Cisco ASA VPN Tunnel with Sonicwall NSa

[LovejitSingh130013]

Hello Experts, @Marvin Rhoads  @balaji.bandi  @Rob Ingram 

I have an IPSec tunnel setup with Cisco ASA and Sonicwall NSA. The tunnel works fine with some packet drops and it happens on Sonicwall. I worked with SonicWALL Support and found that ASA sent some ESP headers with invalid SPI, resulting in a drop.

Please see the attached screenshots.

What is SPI ? in ESP Headers.

Also, what should I do on ASA to find that exact root cause?

I can verify that ISPs have no issues on both sides and Firewalls got other tunnels working fine showing the same kind of Hashing/encryption algorithms

Thanks,

Lovejit Singh

[Jitendra Kumar]

 below are some documents available t-shoot very well describe the issue.

hope it will help you..

https://community.cisco.com/t5/vpn/crypto-isakmp-invalid-spi-recovery-command-is-not-worked-fine-in/td-p/1531178

below is the Article from the Sonicwall for workaround for this issue.

https://www.sonicwall.com/support/knowledge-base/troubleshooting-vpn-packets-drops-with-drop-code-message-octeon-decryption-failed/170505715286572/ 

Thanks,

Jitendra