IPSEC packet has invalid spi

I have a very simple LAN-2-LAN between two cisco routers running IOS version 12.4(15)T8 as follows:
RouterA:
crypto isakmp key test123 address 4.2.97.15 no-xauth
crypto isakmp policy 1
encr aes 256
hash sha
authentication pre-share
group 5
lifetime 86400
no crypto ipsec nat-transparency udp-encapsulation
crypto ipsec transform-set tset esp-aes 256 esp-sha-hmac
crypto map vpn 10 ipsec-isakmp
set peer 4.2.97.15
set security-association lifetime seconds 3600
set transform-set tset
set pfs group5
match address vpn
interface FastEthernet0/0
ip address 207.15.205.15 255.255.255.0
speed 100
full-duplex
crypto map vpn
ip access-list extended vpn
permit ip 129.174.15.0 0.0.0.255 129.174.16.0 0.0.0.255
RouterB:
crypto isakmp key test123 address 207.15.205.15 no-xauth
crypto isakmp policy 1
encr aes 256
hash sha
authentication pre-share
group 5
lifetime 86400
no crypto ipsec nat-transparency udp-encapsulation
crypto ipsec transform-set tset esp-aes 256 esp-sha-hmac
crypto map vpn 10 ipsec-isakmp
set peer 207.15.205.15
set security-association lifetime seconds 3600
set transform-set tset
set pfs group5
match address vpn
interface FastEthernet0/0
ip address 4.2.97.15 255.255.255.0
speed 100
full-duplex
crypto map vpn
ip access-list extended vpn
permit ip 129.174.16.0 0.0.0.255 129.174.15.0 0.0.0.255
Every now and then I am seeing this message in the log file:
Jul 27 00:25:20.603: %CRYPTO-4-RECVD_PKT_INV_SPI: decaps: rec'd
IPSEC packet has invalid spi for destaddr=207.15.205.15, prot=50,
spi=0x681E0955(1746798933), srcaddr=4.2.97.15.
Why am I seeing this message? The VPN peer between two router is very stable without any errors.
I've asked several ccie consultant folks and none of them is able to provide me with a satifactory answer regarding this message.
Anyone know why? Thanks in advance.

I know its been a while since this was asked but to help anyone who may still want to know here is the reason from Cisco:
It simply means IPsec Security Associations are out of sync       between the peer devices. As a result, an encrypting device will encrypt       traffic with SAs that its peer does not know about. These packets are dropped       on the peer with the above message logged to the syslog
Read more here: http://www.cisco.com/en/US/tech/tk583/tk372/technologies_tech_note09186a0080bf6100.shtml
One of the most common IPsec issues is that SAs can become out of sync       between the peer devices. As a result, an encrypting device will encrypt       traffic with SAs that its peer does not know about. These packets are dropped       on the peer with this message logged to the syslog: Sep 2 13:27:57.707: %CRYPTO-4-RECVD_PKT_INV_SPI: decaps: rec'd IPSEC packet
   has invalid spi for destaddr=20.1.1.2, prot=50, spi=0xB761863E(3076621886),
   srcaddr=10.1.1.1

