Jaas & Integrity check on decrypted field failed

I'm trying to do Kerberos authentication using JAAS and the jdk 1.4.1_02 under Mandrake 9.1. The Kerberos server is installed on a Redhat 9 machine. I'm using the login module com.sun.security.auth.module.Krb5LoginModule and the TextCallbackHandler class. The login fails with the error "Exception: krb_error 31 Integrity check on decrypted field failed (31) Integrity check on decrypted field failed". I get the same error if I use the kinit utility bundled with the jdk. Conversely all seems ok when I use the kinit utility bundled with the kerberos client programs of my Mandrake 9.1 distribution.
Anyone could help me?
Michele

I encountered the same problem--"Integrity check on decrypted field failed (31)" when trying to authenticate against a KDC (v5) running RedHat 8.0 (JASS and JDK 1.4.1_02)--but I was able to use Kerberized telnet and login from remote/local machines to get authenticated with this RedHat KDC. There is no problem authenticating against a KDC running Win2k AD/Kerberos with the same code. I am using the com.sun.security.auth.module.Krb5LoginModule.
Can anyone help me to resolve this issure?

Similar Messages

  • Error from sample JAAS: Integrity check on decrypted field failed (31)

    I am trying to follow the tutorial for JAAS Authentication located here:
    http://java.sun.com/j2se/1.4.2/docs/guide/security/jgss/tutorials/AcnOnly.html
    I am trying to run the sample JaasAcn.java but am getting a strange error when I try to log on to my Active Directory.
    I am using Java version: jre1.6.0_03
    I can login to Active Directory fine with the credentials I am providing, just not with this client, so I know the credentials are valid.
    What could this mean?
    The Error message is: [Krb5LoginModule] authentication failed
    Integrity check on decrypted field failed (31)
    Here is the full output:
    C:\Progra~1\Java\jre1.6.0_03\bin\java -Dsun.security.krb5.debug=true -Djava.security.krb5.realm=PRSDev.local -Djava.security.krb5.kdc=192.168.40.72 -Djava.security.auth.login.config=jaas.conf JaasAcn
    Debug is true storeKey false useTicketCache false useKeyTab false doNotPrompt f
    alse ticketCache is null isInitiator true KeyTab is null refreshKrb5Config is fa
    lse principal is null tryFirstPass is false useFirstPass is false storePass is f
    alse clearPass is false
    Kerberos username [ILea]: sra
    Kerberos password for sra:
    [Krb5LoginModule] user entered username: sra
    Using builtin default etypes for default_tkt_enctypes
    default etypes for default_tkt_enctypes: 3 1 23 16 17.
    Acquire TGT using AS Exchange
    Using builtin default etypes for default_tkt_enctypes
    default etypes for default_tkt_enctypes: 3 1 23 16 17.
    KrbAsReq calling createMessage
    KrbAsReq in createMessage
    KrbKdcReq send: kdc=192.168.40.72 UDP:88, timeout=30000, number of retries =3, #bytes=144
    KDCCommunication: kdc=192.168.40.72 UDP:88, timeout=30000,Attempt =1, #bytes=144
    KrbKdcReq send: #bytes read=587
    KrbKdcReq send: #bytes read=587
    EType: sun.security.krb5.internal.crypto.DesCbcMd5EType[Krb5LoginModule] authentication failed
    Integrity check on decrypted field failed (31)
    Authentication failed:
    Integrity check on decrypted field failed (31)

    FYI The fix for this was to chang the value for -Djava.security.krb5.realm to be all upper case
    Once that change was made authentication passed
    Edited by: IDL on Jan 2, 2008 9:25 AM

  • Kerberos Authentication: "Integrity check on decrypted field failed"

