> Source: [sk32648](https://support.checkpoint.com/results/sk/sk32648)

# sk32648 - Site-to-site VPN using certificates issued by the ICA (Internal Certificate Authority) fails with error

| Property | Value |
|----------|-------|
| Solution ID | sk32648 |
| Date Created | 2007-03-11 |
| Last Modified | 2022-08-14 |
| Technical Level | General |

## Symptoms

- * SmartView Tracker shows an IKE negotiation error: "Invalid Certificate".
* *IKE.elg* debug shows that after the six main mode packets of the IKE negotiation Phase 1 are exchanged, one of the peers in the Site-to-Site VPN sends out an IKE notification packet with an "invalid certificate" message.
* SmartView Tracker on a Security Gateway located between one of the peers in the Site-to-Site VPN community and its SmartCenter shows a 'drop' log entry for TCP port 18264.
* Intermittent VPN tunnel down due to "Invalid certificate" between two Check Point gateways and Management server is behind one gateway.

## Cause

One of the Security Gateways in the Site-to-Site VPN community is unable to communicate with the SmartCenter server (or CMA) via TCP port 18264 (FW1_ica_services - Check Point Internal CA Fetch CRL and User Registration Services).

**Possible Cause 1:** A Security Gateway that is located between the VPN-1 Gateway and its SmartCenter server (or CMA) is blocking the TCP port 18264 communication.

**Possible Cause 2:**Another possibility is that when the SmartCenter (or CMA) is behind a NAT, the traffic from the remote gateway is going to the wrong IP (private IP).

## Solution

**Solution to Possible Cause 1**

In order to allow TCP port 18264 communication between the VPN-1 Gateway and its SmartCenter server (or CMA), the Security Gateway located between these two machines needs to have the following type of explicit rule installed:

|---------------|-----------------------------|------------------|--------|-------|
| SOURCE        | DESTINATION                 | SERVICE          | ACTION | TRACK |
| VPN-1 Gateway | SmartCenter server (or CMA) | FW1_ica_services | accept | Log   |

Reinstall the security policy on the Security gateway located between the VPN-1 Gateway and its SmartCenter Server (or CMA), after this rule has been added.

After the procedure completes:

The Security Gateway located between the VPN-1 Gateway and its SmartCenter server (or CMA) should allow TCP port 18264 communication, allowing the one peer to validate the other peer's VPN certificate with its SmartCenter's (or CMA's) CRL (Certificate Revocation List), and thus enabling the Site-to-Site VPN to properly complete the IKE negotiation and establish the Site-to-Site VPN tunnel.

**Solution to Possible Cause 2** verify that the NAT is configured according to [sk66381](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk66381).  

**This solution applies specifically to Site-to-Site VPN scenarios.**   
The solution that handles the SecuRemote/SecureClient VPN scenario for this issue is [sk24552](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk24552).

**Related Solutions:
Excluded Tunnel Test port (18264) services in VPN community . So that traffic on this port will be clear text between two Check /Point Gateways**   
[sk17745 - Services allowed by "Accept FireWall-1 Control Connections" property](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk17745)

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content