ipsec log

[nicky123]

hi,

i have this log below;

%CERM-4-TUNNEL_LIMIT: Maximum tunnel limit of 225 reached for Crypto functionality with securityk9 technology package license

is it related to below;

#show crypto ipsec sa count
IPsec SA total: 402, active: 74, rekeying: 0, unused: 328, invalid: 0

why is there unused?

thanks.

[MHM Cisco World]

are you use any L2TP/IPsec or client VPN?

[nicky123]

ipsec

[MHM Cisco World]

IPSec VPN S2S with per host config 

make any host have it SPI and exhausted your router.

send to me the config of IPSec 

[Rob Ingram]

@nicky123 

Of your 402 SAs, 74 are actively encrypting and passing traffic, the 328 unused have 0 packets being sent over the tunnel and no inbound/outbound SAs.

By the looks of the error message you need the HSEC-K9 license if you need more than 225 active tunnels - although it would also depend on whether your hardware supports more than 225 tunnels.

This link provides more information:

https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/118746-technote-isr-00.html