    Hi,
    I have configured a portal (NW 7.0 SP13) for Kerberos Authentication. I have another portal with exactly the same configuration (same MS-ADS etc, just a different user) which is working fine. But this one is giving me the error "Integrity check on decrypted field failed" (and Kerberos Auth fails).
    Any ideas?? I get the same error whether I use the keytab from the SPNEGO wizard, or the keytab from "ktpass -princ host/%HOST%@%DOMAIN% -pass %PASSWORD% -out keytab -mapUser %USER% +DesOnly /crypto DES-CBC-MD5 /ptype KRB5_NT_PRINCIPAL"
    The only difference I can see between the ldifde outputs of the two users (the one that works and the one that doesn't) is the one that doesn't has an extra SPN "HTTP/" - would that cause this error??
    Has anyone else had this error & what causes it?
    Many thanks in advance.
    Regards
    Jane
    Full error text:
    JGSS_DBG_CTX Creating context, initiator = no, input cred = not null
    JGSS_DBG_CRED getCred: only one cred, returning it
    JGSS_DBG_CRED getName found name: host/[email protected], mech=1.2.840.113554.1.2.2
    JGSS_DBG_CRED Krb5 name type = 0
    JGSS_DBG_CTX Creating context, cred usage = 2
    GSS Context created
    JGSS_DBG_UNMARSH Real token len 1641
    JGSS_DBG_UNMARSH Token oid 1.2.840.113554.1.2.2
    JGSS_DBG_UNMARSH inner token len 1630
    JGSS_DBG_PROV getFactory: index = 0 found factory
    JGSS_DBG_PROV getMechs: Mechanism(s) supported by provider IBMJGSSProvider
    JGSS_DBG_PROV 1.2.840.113554.1.2.2
    JGSS_DBG_PROV getMechs: 1 unique mechanism(s) found
    JGSS_DBG_PROV [0]: 1.2.840.113554.1.2.2
    JGSS_DBG_CTX Default list of negotiable mechs:
    1.2.840.113554.1.2.2
    JGSS_DBG_CTX ticket enc type = des-cbc-md5
    com.ibm.security.krb5.internal.KrbException, status code: 31
    message: Integrity check on decrypted field failed
    at com.ibm.security.krb5.internal.crypto.n.decrypt(n.java:31)
    at com.ibm.security.krb5.internal.crypto.n.decrypt(n.java:15)
    at com.ibm.security.krb5.internal.crypto.n.decrypt(n.java:32)
    at com.ibm.security.krb5.EncryptedData.decrypt(EncryptedData.java:106)
    at com.ibm.security.jgss.mech.krb5.k.a(k.java:248)
    at com.ibm.security.jgss.mech.krb5.k.b(k.java:188)
    at com.ibm.security.jgss.mech.krb5.k.acceptSecContext(k.java:533)
    at com.ibm.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:155)
    at com.ibm.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:153)
    at com.sap.security.core.server.jaas.SPNegoLoginModule.doHandshake(SPNegoLoginModule.java:738)
    at com.sap.security.core.server.jaas.SPNegoLoginModule.login(SPNegoLoginModule.java:362)
    at com.sap.engine.services.security.login.LoginModuleLoggingWrapperImpl.login(LoginModuleLoggingWrapperImpl.java:185)
    at com.sap.engine.services.security.login.ModulesProcessAction.run(ModulesProcessAction.java:70)
    at java.security.AccessController.doPrivileged(AccessController.java:242)
    at com.sap.engine.services.security.login.FastLoginContext.login(FastLoginContext.java:181)
    at com.sap.engine.system.SystemLoginModule.login(SystemLoginModule.java:90)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:85)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:58)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:60)
    at java.lang.reflect.Method.invoke(Method.java:391)
    at javax.security.auth.login.LoginContext.invoke(LoginContext.java:699)
    at javax.security.auth.login.LoginContext.access$000(LoginContext.java:151)
    at javax.security.auth.login.LoginContext$4.run(LoginContext.java:634)
    at java.security.AccessController.doPrivileged(AccessController.java:242)
    at javax.security.auth.login.LoginContext.invokeModule(LoginContext.java:631)
    at javax.security.auth.login.LoginContext.login(LoginContext.java:557)
    at com.sap.security.core.logon.imp.SAPJ2EEAuthenticator.getLoggedInUser(SAPJ2EEAuthenticator.java:146)
    at com.sapportals.portal.prt.service.authenticationservice.AuthenticationService.getLoggedInUser(AuthenticationService.java:303)
    at com.sapportals.portal.prt.connection.UMHandler.handleUM(UMHandler.java:96)
    at com.sapportals.portal.prt.connection.ServletConnection.handleRequest(ServletConnection.java:186)
    at com.sapportals.portal.prt.dispatcher.Dispatcher$doService.run(Dispatcher.java:524)
    at java.security.AccessController.doPrivileged(AccessController.java:242)
    at com.sapportals.portal.prt.dispatcher.Dispatcher.service(Dispatcher.java:407)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
    at com.sap.engine.services.servlets_jsp.server.servlet.InvokerServlet.service(InvokerServlet.java:156)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
    at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.doWork(RequestDispatcherImpl.java:321)
    at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.forward(RequestDispatcherImpl.java:377)
    at com.sap.portal.navigation.Gateway.service(Gateway.java:126)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
    at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java:401)
    at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java:266)
    at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:387)
    at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:365)
    at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java:944)
    at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java:266)
    at com.sap.engine.services.httpserver.server.Client.handle(Client.java:95)
    at com.sap.engine.services.httpserver.server.Processor.request(Processor.java:175)
    at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java:33)
    at com.sap.engine.core.cluster.impl6.session.MessageRunner.run(MessageRunner.java:41)
    at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37)
    at java.security.AccessController.doPrivileged(AccessController.java:215)
    at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:100)
    com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:170)
    JGSS_DBG_CTX Error authenticating request. Reporting to client
    Major code = 11, Minor code = 31
    org.ietf.jgss.GSSException, major code: 11, minor code: 31
    major string: General failure, unspecified at GSSAPI level
    minor string: Kerberos error while decoding and verifying token: com.ibm.security.krb5.internal.KrbException, status code: 31
    message: Integrity check on decrypted field failed

