crypto ipsec security-association multi-sn

[DraganSkundric87318]

hi,

is it possible to configure 

crypto ipsec security-association multi-sn

per peer? I am trying to resolve anti-reply errors and this command needs to be configured on both side of ipsec tunnel. One router involved has many tunnels and I need to configure this only on one.

br 

[M02@rt37]

Hello @DraganSkundric87318 

No, it's not possible to configure the [crypto ipsec security-association multi-sn] command per peer. This command is a global configuration command that enables or disables the use of multiple SAs for a single IPsec peer.

[MHM Cisco World]

under the crypto map for that peer there is 

set security-association multi-sn

 this way you can apply this command only for this peer

[DraganSkundric87318]

I am using VTI's and there is no this set command under ipsec profile

[MHM Cisco World]

OK let me check how we can solve issue.

[M02@rt37]

@DraganSkundric87318 

What about this command 

crypto ipsec security-association multi-sn

Not in global mode but under the interface tunnel interface? 

[DraganSkundric87318]

there is no this command in interface mode, only crypto ipsec df-bit and fragmentation

[MHM Cisco World]

ok the anti-reply issue can solve via three 
1- disable anti-reply 
2- change the size of window
3- config multi-seq num

why you can not use one of above two solution ?

[DraganSkundric87318]

Well


1. I want to keep anti-reply protection
2. Max windows size does not help
3. I do not want to change this on few hundered locations

But looks like problem is mybe in qos/VTI combination so I will try to move qos policy from physical interface to tunnel

[MHM Cisco World]

understood, 
this command in in IOS XE, I need to return home and check CSR.
update you soon. 

[MHM Cisco World]

I use CSr1000 IOS XE and there is set multi-sn under ipsec profile 
please check above 

[DraganSkundric87318]

well on ASR 1001-x  ios xe 17.06.03a there is not 

(config-crypto-map)#set sec
(config-crypto-map)#set security-association ?
dfbit Handling of encapsulated DF bit.
dummy Enable transmitting dummy packets
ecn Handling of ECN bit
idle-time Automatically delete IPSec SAs after a given idle period.
level specify a security association granularity level for identities
lifetime security association lifetime
replay Set replay checking.

[MHM Cisco World]

I think I found solution but I need to check some command reference first. 

[beverhart1993]

Did you ever figure this out?

[MHM Cisco World]

can you please make new post 

thanks 

MHM