Similar Messages

DMVPN Issues - IPsec packets

Hi All,
I am currently trying to configure DMVPN for the first time. I have been following the cisco config guide and googling a few other bits however I seem to have hit a brick wall.
The setup is in a lab environment so i can post up as much info as required but here are the important bits:
I have 3 Cisco 2821 routers running IOS 12.4(15) with a Layer 3 switch in the middle connecting the "wan" ports together. the routing is working fine, I can ping each router from each other router.
A few snippets from the hub router config:
crypto ipsec transform-set DMVPN_SET esp-3des esp-md5-hmac!crypto ipsec profile DMVPN_PRJ set transform-set DMVPN_SET!interface Tunnel0 bandwidth 10000 ip address 172.17.100.1 255.255.255.0 no ip redirects ip mtu 1500 ip nhrp authentication secretid ip nhrp map multicast dynamic ip nhrp network-id 101 ip nhrp holdtime 450 ip tcp adjust-mss 1460 tunnel source GigabitEthernet0/0 tunnel mode gre multipoint tunnel key 10101 tunnel protection ipsec profile DMVPN_PRJ!interface GigabitEthernet0/0 description HQ WAN ip address 1.1.1.1 255.255.255.248 ip nat outside ip virtual-reassembly duplex auto speed auto!
and heres the config on the first spoke router:
crypto ipsec transform-set DMVPN_SET esp-3des esp-md5-hmac!crypto ipsec profile DMVPN_PRJ set transform-set DMVPN_SET!interface Tunnel0 bandwidth 3000 ip address 172.17.100.10 255.255.255.0 no ip redirects ip mtu 1500 ip nhrp authentication secretid ip nhrp map 172.17.100.1 1.1.1.1 ip nhrp map multicast 1.1.1.1 ip nhrp network-id 101 ip nhrp holdtime 450 ip nhrp nhs 172.17.100.1 ip tcp adjust-mss 1460 tunnel source GigabitEthernet0/0 tunnel mode gre multipoint tunnel key 10101 tunnel protection ipsec profile DMVPN_PRJ!interface GigabitEthernet0/0 description Site 1 WAN ip address 11.11.11.1 255.255.255.248 ip nat outside ip virtual-reassembly duplex auto speed auto!
if I shut/no shut the tunnel0 interface on spoke 1, I get the following error on the hub router:
Mar 30 13:41:17.075: %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet.        (ip) vrf/dest_addr= /1.1.1.1, src_addr= 11.11.11.1, prot= 47
so I feel im missing some config on the spoke side to encrypt the traffic but im not sure what.
the following are outputs from the spoke router:
RTR_SITE1#sh dmvpn detailLegend: Attrb --> S - Static, D - Dynamic, I - Incompletea        N - NATed, L - Local, X - No Socket        # Ent --> Number of NHRP entries with same NBMA peer -------------- Interface Tunnel0 info: --------------Intf. is up, Line Protocol is up, Addr. is 172.17.100.10   Source addr: 11.11.11.1, Dest addr: MGRE Protocol/Transport: "multi-GRE/IP", Protect "DMVPN_PRJ",Tunnel VRF "", ip vrf forwarding ""NHRP Details: NHS:       172.17.100.1 EType:Spoke, NBMA Peers:1# Ent Peer NBMA Addr Peer Tunnel Add State UpDn Tm Attrb    Target Network----- --------------- --------------- ----- -------- ----- -----------------    1         1.1.1.1    172.17.100.1   IKE    never S       172.17.100.1/32 Interface: Tunnel0Session: [0x48E31B98] Crypto Session Status: DOWN fvrf: (none),   IPSEC FLOW: permit 47 host 11.11.11.1 host 1.1.1.1        Active SAs: 0, origin: crypto map   Outbound SPI : 0x       0, transform :    Socket State: ClosedPending DMVPN Sessions:
RTR_SITE1#sh ip nhrp detail172.17.100.1/32 via 172.17.100.1, Tunnel0 created 00:33:44, never expire Type: static, Flags: used NBMA address: 1.1.1.1
RTR_SITE1#sh crypto ipsec sainterface: Tunnel0    Crypto map tag: Tunnel0-head-0, local addr 11.11.11.1   protected vrf: (none)   local ident (addr/mask/prot/port): (11.11.11.1/255.255.255.255/47/0)   remote ident (addr/mask/prot/port): (1.1.1.1/255.255.255.255/47/0)   current_peer 1.1.1.1 port 500     PERMIT, flags={origin_is_acl,}    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0    #pkts compressed: 0, #pkts decompressed: 0    #pkts not compressed: 0, #pkts compr. failed: 0    #pkts not decompressed: 0, #pkts decompress failed: 0    #send errors 46, #recv errors 0     local crypto endpt.: 11.11.11.1, remote crypto endpt.: 1.1.1.1     path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0     current outbound spi: 0x0(0)     inbound esp sas:     inbound ah sas:     inbound pcp sas:     outbound esp sas:     outbound ah sas:     outbound pcp sas:
All of these commands show up as blank when i run them on the hub router.
Any help appreciated.
Thanks

