CRYPTO-4-RECVD_PKT_NOT_IPSEC - caused by crypto map on inbound interface?

[crhodes]

I'm trying to establish an IPSEC tunnel between two IOS routers.

The local router (say Router A) can establish an IPSEC tunnel and send encrypted packets to the remote router (say router B), but when router B tries to send traffic to router A via the IPSEC tunnel, router A reports the following error:

%CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet.

(ip) dest_addr= 172.16.70.4, src_addr= 172.16.196.254, prot= 1

I'm wondering if the problem is due to router B having the crypto map statement on the interface that receives packets from 172.16.196.254, not on the interface that sends the packets to the next hop towards router A.

We have

host (172.16.196.254)

|

firewall

|

router B:Interface F0/0

ip 172.16.224.1 (the IPsec address for router B)

crypto map mymap

router B:Interface S0/0.1

|

WAN link

|

router C

|

router A:interface F0/0

ip 203.17.35.225 (the Ipsec address for router A)

crypto map mymap

router A:interface F0/1

ip 172.16.70.1

|

host (172.16.70.4)

Any thoughts/suggestions appreciated.

[kmarrero]

The problem could be with your ACL's not matching. The following document shows an example of two routers and one router has an access-list for inside-host to inside-host and the other has an access-list for interface to interface. The document states that the ACL's should be symmetric.

http://www.cisco.com/warp/public/707/manual.shtml

[rajesh444]

I am not sure if I understand your question but as far as I know the crypto map is always applied to the public (dirty) interface on the router. In other words, if router B has a serial interface that connects to the WAN with a public IP, the crypto map should be applied on that interface, the same goes for router A.

Hope this helps.

Regards,

RAJ

[crhodes]

Thanks for the replies.

As suggested by RAJ, the problem appears to be as a result of having the crypto map applied to the ingress interface of Router B.

I found a reference on CCO stating that the crypto map needs to be applied to the egress interface.

Regards