%CRYPTO-6-IKMP_MODE_FAILURE: Processing of Informational mode failed with p

[vyelmene]

Has anyone ran across this error message: %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Informational mode failed with peer at x.x.x.x? I've seen similar ones, but not the 'informational' mode. I'm also getting this message; ISAKMP (1): sending packet to x.x.x.x (I) MM_NO_STATE.

Any help would be great.

Thanks.

[vyelmene]

Disregard, I have fixed my problems.

[hakenkreuz]

How did you fix it? I´m getting the same error on a Dual Hub Single Layout DMVPN even if I copy paste the same crypto info in all my hubs and spokes.

[MSD1001]

HI , please help me out with the solution. I am working on an office project and implemented cluster dmvpn. Though the tunnel is up, i keep getting this message.

[MSD1001]

plz help !

[MSD1001]

Please help me with the solution.

[CiscoPurpleBelt]

Hey check your policies and especially the keys on both sides, its probably because something is not matching.

[Wizard4777]

all keys are the same. the hub is not displaying isakmp is on when applied to interface

[cord o]

As others have mentioned, double check that your keys and transform sets are matching on both ends.

During after hours try running debug crypto ipsec

[Wizard4777]

what was the fix? i have the same issue too

[arpgaur]

Run  sh crypto isakmp sa to check if the phase 1 tunnel is up.

this message has more to do with the phase -2 tunnel. once the first one is checked check the phase 2 tunnel. 

start a ping from host A to host B

run >> #sh crypto ipsec sa. And check if we're getting any packets encrypted/decrypted. my bet would be, you won't see any packet being encrypted.

now, run> sh crypto map for routers on both the ends and check if we have the correct configuration on both the devices, and by that, I mean.

1> peers IP are correct (common issue)

2> ACL's are correct, both routers are correct identifying the source and destination IP (most common issue)

3> crypto map is applied on the correct interface.

it's basically a configuration mismatch and a closer look should resolve this issue.

[rackaraaron]

Hello, I am new with the IPsec configs but am studying as part of the ENCOR.
Here is a brief story:
After configuring a GRE tunnel I decided to use crypto map to add IPsec. 
The GRE tunnel was fine. The underlay protocol was eigrp and after establishing the tunnel I decided to advertise the loopbacks and the LAN networks on the remote host through OSPF over the tunnel which worked fine. 

The moment I applied the crypto map to the outside interface, I got the error below:
R4(config-if)#crypto map MYMAP
R4(config-if)#
*Aug 20 01:04:21.437: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON
R4(config-if)#
*Aug 20 01:04:25.495: %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Informational mode failed with peer at 10.10.1.1
R4(config-if)#
*Aug 20 01:04:36.564: %OSPF-5-ADJCHG: Process 1, Nbr 0.0.1.1 on Tunnel0 from FULL to DOWN, Neighbor Down: Dead timer expired
R4(config-if)#
*Aug 20 01:05:32.148: %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Informational mode failed with peer at 10.10.1.1
R4(config-if)#
*Aug 20 01:06:38.663: %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Informational mode failed with peer at 10.10.1.1
R4(config-if)#
*Aug 20 01:07:43.336: %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Informational mode failed with peer at 10.10.1.1
after reading your comment on this post, I issued the command sh crypto ipsec sa and I got a strange result as shown in the attachment.

In the end I noticed that I forgot to configure the pre-shared key on R1 which fixed the issue. 

Your post has opened my mind to troubleshoot my issue.

Thanks. 

[MHM Cisco World]

share the config I will check it 

[SDhaliwal]

I ran into the same issue while working GRE over IPsec lab. The issue I ran into was misconfiguration of key command, make sure to verify that the key matches on both end and also verify peer IP address when you configure isakmp key. 

crypto isakmp key <key> address <peer-ip>.