Thanks for the help
I was following this guide: http://www.cisco.com/en/US/docs/ios/sec_secure_connectivity/configuration/guide/sec_DMVPN.html#wp1118625
I am using NAT, g0/1 on the routers in the LAN interface with a difference 10.x.x.x/24 on each router.
isakmp policy solved my issue, fixed the MTU as well.
What do i need to add to allow the 10.x.x.x networks to use the tunnels to communicate? I can now ping each end of the tunnel from both routers but not the LAN interfaces.
Thanks

Sun-cmp-mappings.xml exists but has invalid contents: getSchema() == null

Can anyone help please!
what this error means by invalid contents: getSchema() == null
when I try to deploy or veryfy, this is what I get:
deployment started : 0%
Deploying application in domain failed; Error while running ejbc -- Fatal Error from EJB Compiler -- JDO74041: While deploying 'EJBModuleOnlineRegistration' from 'EJBModuleOnlineRegistration': sun-cmp-mappings.xml exists but has invalid contents: getSchema() == null
; requested operation cannot be completed
D:\Projects\EJBModuleOnlineRegistration\nbproject\build-impl.xml:317: Deployment failed.
BUILD FAILED (total time: 29 seconds)

The most probable there are some errors in your sun-cmp-mappings.xml file.
A few similar Q&As:
http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=5045366
http://www.netbeans.org/issues/show_bug.cgi?id=59394

LOCKBOX PROCESS 시 42440 RECEIPT HAS INVALID APPLICATIONS ERROR 가 발생했을 경우

제품 : FIN_AR
작성날짜 : 2005-10-24
LOCKBOX PROCESS 시 42440 RECEIPT HAS INVALID APPLICATIONS ERROR 가 발생했을 경우
========================================================================
PURPOSE
Lockbox process 시 42440 Error 에 대처한다.
Problem Description
LockBox Interface table 에 데이타를 load 후 lockbox process 실행 시 report output 에 error: 42440 Receipt has invalid applications error 가 발생 한것을 발견하였다.
Workaround
Maintenance Transmission Screen 을 Open하여 해당 lockbox process 를 조회 하고 Application Button을 눌러 Invoice Filed 를 Clear 한 후 다시 해당 Process 를 수행한다.
Solution Description
아래 내용을 참조 하여 patch를 apply 한다.
11.0 arlval.lpc 110.12 or higher
11.5 arlval.lpc 115.7 or higher
11.0 1999278 patchset 11.0.AR.I
11i 1999278 patchset 11i.AR.H
2004333 Standalone
문제의 원인은 lockbox validation program 수행 시 error 가 발생하였는데 그 error 의 원인 데이타를 고치고 다시 lockbox validation program 을 수행 하였을 경우 이전의 invoice 데이타를 clear 하지 않아 발생 하는 것으로 판단 된다.
Reference Documents
Note. 219854.1 - Oracle Receivables Lockbox Troubleshooting Guide

Hi,
Can youplease let me know what is the exact error message you are encountering. May be the output/log file message will throw some additional information on this. please paste this here.
Thanks and Regards,
Raj..

ERROR - The element 'MailboxSearchScope' in namespace has invalid child element 'ExtendedAttributes'

