- Are these error messages cosmetic or are they making any performance impact. Ideally they should be cosmetic..
-Have you recently made any changes on the device which could have triggered this issue?
The issue is seen when the SA which is responsible for decryption is invalid. A potential reason could be that the SA on the decryption side has aged out slightly before the encryption resulting in the IPSec packet carrying an invalid SPI.
The "IKE" module, which serves as a checkpoint in the IPSec session, recognizes the "Invalid SPI" situation. The IKE module then sends an "Invalid Error" message to the packet-receiving peer so that synchronization of the security association databases (SADBs) of the two peers can be attempted. As soon as the SADBs are resynchronized, packets are no longer dropped. It is usually a temporary condition.
Please make sure that these commands are set.
- crypto isakmp invalid-spi-recovery
- crypto ipsec df-bit clear
- crypto ipsec fragmentation before-encryption
Make sure to set last two commands only during OFF production hours as it will lead to tearing the tunnels down for a moment.
If the issue is still seen then check if you have any crypto modules available on router and if they are throwing any error as well. Ideally configuring the commands alone should fix the issue if error messages are only cosmetic.
.
Regards,
Anuj
