> Source: [sk185172](https://support.checkpoint.com/results/sk/sk185172)

# sk185172 - Site-to-Site VPN Traffic Is Dropped with "decryption failure: tunnel is accelerated but packet was not decrypted by SecureXL"

| Property | Value |
|----------|-------|
| Solution ID | sk185172 |
| Date Created | 2026-08-06 |
| Last Modified | 2026-08-13 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- * The Site-to-Site VPN tunnel is established successfully.
* Internet Key Exchange (IKE) Phase 1 and Phase 2 are up.
* VPN traffic does not pass through the tunnel.
* The issue appears in VPN Link Selection or Route-Based VPN deployments.
* Traffic works when VPN acceleration is disabled.
* Traffic fails when VPN acceleration is enabled.
* Packet captures show encrypted traffic sent to an unexpected destination IP address.
* Kernel messages may contain:  

  ```
  dropped by vpn_ipsec_decrypt
  Reason: decryption failure: tunnel is accelerated but packet was not decrypted by SecureXL
  
  fw_ipsec_decrypt_request: spi is accelerated, not decrypting in FW
  
  VPN-1: vpn_ipsec_decrypt: IPSEC decryption failed
  
  vpn_decrypt: connection localip error
  ```

## Cause

The peer gateway sends Encapsulating Security Payload (ESP) traffic to the gateway main IP address instead of the configured VPN Link Selection IP address.  

This behavior can occur when the peer gateway uses:**`ipsec_use_p1_src_ip = 1`**

When this parameter is enabled, the peer uses the Internet Key Exchange (IKE) Phase 1 source IP address as the VPN endpoint.

As a result:

* The encrypted packet reaches a destination IP address that differs from the VPN endpoint expected by the receiving gateway.
* SecureXL cannot associate the packet with the expected VPN endpoint.
* The gateway rejects the packet during decryption processing.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content