IPsec VPN

[Mlex1]

Hello

configured vpn and all good, sometimes i see this log what it this? and also googled log and found this config 

crypto isakmp invalid-spi-recovery

%CRYPTO-4-RECVD_PKT_INV_SPI: decaps: rec'd IPSEC packet has invalid spi for destaddr=x.x.x.x, prot=50, spi=0x78629A0F(2019727887), srcaddr=x.x.x.x, input interface=interface gi0/0

[MHM Cisco World]

Match lifetime in both Peer 

Use isakmp keepalive 

That all what you need

MHM

[Mlex1]

isakmp keepalive  also have 

[MHM Cisco World · Accepted solution]

I send you PM check it

MHM

[ccieexpert]

this could happen for various reasons.. it indicates that ipsec sas are out of sync..One side (the other side) has it and this side does not have, so it has deleted it either cause there was some sort of connectivity issue, dpd failure, or some incmopatability where one side deleted it. Also could be a transient issue during a rekey etc.. if this causing traffic issues , then you should get some debugs to understand what is happening:

https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/113594-trouble-ios-ike-00.html

[Mlex1]

am i right this problem will not solve as you mentioned above, because this issue has several problems 

[ccieexpert]

it all depends on the root cause.. Sometimes it is normal to see the message during a rekey.

The main question is this affecting your environment or just a transient issue ?  having some debugs or historical logs may help us identify when and why this is happening. Again as i said earlier, it may be normal for a few of these, but you should only be concerned if it affecting traffic flows..

What is the other side of the VPN ? Cisco or something else ?

**please rate as helpful if this was useful**