hi everyone,
i'm using exchange server 2013 and write following code for getting searchable mailboxes and getting emails from these searchable mailboxes but i'm getting following error on "SearchMailboxes" function.
Code:
ExchangeService service = new ExchangeService(ExchangeVersion.Exchange2013);
service.Credentials = new WebCredentials("[email protected]", "test123");
service.AutodiscoverUrl("[email protected]", RedirectionUrlValidationCallback);
GetSearchableMailboxesResponse gsMBResponse = service.GetSearchableMailboxes("example*", false);
MailboxSearchScope[] msbScope1 = new MailboxSearchScope[gsMBResponse.SearchableMailboxes.Length];
Int32 mbCount1 = 0;
foreach (SearchableMailbox sbMailbox in gsMBResponse.SearchableMailboxes)
msbScope1[mbCount1] = new MailboxSearchScope(sbMailbox.ReferenceId, MailboxSearchLocation.PrimaryOnly);
mbCount1++;
SearchMailboxesParameters smSearchMailbox1 = new SearchMailboxesParameters();
MailboxQuery mbq1 = new MailboxQuery("attachment:'.xls'", msbScope1);
MailboxQuery[] mbqa1 = new MailboxQuery[1] { mbq1 };
smSearchMailbox1.SearchQueries = mbqa1;
smSearchMailbox1.PageSize = 1000;
smSearchMailbox1.ResultType = Microsoft.Exchange.WebServices.Data.SearchResultType.PreviewOnly;
service.TraceEnabled = true;
ServiceResponseCollection<SearchMailboxesResponse> srCol1 = service.SearchMailboxes(smSearchMailbox1);
ERROR:
The request failed schema validation: The element 'MailboxSearchScope' in namespace 'http://schemas.microsoft.com/exchange/services/2006/types' has invalid child element 'ExtendedAttributes' in namespace 'http://schemas.microsoft.com/exchange/services/2006/types'."}
anyone have idea to solve this?
Thanks

Check to make sure you have the latest version of the managed API.
https://github.com/OfficeDev/ews-managed-api/

%CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet.

Hi Everyone.
I was making some changes in routers and after I rolled back configuration a gre tunnel won't work. It's GRE Tunnel between a Cisco 7600 and Cisco 2851.
It seems like 7600 sent packets unencrypted.
On C2851 is received this message:
%CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet.
(ip) vrf/dest_addr= /10.0.0.10, src_addr= 10.0.0.18, prot= 47
Could you check configuration attached and give any advise.
Thank you.

I went through the configuration and think all required components are in there.
I would say that we should check routing.
Error message means that packet recieved as per local policy should have been a IPSEC encrypted packet however it was a plain text packet.
going further:
* Please check if tunnel is up and share show crypto ipsec sa from either end.
* please check if the packets leaving other end are taking right exit interface and if yes are they encrypted or not. you can check this with the help of ACL (disabling CEF if this is not into production and there is no MPLS link involved).

%CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet. (ip) vrf/dest_addr= /x.x.x.x, src_addr= x.x.x.x, prot= 47

Hi ,
I am want to crerate a GREover IPsec Tunnel between Cisco ASR 1002 and cisco 3900 i am getting the below error.
%CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet. (ip) vrf/dest_addr= /x.x.x.x, src_addr= x.x.x.x, prot= 47
I have attached the configuration file as well currently working on tunnel 117.
Site A already have some tunnels up and running but only tunnel 117 is not working which i created now on ASR 1002.
CAN ANYONE LET ME KNOW WHAT I AM FACING AN ISSUE.

The first issue that I note is that you have applied the crypto map on the tunnel interface as well as on the physical interface. While there are perhaps still some examples that show this they are based on the operation of quite old IOS versions. The code that you are now running expects the crypto map to be applied only on the physical interface. I suggest that you remove the crypto map from the tunnel interfaces. Try that and let us know if the behavior changes.
HTH
Rick

MasterThemeSchema.xml file has invalid data error when customizing layout

Whenever I try to customize my layout for Responsive HTML5 I get an error "MasterThemeSchema.xml file has invalid data". I've tried creating new layouts and editing existing layouts. The first time I click Customize Selected Layout it works. But any attempt after that produces the error. Anyone know what's going on? Thanks.

