Hello,
One of our 1921 router configured with GRE tunnel has been reporting Crypto errors every single day and has OSPF adjacency flapping.
Below are some error message in log:
*Oct 25 00:52:14: %CRYPTO-4-PKT_REPLAY_ERR: decrypt: replay check failed connection id=1605, sequence number=471
*Oct 25 01:21:32: %OSPF-5-ADJCHG: Process 1, Nbr 3.3.3.3 on Tunnel1 from FULL to DOWN, Neighbor Down: Dead timer expired
*Oct 25 01:21:56: %OSPF-5-ADJCHG: Process 1, Nbr 3.3.3.3 on Tunnel1 from LOADING to FULL, Loading Done
*Oct 25 02:48:44: %CRYPTO-4-RECVD_PKT_INV_SPI: decaps: rec'd IPSEC packet has invalid spi for destaddr=2.2.2.2, prot=50, spi=0xE16E0A49(3782085193), srcaddr=1.1.1.1, input interface=Cellular0/0/0
*Oct 25 03:34:47: %CRYPTO-4-PKT_REPLAY_ERR: decrypt: replay check failed connection id=1609, sequence number=31063
*Oct 25 03:49:06: %CRYPTO-4-PKT_REPLAY_ERR: decrypt: replay check failed connection id=1611, sequence number=656
*Oct 25 05:02:28: %CRYPTO-4-PKT_REPLAY_ERR: decrypt: replay check failed connection id=1613, sequence number=10551
*Oct 25 06:08:39: %CRYPTO-4-PKT_REPLAY_ERR: decrypt: replay check failed connection id=1615, sequence number=16246
*Oct 25 06:10:01: %CRYPTO-4-PKT_REPLAY_ERR: decrypt: replay check failed connection id=1615, sequence number=16927
*Oct 25 06:26:56: %CRYPTO-4-PKT_REPLAY_ERR: decrypt: replay check failed connection id=1615, sequence number=29395
*Oct 25 06:35:41: %CRYPTO-4-PKT_REPLAY_ERR: decrypt: replay check failed connection id=1615, sequence number=35306
*Oct 25 06:36:52: %CRYPTO-4-PKT_REPLAY_ERR: decrypt: replay check failed connection id=1615, sequence number=35835
*Oct 25 06:48:12: %CRYPTO-4-PKT_REPLAY_ERR: decrypt: replay check failed connection id=1617, sequence number=3473
*Oct 25 08:39:54: %CRYPTO-4-RECVD_PKT_INV_SPI: decaps: rec'd IPSEC packet has invalid spi for destaddr=2.2.2.2, prot=50, spi=0x87ED373D(2280470333), srcaddr=1.1.1.1, input interface=Cellular0/0/0
*Oct 25 09:38:10: %CRYPTO-4-RECVD_PKT_INV_SPI: decaps: rec'd IPSEC packet has invalid spi for destaddr=2.2.2.2, prot=50, spi=0xBC10B1CB(3155210699), srcaddr=1.1.1.1, input interface=Cellular0/0/0
*Oct 25 10:35:53: %CRYPTO-4-RECVD_PKT_INV_SPI: decaps: rec'd IPSEC packet has invalid spi for destaddr=2.2.2.2, prot=50, spi=0x530B08B0(1393232048), srcaddr=1.1.1.1, input interface=Cellular0/0/0
Here's output for show crypto ipsec sa peer 2.2.2.2 det
interface: Cellular0/0/0
Crypto map tag: gre-tunnel-map, local addr 1.1.1.1
protected vrf: (none)
local ident (addr/mask/prot/port): (1.1.1.1/255.255.255.255/47/0)
remote ident (addr/mask/prot/port): (2.2.2.2/255.255.255.255/47/0)
current_peer 2.2.2.2 port 4500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 6276970, #pkts encrypt: 6276970, #pkts digest: 6276970
#pkts decaps: 5874906, #pkts decrypt: 5874906, #pkts verify: 5874906
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#pkts no sa (send) 0, #pkts invalid sa (rcv) 0
#pkts encaps failed (send) 0, #pkts decaps failed (rcv) 0
#pkts invalid prot (recv) 0, #pkts verify failed: 0
#pkts invalid identity (recv) 0, #pkts invalid len (rcv) 0
#pkts replay rollover (send): 0, #pkts replay rollover (rcv) 0
##pkts replay failed (rcv): 2694
#pkts tagged (send): 0, #pkts untagged (rcv): 0
#pkts not tagged (send): 0, #pkts not untagged (rcv): 0
#pkts internal err (send): 0, #pkts internal err (recv) 0
local crypto endpt.: 1.1.1.1, remote crypto endpt.: 2.2.2.2
plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb Cellular0/0/0
current outbound spi: 0x6A2ED478(1781453944)
PFS (Y/N): Y, DH group: group14
inbound esp sas:
spi: 0xE3087C19(3808984089)
transform: esp-3des esp-sha256-hmac ,
in use settings ={Tunnel UDP-Encaps, }
conn id: 3633, flow_id: Onboard VPN:1633, sibling_flags 80000040, crypto map: gre-tunnel-map
sa timing: remaining key lifetime (k/sec): (4193929/1655)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE(ACTIVE)
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0x6A2ED478(1781453944)
transform: esp-3des esp-sha256-hmac ,
in use settings ={Tunnel UDP-Encaps, }
conn id: 3634, flow_id: Onboard VPN:1634, sibling_flags 80000040, crypto map: gre-tunnel-map
sa timing: remaining key lifetime (k/sec): (4223323/1655)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE(ACTIVE)
outbound ah sas:
outbound pcp sas:
Not sure why it is behaving the way it is. We are on cellular link as it is a back to main link on a different device.
Any pointers would be greatly appreciated.
Thanks.
