Error Message Decoder says:
A received IPSec packet specifies an SPI that does not exist in SADB. This may be a temporary condition because of slight differences in the aging of SAs between the IPSec peers or because the local SAs have been cleared. It may also be caused by invalid packets sent by the IPSec peer. This activity could be considered a hostile event.
Recommended Action:
If the local SAs have been cleared, the peer may not know. In this case, if a new connection is established from the local router, the two peers may reestablish successfully. If the problem occurs for more than a brief period, either attempt to establish a new connection or contact the peer administrator.
So, i mu opinion it can be caused by:
clear crypto sa command
Slight difference in security association lifetime on peers:
sh crypto ipsec profile
...
Security association lifetime: 4608000 kilobytes/3600 seconds
...
---
HTH. Please rate this post if it was helpful. If this solves your problem, please mark this post as "Correct Answer."
