Invalid SPI for unknown reasons

If an IPSec tunnel is established correctly, but the connection is dropped soon after and messages similar to the following appear in the logs:

CRYPTO-4-RECVD_PKT_INV_SPI: decaps: rec'd IPSEC packet has invalid spi for destaddr=1.2.3.4, prot=51, spi=0x1214F0D(18960141), srcaddr=5.6.7.8

it’s worth trying to add the following commands to the configuration:

crypto isakmp invalid-spi-recovery
crypto isakmp keepalive 60 periodic

With particular emphasis on the keyword periodic.

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s