VPN Troubleshooting

VPN Problems

Internet Key Exchange Protocol Version 2 (IKEv2)
https://tools.ietf.org/html/rfc5996

IKEv2 negotiation for Site-to-Site VPN tunnel with 3rd party peer fails if IKEv2 SA payload contains more than 8 proposals
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk112139

Use Ike debug to validate and understand how both devices are negotiating the parameters

disable acceleration if you can:

fwaccel off
vpn debug ikeon
vpn debug trunc

Get the file $FWDIR/log/ikev2.xmll and check the proposal for both side.
Read the file $FWDIR/log/vpnd.elg and try to find any inconsistencies.

IKE is the same for all players, the problem is configuration. Many times, the devices try to send parameters differently of what you expect they do.
Check Point firewalls try to summarize the networks inside the encryption domain, this is called supernetting.
It will try to summarize at maximum possible and will send that summarization in place of original one.
If you have two subnets /24 it will try to send a /23.
Route based VPN is more flexible than domain based and you can have both configured. Use it if you can.
There's a new version for ikeview.exe capable to read $FWDIR/log/ikev2.xmll. (https://support.checkpoint.com/results/sk/sk30994)
Check on support center and if possible use its the best tool to troubleshoot VPN problems on Check Point side.
Disable debug after all

fwaccel on
vpn debug off