2

I have implemented a Site-to-Site IPsec tunnel between a Juniper SSG firewall and a SonicWall.

However, any traffic that I send over the tunnel gets dropped on the SonicWall with an error saying sonicwall ipsec vpn decryption failed selector check error.

I have tried multiple things with no luck including disabling replay protection and enabling fragmented packets handling.

Does anyone know what this error message means? What is the selector check?

Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Commented Apr 1, 2018 at 23:11

1 Answer 1

Reset to default
3

This sounds like an issue with traffic-selectors - if you are using policy-based VPN on both sides, you need to make sure the policy (eg: traffic you permit over the tunnel) is the same but reversed on each side. eg:

Side A:

From Side A Network to Side B Network then tunnel

Side B:

From Side B Network to Side A Network then tunnel

Improve this answer
3
  • Domain encryption is correct otherwise the tunnel will not come up
    – Mr.lock
    Commented Mar 26, 2018 at 3:41
  • Okay - your post doesn't mention the tunnel being up. Are you using Perfect Forward Secrecy (PFS) on both sides? Have you got a security policy on your SRX that allows the traffic to the tunnel? Is your tunnel interface in the correct zone?
    – Benjamin Dale
    Commented Mar 26, 2018 at 6:49
  • it is not SRX it is SSG , and I am using policy based VPN on the SSG side
    – Mr.lock
    Commented Apr 1, 2018 at 4:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.