site-to-vpn goes down

[FredDenHeijer]

Hi, I have a cisco 2811 connected by vpn to a sonic firewall. On several occasions the connection is down. In the log of the Cisco 2811 i get the following error:

%CRYPTO-6-IKMP_NOT_ENCRYPTED: IKE packet from xxx.xxx.xxx.xxx was not encrypted and it should've been.

*Jul 19 17:38:26.293: %CRYPTO-4-RECVD_PKT_INV_SPI: decaps: rec'd IPSEC packet has invalid spi for destaddr=xxx.xxx.xxx.xxx, prot=50, spi=0x1C4F247F(474948735), srcaddr=xxx.xxx.xxx.xxx

I've looked at the configurations of both the cisco as the sonic and they look fine.

Hope someone can help me with this our client is quit desperate.

[Collin Clark]

Check this link,

http://www.cisco.com/en/US/docs/ios/12_3t/12_3t2/feature/guide/gt_ispir.html

Hope it helps.

[FredDenHeijer]

This article writes about two cisco routers,my situation is with one cisco and a Sonic Firewall. I'm not sure how to set this on the Sonic. Or can i implement this on the Cisco router only?

[loizosko]

we had this issue today as well. we have 2 routers connected via a ds3 running ipsec encryption between them for compliance reasons, since the telco links are not considered trusted. at some point we could not pass traffic accross, the links were up and we were receiving the %CRYPTO-4-RECVD_PKT_INV_SPI: error

we removed the crypto and re-apply it to the interface and got established. we did put the crypto isakmp invalid-spi-recovery command afterwards and hopefully the issue does not appear again. we had this issue again in the past when we upgraded the ios and rebooted the router. a second reboot that time fixed it.

i just hope this command will prevent the issue from happening again.

[cempuerto]

Hi,

any update on this post?? having the same issue.

Thanks,

[FredDenHeijer]

Our problem was that we had multiple connections configured as one but only one line was configured with the vpn. The other sides on its behalve communicated on only one of the connections.

[cempuerto]

I'm trying to set up VPN connection using

1841 router and tz-190 sonicwall firewall.

VPN is not working and i'm getting

"%CRYPTO-6-IKMP_NOT_ENCRYPTED: IKE packet from [IP_address] was not encrypted and it should've been"

i have found this article

www.cisco.com/application/pdf/paws/.../vpn-sonicwall-pixfw.pdf

Sonicwall was set to aggressive mode. so i'm planning to follow the steps on the article making Phase 2 dynamic.. have any one tried this??

Thanks