IPSEC-3-REPLAY_ERROR

[Kihyun Han]

Cisco IOS-XE

cisco ASR1002

Do you have any idea??

what is the cause? it looks like HMAC or Crypto map?

Dec 27 14:15:09.233 UTC: %IOSXE-3-PLATFORM: F0: cpp_cp: QFP:00 Thread:120 TS:00027993990377395461 %IPSEC-3-REPLAY_ERROR: IPSec SA receives anti-replay error, DP Handle 231

Dec 27 14:18:05.191 UTC: %IOSXE-3-PLATFORM: F0: cpp_cp: QFP:00 Thread:100 TS:00027994166334983422 %IPSEC-3-REPLAY_ERROR: IPSec SA receives anti-replay error, DP Handle 244

Dec 27 14:26:39.338 UTC: %IOSXE-3-PLATFORM: F0: cpp_cp: QFP:00 Thread:152 TS:00027994680430956423 %IPSEC-3-REPLAY_ERROR: IPSec SA receives anti-replay error, DP Handle 253

Dec 27 14:15:09.233 UTC: %IOSXE-3-PLATFORM: F0: cpp_cp: QFP:00 Thread:120 TS:00027993990377395461 %IPSEC-3-REPLAY_ERROR: IPSec SA receives anti-replay error, DP Handle 231

Dec 27 14:18:05.191 UTC: %IOSXE-3-PLATFORM: F0: cpp_cp: QFP:00 Thread:100 TS:00027994166334983422 %IPSEC-3-REPLAY_ERROR: IPSec SA receives anti-replay error, DP Handle 244

Dec 27 14:26:39.338 UTC: %IOSXE-3-PLATFORM: F0: cpp_cp: QFP:00 Thread:152 TS:00027994680430956423 %IPSEC-3-REPLAY_ERROR: IPSec SA receives anti-replay error, DP Handle 253

Regards

Keen

[Kihyun Han]

Do you have any idea, why does it happned?

[abdullah-hassan]

have you resolved the issue 

[DFWTechGuy]

This usually points to the IPsec anti-replay protection receiving packets out of order or outside the configured replay window. It can happen with packet reordering, load balancing, or high traffic rather than necessarily being an HMAC or crypto map issue. You should check the IPsec SA counters and replay window first, especially on both ends. Commands like show crypto ipsec sa can help confirm whether replay errors are increasing and which SA is affected.