    Hi Désirée,
    Yes the service user has "Use DES encryption" set.
    In the end, it was resolved by changing the password and running the SPNEGO wizard again to generate a new keytab with the new password.
    Regards
    Jane

  • SSO using Kerberso receiving "Integrity check on decrypted field failed (31

    I am trying to implement SSO for an application that is running on a WebLogic Server. I have flagged the AD Service user for DES encryption, added spn through setspn, created the keytab file, reset the password (to the same value), moved the keytab file, updated krb5.ini and krb5Login.conf accordingly, modified WebLogic startup command accordingly. When Users try to access the application, authentication fails, and I see “Integrity check on decrypted field failed (31)” error in the WebLogic logs. Any ideas ? I am attaching the related lines from the log below.
    <Sep 29, 2008 9:46:50 AM MDT> <Debug> <SecurityDebug> <000000> <Found Negotiate with SPNEGO token>
    Debug is true storeKey true useTicketCache false useKeyTab true doNotPrompt false ticketCache is null KeyTab is devmax01.http.keytab2 refreshKrb5Config is false principal is HTTP/[email protected] tryFirstPass is false useFirstPass is false storePass is false clearPass is false
    KeyTab: load() entry length: 60
    KeyTabInputStream, readName(): DEV.DENVERWATER.ORG
    KeyTabInputStream, readName(): HTTP
    KeyTabInputStream, readName(): devmax01principal's key obtained from the keytab
    principal is HTTP/[email protected]
    EType: sun.security.krb5.internal.crypto.DesCbcMd5EType
    KrbAsReq calling createMessage
    KrbAsReq in createMessage
    KrbAsReq etypes are: 3 1
    KrbKdcReq send: kdc=dwdev01 UDP:88, timeout=30000, number of retries =3, #bytes=249
    KDCCommunication: kdc=dwdev01 UDP:88, timeout=30000,Attempt =1, #bytes=249
    KrbKdcReq send: #bytes read=1312
    KrbKdcReq send: #bytes read=1312
    EType: sun.security.krb5.internal.crypto.DesCbcMd5EType
    KrbAsRep cons in KrbAsReq.getReply HTTP/devmax01Added server's keyKerberos Principal HTTP/[email protected] Version 8key EncryptionKey: keyType=3 keyBytes (hex dump)=
    0000: 2F 02 76 AB 7F 8C B0 6E
    [Krb5LoginModule] added Krb5Principal HTTP/[email protected] to Subject
    Commit Succeeded
    Found key for HTTP/[email protected]
    Entered Krb5Context.acceptSecContext with state=STATE_NEW
    EType: sun.security.krb5.internal.crypto.DesCbcMd5EType<Sep 29, 2008 9:46:50 AM MDT> <Debug> <SecurityDebug> <000000> <GSS exception GSSException: Failure unspecified at GSS-API level (Mechanism level: Integrity check on decrypted field failed (31))
    GSSException: Failure unspecified at GSS-API level (Mechanism level: Integrity check on decrypted field failed (31))

