DMVPN neighbor is down

[teymur azimov]

Hi Dears,

I configurated dmvpn. it works fine but now i see some error occur.

i copy some log from hub router. how i solve this issue?

ct  9 21:30:49.971: %CRYPTO-4-RECVD_PKT_INV_SPI: decaps: rec'd IPSEC packet has invalid spi for destaddr=66.38.235.1, prot=50, spi=0x965D5160(2522698080), srcaddr=192.168.0.1

*Oct  9 21:31:19.675: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 100: Neighbor 172.30.0.20 (Tunnel10) is down: holding time expired

*Oct  9 21:31:47.095: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 100: Neighbor 172.30.0.20 (Tunnel10) is up: new adjacency

*Oct  9 21:31:50.915: %CRYPTO-4-RECVD_PKT_INV_SPI: decaps: rec'd IPSEC packet has invalid spi for destaddr=66.38.235.1, prot=50, spi=0x965D5160(2522698080), srcaddr=192.168.0.1

*Oct  9 21:32:51.367: %CRYPTO-4-RECVD_PKT_INV_SPI: decaps: rec'd IPSEC packet has invalid spi for destaddr=66.38.235.1, prot=50, spi=0x965D5160(2522698080), srcaddr=192.168.0.1

*Oct  9 21:33:52.115: %CRYPTO-4-RECVD_PKT_INV_SPI: decaps: rec'd IPSEC packet has invalid spi for destaddr=66.38.235.1, prot=50, spi=0xBB68DF69(3144212329), srcaddr=60.0.0.1

*Oct  9 21:34:30.995: %CRYPTO-4-IKMP_NO_SA: IKE message from 60.0.0.1 has no SA and is not an initialization offer

[Rudy Sanjoko]

Does this happen often? If not than I think it is not something to  worry about, it tears down and reestablishes the adjacency, it looks  stable to me. It often caused by the timers setting of the eigrp, verify  that the hello interval and the hold-time has been configured properly. I would be more worried about the %CRYPTO-4-RECVD_PKT_INV_SPI message,

[teymur azimov]

Thank you to reply me. it happens sometimes. you said that i must be setting hello interval and hold-time ?

all my router the eigrp is default hello and hold-time. must i be change?? how it can help me to solve this issue?

thanks.

[Rudy Sanjoko]

if you are using the default then nothing needs to be done, unless you want to alter those timers values, please refer to following thread to troubleshoot EIGRP, Amit explains "hold time expired" issue really well.

https://supportforums.cisco.com/thread/142617

[shamax_1983]

Hi teymur,

I don't think your EIGRP has any issues,

Your real issue is IPSec tunnel ( if this happens more often ).  Your spokes are sending invalid SPI to the HUB router. But in this case the Spokes wouldn't know they are sending invalid SPIs and they think everything is OK..

Try enabling DPD ( dead peer detection) crypto isakmp keepalive in global configuration mode on the Spokes.

like so,

!

crypto isakmp keepalive 30 10 periodic

!

This will make sure the Spokes sent keepalive messages every 10 seconds and will time out in 30 seconds if no replies received. So if the Hub wouldn't agree with the SPIs  ( like in your debugs ) , the Spokes keepalives will timeout , they will clear their SADB and will renegotiate the tunnel with  new SPIs.

** But if you don't see the error messages too often, I'd say it's pretty normal to have such error messages once in a while. But if you see this daily, try this solution.

Pleas don't forget to rate halpful posts.

Shamal