Has not working over the network fixed the problem? If it has, check both ways again to establish beyond doubt that it is a problem with working on the network. If it does prove to be that, please file a bug but also post back here.
Please follow this link to report a bug.
http://www.Adobe.com/cfusion/mmform/index.cfm?name=wishform&product=38
See www.grainge.org for RoboHelp and Authoring tips
@petergrainge

Parameter TSTMP1 has invalid value 0

I am getting the following error(dump in the back end)..when I try executing the following ABAP Webdynpro program
http://HOST:8000/sap/bc/webdynpro/sap/asr_processes_display
Runtime Errors UNCAUGHT_EXCEPTION
Exception CX_PARAMETER_INVALID_RANGE
The following error text was processed in the system ED1 : Parameter has invalid value: Parameter TSTMP1 has invalid value 0 .
The error occurred on the application server host_ED1_00 and in the work process 0 .
The termination type was: RABAX_STATE
The ABAP call stack was:
Method: SUBTRACT of program CL_ABAP_TSTMP=================CP
Method: SUBTRACT_TIMESTAMPS of program CL_HRASR00_PROCESS_UTILITIES==CP
Method: GET_CURRENT_TIME_DATA of program CL_HRASR00_PROCESS_UTILITIES==CP
Method: START_TRACKING of program /1BCWDY/2VM0SKJ71MBDIR0QYUEP==CP
Method: IF_COMPONENTCONTROLLER~START_TRACKING of program /1BCWDY/2VM0SKJ71MBDIR0QYUEP==CP
Method: HANDLEDEFAULT of program /1BCWDY/2VM0SKJ71MBDIR0QYUEP==CP
Method: HANDLEDEFAULT of program /1BCWDY/2VM0SKJ71MBDIR0QYUEP==CP
Method: IF_WDR_VIEW_DELEGATE~WD_INVOKE_EVENT_HANDLER of program /1BCWDY/2VM0SKJ71MBDIR0QYUEP==CP
Method: INVOKE_EVENTHANDLER of program CL_WDR_DELEGATING_IF_VIEW=====CP
Method: DISPLAY_TOPLEVEL_COMPONENT of program CL_WDR_CLIENT_COMPONENT=======CP
Any ideas on solving this?

Hi
Any one has any incite into this issue. Pls share it.
I am also facing the same issue. In our case, we have been developing processes and some of the processes are working fine until Friday 10/24. Now we are facing this error. I checked all config changes after Firday. Nothing significant related to processes. No patches applied over the weekend.
Any help is appreciated!
Thank you

Errors in Transaction SHMA - Binding has invalid value

I'm trying to create a shared memory area in transaction SHMA
I entered the area name and the root class name and just kept all the default values. When I do a syntax check I get 2 major errors 1. Binding has invalid value, and 2. Synchronization has invalid value.
I don't see any settings for these attributes - has anybody seen this before?
Thanks,
Brent

> I was just thinking, do I have to generate an instance of the class before I do the syntax check? Is the syntax performed on the instance or the definition of the shared memory area?
I don't understand what you mean. The syntax check is only about abap code, so?
In fact, what class are you talking about? Is it the root class, or the generated class corresponding to the handling of the shared memory area (the one with the same name as the area)?
Here are tips to understand the relationships between the area and related ABAP classes:
Create area Z_MY_AREA via transaction SHMA, choose a ZCL_MY_DATA root class name (must either exist or it can be created manually within SHMA; it must have attribute "SHARED-MEMORY ENABLED")
You must define in this ZCL_MY_DATA class at least one instance attribute
When you save the area, SAP creates automatically a class with the same name as the area (Z_MY_AREA), which inherits CL_SHM_AREA (which itself inherits CL_ABAP_MEMORY_AREA), and with an attribute named "ROOT" type ref to ZCL_MY_DATA

JBO-27010: Attribute set ... has invalid precision/scale

We have created a table ACCOUNT with a column RATE defined as NUMBER(5, 3).
Bc4j has created the corresponding entity object Account with:
<Attribute
Name="Rate"
Type="oracle.jbo.domain.Number"
ColumnName="RATE"
ColumnType="NUMBER"
SQLType="NUMERIC"
IsNotNull="true"
Precision="5"
Scale="3"
TableName="ACCOUNT" >
Also the corresponding view object AccountView has been created.
Here is the java code (JDeveloper Ver.3.2.3) where we catch an exception:
ViewObject vo = applicationModule.findViewObject("AccountView");
Row r = vo.createRow();
String rateStr = "12,725"; // comma used locally as decimal separator
oracle.jbo.domain.Number rateN = new oracle.jbo.domain.Number(rateStr);
r.setAttribute("Rate", rateN);
The exception is:
oracle.jbo.AttrSetValException: JBO-27010: Attribute set with value 12,725 for Rate in Account has invalid precision/scale
Any help would be greatly appreciated.
Thanks in advance.
null