    FYI The fix for this was to chang the value for -Djava.security.krb5.realm to be all upper case
    Once that change was made authentication passed
    Edited by: IDL on Jan 2, 2008 9:25 AM

  • Z61t - Integrity check for code area failed system halted

    Saw the post for the T series which recommended to downgrade bios to 2.23.
    Having this issue with the Z61ts since January 4, 2010.
    -Docked and undocked
    -With and without the network cable plugged in
    -With and without peripherals plugged in
    -Bios 2.26 and 2.27,
    -SafeGuard Easy 4.3 and 4.5.2. 
    In some cases restoring the SafeguardEasy Kernel fixes the issue.  In some cases the error reappears and either the kernel needs to be restored again, or the PC can just be rebooted. One case had 2 kernel restores, a reimage and a kernel restore.

    ^ Same problem here.
    How long it takes to create new fixed Bios-software.?
    Moderator edit: Thinly disguised profanity removed. Please stick to the Community Rules.

  • Getting "IPSEC(epa_des_crypt): decrypted packet failed SA identity check" messages on packets from only one of two far-end sources sharing the same tunnel, the other source works fine. What exactly does this error mean?

    One computer at COMPANY-A is attempting to communicate with two
    computers located at COMPANY-B, via an IPsec tunnel between the
    two companies.
    All communications are via TCP protocol.
    All devices present public IP addresses to one another, although they
    may have RFC 1918 addresses on other interfaces, and NAT may be in use
    on the COMPANY-B side.  (NAT is not being used on the COMPANY-A side.)
    The players:(Note: first three octets have been changed for security reasons)
    COMPANY-A computer      1.2.3.161
    COMPANY-A router        1.2.3.8 (also IPsec peer)
    COMPANY-A has 1.2.3.0/24 with no subnetting.
    COMPANY-B router        4.5.6.228 (also IPsec peer)
    COMPANY-B computer #1   4.5.7.94 (this one has no issues)
    COMPANY-B computer #2   4.5.7.29 (this one fails)
    COMPANY-B has 4.5.6.0/23 subnetted in various ways.
    COMPANY-B also has 9.10.11.0/24, but it is not involved in the issue.
    What works:
    The COMPANY-A computer 1.2.3.161 can communicate via the single IPsec
    tunnel to COMPANY-B computer #1 4.5.7.94 without problems.
    The "show crypto session detail" command shows Inbound/Outbound packets
    flowing in the dec'ed and enc'ed positions.
    What doesn't:
    When the COMPANY-A computer 1.2.3.161 attempts to communicate
    via the single IPsec tunnel with the COMPANY-B computer #2 4.5.7.29,
    the COMPANY-A router eventually reports five of these messages:
    Oct  9 15:24:54.327: IPSEC(epa_des_crypt): decrypted packet failed SA identity check
    Oct  9 15:24:57.327: IPSEC(epa_des_crypt): decrypted packet failed SA identity check
    Oct  9 15:25:03.327: IPSEC(epa_des_crypt): decrypted packet failed SA identity check
    Oct  9 15:25:15.328: IPSEC(epa_des_crypt): decrypted packet failed SA identity check
    Oct  9 15:25:39.329: IPSEC(epa_des_crypt): decrypted packet failed SA identity check
    Oct  9 15:26:27.328: IPSEC(epa_des_crypt): decrypted packet failed SA identity check
    and the "show crypto session detail" shows inbound packets being dropped.
    The COMPANY-A computer that opens the TCP connection never gets past the
    SYN_SENT phase of the TCP connection whan trying to communicate with the
    COMPANY-B computer #2, and the repeated error messages are the retries of
    the SYN packet.
