Problems with VPN through 28xx router (CRYPTO-4-RECVD_PKT_INV_SPI)

[obrenes]

Hi everyone,

I have a VPN tunnel between a Cisco VPN client 4.8.01.0300 and a VPN concentrator 4.1.7.P. When I have a 25xx or 26xx router in the middle of the tunnel everything works just fine. This router is not involved or related in any way with the VPN tunnel. He?s just routing packets between the 2 VPN peers.

When a have a 28xx router with an advanced-security IOS image the negotiation of the tunnel succeeded but traffic is unable to cross the tunnel.

In the 28xx router console, I get the following error:

%CRYPTO-4-RECVD_PKT_INV_SPI: decaps: rec'd IPSEC packet has invalid spi ?

It seems that the router is checking every IPsec packet even though it?s not a peer of the VPN tunnel.

I checked the ?Cisco Error Message Decoder? tool and found the following:

?An IPSec packet was received that specified an SPI that does not exist in the SADB?

Once again, this router is not related in any way to the VPN tunnel, that?s why the SPI is not in his SADB.

Is there any way to avoid this checking procedure?? Or any other way to fix this situation??

Thanks in advance.

Omar.

[5220]

Hi Omar,

If 28xx is configured for remote access, try to remove the lines.

If not, enable NAT transparency on the Concentrator and VPN Client, and permit port 4500 UDP and 500 UDP through the 28xx.

Please rate if this helped.

Regards,

Daniel

[obrenes]

Hi Daniel, thanks for the reply. I don?t know why I didn?t get an email notifying me about it.

The 28xx is not configured for remote access.

I?m going to enable the NAT transparency in the communication. I will get back to you as soon as I test it.

[obrenes]

Daniel,

Thank you for your help. The problem was solved using IPSec/TCP.

The Cisco IPSec/UDP did not work and I didn't tried using NAT transparency (design requirements).

Regards,

Omar