 2 -- Tunnel up, traffic actively flowing: Immediately after initiating a ping through the tunnel, the SNMP walk returned: .9002.1.3.\.0 = **Gauge32: 3** The OID returned value reverts to 130 after the ping was stopped, confirming the behavior is tied directly to the presence of active traffic. The tunnels are not down; they are simply idle between traffic bursts. ## Solution This solution requires authentication. Please log in to view the full solution. --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content