    On the COMPANY-A side, this IPsec configuration has been set up on a 3745,
    a 3725, and some 76xx routers were tried, all with similar behavior,
    with packets from one far-end computer passing fine, and packets from
    another far-end computer in the same netblock passing through the same
    IPsec tunnel failing with the "failed SA identity" error.
    The COMPANY-A computer directs all packets headed to COMPANY-B via the
    COMPANY-A router at 1.2.3.8 with this set of route settings:
    netstat -r -n
    Kernel IP routing table
    Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
    4.5.7.0         1.2.3.8         255.255.255.0   UG        0 0          0 eth3
    1.2.3.8.0       0.0.0.0         255.255.255.0   U         0 0          0 eth3
    10.1.0.0        0.0.0.0         255.255.240.0   U         0 0          0 eth0
    169.254.0.0     0.0.0.0         255.255.0.0     U         0 0          0 eth3
    10.0.0.0        10.1.1.1        255.0.0.0       UG        0 0          0 eth0
    0.0.0.0         1.2.3.1         0.0.0.0         UG        0 0          0 eth3
    The first route line shown is selected for access to both COMPANY-B computers.
    The COMPANY-A router (IPsec tunnel endpoint, 1.2.3.8) has this
    configuration:
    crypto isakmp policy 10
    encr 3des
    authentication pre-share
    group 2
    lifetime 28800
    crypto isakmp key XXXXXXXXXXXXXXXXXXXXXXX address 4.5.6.228
    crypto ipsec security-association lifetime seconds 86400
    crypto ipsec transform-set COMPANY-B01 esp-3des esp-sha-hmac
    crypto map COMPANY-BMAP1 10 ipsec-isakmp
    description COMPANY-B VPN
    set peer 4.5.6.228
    set transform-set COMPANY-B01
    set pfs group2
    match address 190
    interface FastEthernet0/0
    ip address 1.2.3.8 255.255.255.0
    no ip redirects
    ip virtual-reassembly
    duplex auto
    speed auto
    no cdp enable
    crypto map COMPANY-BMAP1
    ip forward-protocol nd
    ip route 0.0.0.0 0.0.0.0 1.2.3.1
    ip route 10.0.0.0 255.0.0.0 10.1.1.1
    ip route 1.2.3.8.0 255.255.255.0 FastEthernet0/0
    access-list 190 permit ip host 1.2.3.161 4.5.7.0 0.0.0.255
    access-list 190 permit ip host 1.2.3.161 9.10.11.0 0.0.0.255
    bridge 1 protocol ieee
    One of the routers tried had this IOS/hardware configuration:
    Cisco IOS Software, 3700 Software (C3725-ADVIPSERVICESK9-M), Version 12.4(25c),
    RELEASE SOFTWARE (fc2)
    isco 3725 (R7000) processor (revision 0.1) with 115712K/15360K bytes of memory.
    Processor board ID XXXXXXXXXXXXXXX
    R7000 CPU at 240MHz, Implementation 39, Rev 3.3, 256KB L2 Cache
    2 FastEthernet interfaces
    4 ATM interfaces
    DRAM configuration is 64 bits wide with parity disabled.
    55K bytes of NVRAM.
    31296K bytes of ATA System CompactFlash (Read/Write)
    250368K bytes of ATA Slot0 CompactFlash (Read/Write)
    Configuration register is 0x2102
    #show crypto sess
    Crypto session current status
    Interface: FastEthernet0/0
    Session status: UP-ACTIVE
    Peer: 4.5.6.228 port 500
      IKE SA: local 1.2.3.8/500 remote 4.5.6.228/500 Active
      IPSEC FLOW: permit ip host 1.2.3.161 4.5.7.0/255.255.255.0
            Active SAs: 2, origin: crypto map
      IPSEC FLOW: permit ip host 1.2.3.161 9.10.11.0/255.255.255.0
            Active SAs: 0, origin: crypto map
    #show crypto sess det
    Crypto session current status
    Code: C - IKE Configuration mode, D - Dead Peer Detection
    K - Keepalives, N - NAT-traversal, X - IKE Extended Authentication
    Interface: FastEthernet0/0
