3

I have implemented a Site-to-Site IPsec tunnel between a Juniper SSG firewall and a SonicWall.

However, any traffic that I send over the tunnel gets dropped on the SonicWall with an error saying sonicwall ipsec vpn decryption failed selector check error.

I have tried multiple things with no luck including disabling replay protection and enabling fragmented packets handling.

Does anyone know what this error message means? What is the selector check?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Apr 1 '18 at 23:11
3

This sounds like an issue with traffic-selectors - if you are using policy-based VPN on both sides, you need to make sure the policy (eg: traffic you permit over the tunnel) is the same but reversed on each side. eg:

Side A:

From Side A Network to Side B Network then tunnel

Side B:

From Side B Network to Side A Network then tunnel

  • Domain encryption is correct otherwise the tunnel will not come up – Mr.lock Mar 26 '18 at 3:41
  • Okay - your post doesn't mention the tunnel being up. Are you using Perfect Forward Secrecy (PFS) on both sides? Have you got a security policy on your SRX that allows the traffic to the tunnel? Is your tunnel interface in the correct zone? – Benjamin Dale Mar 26 '18 at 6:49
  • it is not SRX it is SSG , and I am using policy based VPN on the SSG side – Mr.lock Apr 1 '18 at 4:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.