error Clear text packet should be encrypted - Check Point CheckMates

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

12 Replies

MVP Diamond

‎2024-03-0808:40 AM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

Let me see if I can find some stuff about this, it might be known issue if gateways are still on R80.40

Andy

Best,

Andy

"Have a great day and if its not, change it"

Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

MVP Diamond

‎2024-03-0808:41 AM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

K, found it...MAKE SURE to backup the files first, of course

# cd $FWDIR/conf

# cp user.def.FW1 user.def.R8040CMP

Thats it. Then push the policy.

Andy

Best,

Andy

"Have a great day and if its not, change it"

Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

bezeq_int

Participant

‎2024-03-0809:07 AM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

In response to the_rock

No sir, that also did not fix the issue

[Expert@CP-MGMT:0]# cd $FWDIR/conf

[Expert@CP-MGMT:0]# pwd

/opt/CPsuite-R81.20/fw1/conf

[Expert@CP-MGMT:0]# ll | grep user.def

...

-rwxrwx--- 1 admin bin 882 Mar 7 20:44 user.def.FW1

...

-rw-r----- 1 admin bin 732 Nov 16 2022 user.def.R8040CMP

...

[Expert@CP-MGMT:0]#

[Expert@CP-MGMT:0]# cp user.def.FW1 user.def.R8040CMP

[Expert@CP-MGMT:0]#

[Expert@CP-MGMT:0]# ll | grep user.def.FW

-rwxrwx--- 1 admin bin 882 Mar 7 20:44 user.def.FW1

[Expert@CP-MGMT:0]# ll | grep user.def.R

....

-rw-r----- 1 admin bin 882 Mar 8 18:56 user.def.R8040CMP

Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

MVP Diamond

‎2024-03-0809:28 AM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

Did you install the policy?

Best,

Andy

"Have a great day and if its not, change it"

Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

bezeq_int

Participant

‎2024-03-0809:35 AM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

In response to the_rock

sure i did 🙂

1\ \ \ Kudo

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

MVP Diamond

‎2024-03-0810:07 AM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

K, fair enough. If thats the case, I dont want to tell you to modify anything else with that file, as Im worried we may make it worse and no one wants that on the weekend lol

Anyway...maybe reverse all the changes and lets take a step back here. So, IF its saying clear packet should be encrypted, logically, that insinuates to me that something is missing in the enc. domain possibly...can you check?

Best,

Andy

Best,

Andy

"Have a great day and if its not, change it"

Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

bezeq_int

Participant

‎2024-03-0810:39 AM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

In response to the_rock

thankyou

we'll check with TAC

Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

_Jelle

Collaborator

‎2024-11-1807:25 AM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

Hi bezeq_int,

So, it's a while ago but any chance you could still share the outcome of your TAC case? Would be great for me but also other people crawling these topics.

Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

KeonNg

Participant

‎2025-12-2207:06 PM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

Hi @bezeq_int

Seeking for your update as well the feedback from TAC. Thank you.

What I suspect from here is that whether you need to remove the line:

#define NON_VPN_TRAFFIC_RULES 0

since you have rules define:

#define NON_VPN_TRAFFIC_RULES (dst=y.y.y.y or dst=z.z.z.z)

But im not sure.

Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

MVP Diamond

‎2025-12-2307:46 AM

https://community.checkpoint.com/t5/Security-Gateways/Unnumbered-VTI-to-3rd-party-gateway/m-p/137471...

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

In response to KeonNg

See if this explanation by @Bob_Zimmerman helps. I know maybe not exact same scenarion, but it is relevant.

Best,

Andy

"Have a great day and if its not, change it"

Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

MVP Diamond

‎2026-01-0106:44 PM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

Hey mate,

Happy new year!

Any progress with this?

Best,

Andy

"Have a great day and if its not, change it"

Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

Bob_Zimmerman

MVP Gold

‎2025-12-2307:19 AM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

This message means the source is in a peer's encryption domain and the destination is in the local encryption domain. The firewall is saying it should have received this traffic over a VPN with that peer.

Think of it like antispoofing for VPNs.

"According to the policy, the packet should not have been decrypted" is similar, but the other way around: the local system decrypted the packet, but the source isn't in that peer's encryption domain or the destination isn't in the local encryption domain.

Kudos