    Session status: UP-ACTIVE
    Peer: 4.5.6.228 port 500 fvrf: (none) ivrf: (none)
          Phase1_id: 4.5.6.228
          Desc: (none)
      IKE SA: local 1.2.3.8/500 remote 4.5.6.228/500 Active
              Capabilities:(none) connid:1 lifetime:06:26:27
      IPSEC FLOW: permit ip host 1.2.3.161 4.5.7.0/255.255.255.0
            Active SAs: 2, origin: crypto map
            Inbound:  #pkts dec'ed 651 drop 16 life (KB/Sec) 4496182/23178
            Outbound: #pkts enc'ed 574 drop 2 life (KB/Sec) 4496279/23178
      IPSEC FLOW: permit ip host 1.2.3.161 9.10.11.0/255.255.255.0
            Active SAs: 0, origin: crypto map
            Inbound:  #pkts dec'ed 0 drop 0 life (KB/Sec) 0/0
            Outbound: #pkts enc'ed 0 drop 0 life (KB/Sec) 0/0
    The COMPANY-B device on their end of the IPsec VPN is a Juniper SSG1000
    Version 6.1 (ScreenOS)
    We only have a limited view into the Juniper device configuration.
    What we were allowed to see was:
    COMPANY-B-ROUTER(M)-> sh config | incl COMPANY-A
    set address "Untrust" "oss-COMPANY-A-1.2.3.161" 1.2.3.161 255.255.255.255
    set ike gateway "COMPANY-A-1-GW" address 1.2.3.8 Main outgoing-interface "ethernet2/1" preshare xxxxxxxxxxxxxxxxxxxxxx  proposal "pre-g2-3des-sha"
    set vpn "COMPANY-A-1-IKE" gateway "COMPANY-A-1-GW" no-replay tunnel idletime 0 proposal "g2-esp-3des-sha-28800"
    set policy id 2539 from "Untrust" to "Trust"  "oss-COMPANY-A-1.2.3.161" "9.10.11.0-24" "ANY" tunnel vpn "COMPANY-A-1-IKE" id 0x309a pair-policy 2500
    set policy id 2500 from "Trust" to "Untrust"  "9.10.11.0-24" "oss-COMPANY-A-1.2.3.161" "ANY" tunnel vpn "COMPANY-A-1-IKE" id 0x309a pair-policy 2539
    set policy id 2541 from "Trust" to "Untrust"  "4.5.7.0-24" "oss-COMPANY-A-1.2.3.161" "ANY" tunnel vpn "COMPANY-A-1-IKE" id 0x309b pair-policy 2540
    set policy id 2540 from "Untrust" to "Trust"  "oss-COMPANY-A-1.2.3.161" "4.5.7.0-24" "ANY" tunnel vpn "COMPANY-A-1-IKE" id 0x309b pair-policy 2541
    COMPANY-B-ROUTER(M)->
    I suspect that this curious issue is due to a configuration setting on the
    Juniper device, but neither party has seen this error before.  COMPANY-B
    operates thousands of IPsec VPNs and they report that this is a new error
    for them too.  The behavior that allows traffic from one IP address to
    work and traffic from another to end up getting this error is also unique.
    As only the Cisco side emits any error message at all, this is the only
    clue we have as to what is going on, even if this isn't actually an IOS
    problem.
    What we are looking for is a description of exactly what the Cisco
    IOS error message:
    IPSEC(epa_des_crypt): decrypted packet failed SA identity check
    is complaining about, and if there are any known causes of the behavior
    described that occur when running IPsec between Cisco IOS and a Juniper
    SSG device.  Google reports many other incidents of the same error
    message (but not the "I like that IP address but hate this one" behavior),
    and not just with a Juniper device on the COMPANY-B end, but for those cases,
    not one was found where the solution was described.
    It is hoped that with a better explanation of the error message
    and any known issues with Juniper configuration settings causing
    this error, we can have COMPANY-B make adjustments to their device.
    Or, if there is a setting change needed on the COMPANY-A router,
    that can also be implemented.
    Thanks in advance for your time in reading this, and any ideas.

