topic 2 firewall and 1 cisco router in Network Security

2 firewall and 1 cisco router

edgar-quintana — Fri, 21 Feb 2020 11:44:25 GMT

Hi,

I have a 1841 cisco router with ports and ip remote access to locally connected 2 firewalls.

Those firewalls stablish 2 vpn tunnels. 1 is up an the other one no.

This warning is show:

packet has invalid spi for dest address=213.171.249.86, prot=50 spi srcaddress=217.204.95.134.

why? ther is no crypto configured at router all vpn traffic is configured into the firewall

Whats wrong?

Best regards

Re: 2 firewall and 1 cisco router

asafayan — Thu, 15 Oct 2009 23:33:14 GMT

Hi,

Does this scenario / solution apply to your circumstance:

The %PIX-4-402101: decaps: recd IPSEC packet has invalid spi for destaddr=dest_address, prot=protocol, spi=number error message is received on the PIX Firewall

VERSION 2

Core issue

The received IPsec packet specifies a security parameters index (SPI) that does not exist in the security association database (SADB). This can be a temporary condition due to slight differences in the aging of security associations (SAs) between the IPsec peers or it can be due to the clearing of the local SAs. This condition can also be caused by incorrect packets sent by the IPsec peer.

Note: This can also be an attack.

Resolution

The peer may not acknowledge that the local SAs have been cleared. If a new connection is established from the local router, the two peers can then reestablish successfully. Otherwise, if the problem occurs for more than a brief period, either attempt to establish a new connection or contact the peer's administrator.

For more information about PIX Firewall syslog messages, refer to Cisco PIX Firewall System Log Messages, Version 6.3 and Cisco Security Appliance System Log Messages, Version 7.0.

Re: 2 firewall and 1 cisco router

edgar-quintana — Sat, 31 Oct 2009 20:27:48 GMT

HI,

As I told you, there are 2 firewalls behind the router, both has as default GW routers ip, 192.168.157.254. If I change the firewall's LAN ip from 192.168.157.252 to 192.168.157.251 it works... if router is switched off same error.. changing the ip and solution.

what's happening?

Sorry about this late response...I was ill

Best regards