Crypto isakmp invalid-spi-recovery in a Cisco ASR1002-HX running EIGRP and DMVPN.

[CSCO12789549]

I have and ASR 1000 which is the main HUB for our EIGRP / DMVPN solution. I recently started getting crypto errors!!
*Apr 23 17:10:45: %CRYPTO-4-RECVD_PKT_INV_SPI: decaps: rec'd IPSEC packet has invalid spi for destaddr=316.17.98.56, prot=50, spi=0x1872BAB4(410172084), srcaddr=80.76.167.70, input interface=Tunnel1 and

*Apr 23 16:54:40: %CRYPTO-4-RECVD_PKT_INV_SPI: decaps: rec'd IPSEC packet has invalid spi for destaddr=214.13.90.244, prot=50, spi=0x6869FF33(1751777075), srcaddr=80.76.167.70, input interface=Tunnel0

I have 4 additional spokes no to sure if they are getting this error, but with terminal monitor enabled I am getting it on the main hub.

We also have 2 taclanes connected to the hub that branch off into the core. Hence I do not know where the 80.76.167.70 address is coming from.

Does anyone know how to clear this crypto issue from the hub?

[marce1000]

 https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/115801-technote-iosvpn-00.html

 M.

[CSCO12789549]

@marce1000 thank you for this link, it does give me some insight but even with the debugs running and with invalid-spi-recovery turned on I am still stuck as in what to do to clear this error up. The article does not go into full detail on how to resolve the issue. Any more suggestions? Thanks

[balaji.bandi · Accepted solution]

Look at the workaround thread for reference :

clear manually SPI and test it.

https://community.cisco.com/t5/vpn/crypto-isakmp-invalid-spi-recovery-command-is-not-worked-fine-in/td-p/1531178