    Hello Harish,
    It is believed that:
    COMPANY-B computer #1   4.5.7.94 (this one has no issues)
    COMPANY-B computer #2   4.5.7.29 (this one fails)
    both have at least two network interfaces, one with a public IP address
    (which we are supposedly conversing with) and one with a RFC 1918 type
    address.   COMPANY-B is reluctant to disclose details of their network or
    servers setup, so this is not 100% certain.
    Because of that uncertainty, it occurred to me that perhaps COMPANY-B
    computer #2 might be incorrectly routing via the RFC 1918 interface.
    In theory, such packets should have been blocked by the access-list on both
    COMPANY-A router, and should not have even made it into the IPsec VPN
    if the Juniper access settings work as it appears they should.  So I turned up
    debugging on COMPANY-A router so that I could see the encrypted and
    decrypted packet hex dumps.
    I then hand-disassembled the decoded ACK packet IP header received just
    prior to the "decrypted packet failed SA check" error being emitted and
    found the expected source and destination IP addresses (4.5.7.29 and 1.2.3.161),
    in the unecapsulated packet.  I also found the expected port numbers of the TCP
    conversation that was trying to be established in the TCP header.  So, it
    looks like COMPANY-B computer #2 is emitting the packets out the right
    interface.
    The IP packet header of the encrypted packet showed the IP addresses of the
    two routers at each terminus of the IPsec VPN, but since I don't know what triggers
    the "SA check" error message or what it is complaining about, I don't know what
    other clues to look for in the packet dumps.
    As to your second question, "can you check whether both encapsulation and
    decapsulation happening in 'show crypto ipsec sa'",   the enc'ed/dec'ed
    counters were both going up by the correct quantities.  When communicating
    with the uncooperative COMPANY-B computer #2, you would also see the
    received Drop increment for each packet decrypted.  When communicating
    with the working COMPANY-B computer #1, the Drop counters would not
    increment, and the enc'ed/dec'ed would both increment.
    #show crypto sess det
    Crypto session current status
    Code: C - IKE Configuration mode, D - Dead Peer Detection
    K - Keepalives, N - NAT-traversal, X - IKE Extended Authentication
    Interface: FastEthernet0/0
    Session status: UP-ACTIVE
    Peer: 4.5.6.228 port 500 fvrf: (none) ivrf: (none)
          Phase1_id: 4.5.6.228
          Desc: (none)
      IKE SA: local 1.2.3.8/500 remote 4.5.6.228/500 Active
              Capabilities:(none) connid:1 lifetime:07:59:54
      IPSEC FLOW: permit ip host 1.2.3.161 4.5.7.0/255.255.255.0
            Active SAs: 2, origin: crypto map
            Inbound:  #pkts dec'ed 376 drop 5 life (KB/Sec) 4458308/28784
            Outbound: #pkts enc'ed 401 drop 3 life (KB/Sec) 4458308/28784
    Attempt a TCP communication to COMPANY-B computer #2...
    show crypto sess det
    Crypto session current status
    Code: C - IKE Configuration mode, D - Dead Peer Detection
    K - Keepalives, N - NAT-traversal, X - IKE Extended Authentication
    Interface: FastEthernet0/0
    Session status: UP-ACTIVE
    Peer: 4.5.6.228 port 500 fvrf: (none) ivrf: (none)
          Phase1_id: 4.5.6.228
          Desc: (none)
      IKE SA: local 1.2.3.8/500 remote 4.5.6.228/500 Active
              Capabilities:(none) connid:1 lifetime:07:59:23
      IPSEC FLOW: permit ip host 1.2.3.161 4.5.7.0/255.255.255.0
            Active SAs: 2, origin: crypto map
            Inbound:  #pkts dec'ed 376 drop 6 life (KB/Sec) 4458307/28753
            Outbound: #pkts enc'ed 402 drop 3 life (KB/Sec) 4458307/28753
    Note Inbound "drop" changed from 5 to 6.  (I didn't let it sit for all
    the retries.)
    #show crypto ipsec sa
    interface: FastEthernet0/0
        Crypto map tag: COMPANY-BMAP1, local addr 1.2.3.8
       protected vrf: (none)
       local  ident (addr/mask/prot/port): (1.2.3.161/255.255.255.255/0/0)
       remote ident (addr/mask/prot/port): (4.5.7.0/255.255.255.0/0/0)
       current_peer 4.5.6.228 port 500
         PERMIT, flags={origin_is_acl,}
        #pkts encaps: 402, #pkts encrypt: 402, #pkts digest: 402
        #pkts decaps: 376, #pkts decrypt: 376, #pkts verify: 376
        #pkts compressed: 0, #pkts decompressed: 0
        #pkts not compressed: 0, #pkts compr. failed: 0
        #pkts not decompressed: 0, #pkts decompress failed: 0
        #send errors 3, #recv errors 6
         local crypto endpt.: 1.2.3.8, remote crypto endpt.: 4.5.6.228
         path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0/0
         current outbound spi: 0xDF2CC59C(3744253340)
      inbound esp sas:
          spi: 0xD9D2EBBB(3654478779)
            transform: esp-3des esp-sha-hmac ,
            in use settings ={Tunnel, }
            conn id: 2004, flow_id: SW:4, crypto map: COMPANY-BMAP1
            sa timing: remaining key lifetime (k/sec): (4458307/28600)
            IV size: 8 bytes
            replay detection support: Y
            Status: ACTIVE
         inbound ah sas:
         inbound pcp sas:
         outbound esp sas:
          spi: 0xDF2CC59C(3744253340)
            transform: esp-3des esp-sha-hmac ,
            in use settings ={Tunnel, }
            conn id: 2003, flow_id: SW:3, crypto map: COMPANY-BMAP1
            sa timing: remaining key lifetime (k/sec): (4458307/28600)
            IV size: 8 bytes
            replay detection support: Y
            Status: ACTIVE
         outbound ah sas:
         outbound pcp sas:
    The "send" errors appear to be related to the tunnel reverting to a
    DOWN state after periods of inactivity, and you appear to get one
    each time the tunnel has to be re-negotiated and returned to
    an ACTIVE state.  There is no relationship between Send errors
    incrementing and working/non-working TCP conversations to the
    two COMPANY-B servers.
    Thanks for pondering this very odd behavior.

