A packet is dropped with the log "Encryption Failure: clear text packet received." What's the MOST probable cause?

Mateus R.Jun 26, 2026

C is the right pick here. Think of it like a bouncer at a members-only club who has strict orders to only let in people wearing the club badge (encrypted packets), and then someone walks up in street clothes with no badge at all, so the bouncer turns them away and writes it in the log. That log message means the local gateway was expecting ciphertext on that tunnel route but the remote peer sent raw, unencrypted traffic instead, which is exactly what "clear text packet received" is telling you.

Viktor S.Jun 26, 2026

That log is the firewall telling you it expected an encrypted packet on that route but got a raw one instead, which is exactly what happens when the remote peer's VPN tunnel drops or never came up on their end while your policy still points traffic at it. C is right because the log is describing the symptom precisely, not a negotiation failure or a config mismatch you would see in IKE logs.

Orla P.Jun 26, 2026

C is right, the peer sent unencrypted traffic on a route expecting ESP.

Grace U.Jun 26, 2026

C is the one, and the log is practically spelling it out for you. The gateway expected an ESP-encapsulated packet on that route and got plaintext instead, which means the remote peer either lost its SA or never had a matching encryption domain configured on that traffic.

Ingrid P.Jun 25, 2026

That log fires when the Check Point gateway expects encrypted traffic on a VPN route but receives a cleartext packet instead, which is exactly option C. A card worth making here: front side "Encryption Failure: clear text packet received" back side "peer sent unencrypted traffic on a route the local gateway treats as encrypted, usually because the remote side lost SA state or never completed Phase 2."