Core issue
This issue is due to the presence of Cisco bug ID CSCsd50841.
When 800 series routers run with CPU over 50 percent, traffic can stop after one or more IPsec rekeys. When this happens, Packets Dropped and Invalid Flow Error counters increment in the crypto accelerator statistics. Use the show crypto engine accelerator statistic command in order to view these counters.
This issue occurs on 870 routers when the IPsec flow ID value reaches 40 and on 1800 routers when the flow ID reaches 300. Most often, the main outbound Security Association (SA) does not pass traffic.
Note: This issue is first found in Cisco IOS Software Release 12.4(6)T.
Resolution
For temporary workaround:
- Clear the IPsec SAs. Use the clear crypto sa command in order to restart traffic or set a longer IPsec rekey interval.
For permanent workaround:
- In order to completely resolve this issue, download the latest code. With Cisco, the number of images and releases is reduced, which makes it easier to choose the right release.
This bug is fixed in these software releases:
- Cisco IOS Software Release 12.4(7.18)T
- Cisco IOS Software Release 12.4(6)T01
Refer to the Cisco IOS Upgrade Planner for more information.
