topic Re: Cisco ASA 5545X Error Message in Network Security

Cisco ASA 5545X Error Message

TW80CJ5 — Wed, 13 May 2020 16:13:12 GMT

Hello All,

I am getting an error message in the CLI : "MAC decrypt: MAC length error"

We are running ASA 9.14(1)

Error repeats itself approximately 3-4 minutes...

Re: Cisco ASA 5545X Error Message

Marius Gunnerud — Wed, 13 May 2020 17:49:16 GMT

Seems that there is a mismatch in your HMAC configuration in one of your VPNs. But you did not provide much information to go on so this is what first comes to mind.

Re: Cisco ASA 5545X Error Message

TW80CJ5 — Wed, 13 May 2020 17:52:26 GMT

I stepped out of the office. What additional info would you like???

Thanks for the suggestion...

Re: Cisco ASA 5545X Error Message

Marius Gunnerud — Wed, 13 May 2020 18:18:02 GMT

Well, check the HMAC configuration first and if that doesn't pan out then you could provide the following:

a description of your network (what connects to the ASA, a switch, router, etc.)

- What roll the ASA plays in your network (just VPN or also a gateway to the internet)? I suppose this could fall under the network description also.

- How many VPNs do you have and how many are reporting this error?

- Were there any changes made prior to seeing this error? Or is this a new VPN setup?

Re: Cisco ASA 5545X Error Message

TW80CJ5 — Fri, 15 May 2020 19:39:20 GMT

I apologize for such a delayed response.

I wanted to follow up with our solution. We viewed the firewall logs and were getting an NTP packet refusal. I removed our NTP server configs on the firewall and re-added them AFTER I reconfigured the switch that serves time on our network. I removed and re-added the NTP server settings on the switch and verified our ASA successfully pulled time. Once it did that, the error messages ceased.

Thank you for the valuable input and have a great day!