I like to tell you that now everything is ok.
Looking at the libraries included in my project, I found an unecessary library "JBO Generic Domains" (X:\Program Files\Oracle\JDeveloper 3.2.3\lib\jbodomgnrc.zip) containing a class oracle.jbo.domain.Number different from the right one in "JBO Oracle Domains" (X:\Program Files\Oracle\JDeveloper 3.2.3\lib\jbodomorcl.zip).

When trying to install update 10.5 it says the download has invalid signature and won't install. I run XP

when trying to install update 10.5 it says the download has invalid signature and won't install. I run XP

I'm having similar problems with 10.5. I managed to install it but when I try to run itunes it doesn't open correctly and when I view my account the screen is not presented in the correct format. When I try to search for music it finds nothing. So I ran the diagnostics option but this came back with an error ' secure link to itunes failed'. It also said that the internet connection was verified but when I went into the help option it said I wasn't connected to the internet but as you can see I was and am. I've now uninstalled and reinstalled 3 times, each time I uninstall I've followed the correct sequence as recommended:-
1. Itunes
2. Quicktime
3. Apple software update
4. Apple mobile device support
5. Bonjour
6. Apple application support
I've noticed now that 'quicktime' didn't get reinstalled, not sure if that's the problem. Also when I rebooted after the last Uninstall I received a new error message ' Applesyncnotifier.exe - unable to locate component'. I've also noticed that my CPU is running at 50% according to task manager when I've got apple loaded, but it goes down to less than 20% when it's uninstalled and even goes down to 0%. Clearly, there are a number of people with similar issues and Apple need to sort it quickly.

For Windows XP. trying to download 10.5.2, but download fails continuously with message saying "certificate has invalid signature"

I have been trying to download itunes_10.5.2 to a Window XP environment, but on each occasion after each section of the download I get a fail message saying something like "certificate has invalid signature".

Thanks for the reply kglad - much appreciated.
I have already tried that option (along with downloading files) as it was one of the solutions mentioned on other threads, but that also failed.
Any other ideas?

FMLE will not install because of 1324 error, path has invalid character???

FMLE will not install because of 1324 error, path has invalid character???
Seems to be a somewhat common problem (by google search) for Adobe and Microsoft programs, but nothing on FMLE...
Everything I have tried (from google'd suggestions) has not worked.
I suspect that the installer is trying to install to an invalid path but I cannot find it in the registry or figure out why the error. The program was previously installed and working, but after having some issues I tried to re-install and find myself here!
Any help is greatly appreciated.
HP Pavilllion dv6700 Laptop
Intel Core2Duo T5450
Vista 32-bit

Solved!
It would appear previous version could not be uninstalled because of invalid path {somehow over time windows had re-assigned drive letters such that previous location of install on external hard drive F: (as in registry), was now pointing to DVD drive F: and I assume generated the 1324 error, path has invalid character}.
Used Revo Uninstaller to clear all traces of former install and "voila", fresh install of FMLE proceeded successfully.
Hope this helps others with this error code.

RPE-02249 Shell.security_constraint has invalid value NATIVE_JAVA

Hi all,
I m trying to run shell script in OWB process flows and using user defined actvity for this purpose. I've set paramter "Shell.security_constraint " value to NATIVE_JAVA as required in "Runtime.properties" file to run shell script. but getting the error
RPE-02249: Control Center property Shell.security_constraint has invalid value SCHEDULER .
Can anyone help pls.
Thanks :)

Make sure that the NATIVE_JAVA is the last value in the file for this property and also restart the runtime.
Cheers
David

IPSEC packet has invalid spi

Similar Messages

Maybe you are looking for