  • Meaning of this error (ISE 1.2 on SNS-3415): HARDWARE RNG INTEGRITY CHECK HAS FAILED!

    Hi. We recently purchased an ISE 1.2 appliance (SNS-3415 hardware). It installed fine, but I am unable to access the GUI. When I login to the box and run the following command on the CLI
    ISE-12-NS-SD-2/admin# show application status ise
    I see the following output:
    ISE Database listener is running, PID: 7737
    ISE Database is running, number of processes: 38
    ISE Application Server process is not running.
    ISE Profiler DB is running, PID: 9090
    ISE M&T Session Database is running, PID: 8959
    ISE M&T Log Collector is running, PID: 9294
    ISE M&T Log Processor is running, PID: 9376
    % ERROR: ISE SERVICES HAVE BEEN DISABLED BECAUSE
    %        HARDWARE RNG INTEGRITY CHECK HAS FAILED!
    Can anyone help me? What can I do to ensure that the hardware RNG integrity check succeeds. Is it a license issue? Is it faulty hardware? Please advise. I would be very greatful.
    Thanks in advance.

    I worked with a TAC engineer on this and he said one other customer had this issue and the only recourse was reimaging the appliance with the ISE 1.2 ISO image.
    I did reboot, restarted services, reset to factory default and none of that worked. It is possible that the issue happened because during setup of the appliance I didn't have network connectivity and went ahead with the setup and configuration of the ISE application anyway. I later had network connectivity but by that time ISE manifested this fault.
    Reimaging and ensuring network connectivity during setup the next time around fixed the problem.

  • Site2Site Tunnel issue PSEC(epa_des_crypt): decrypted packet failed SA identity check

    Hi,
    I have a slight issue I'm having some problems resolving..
    The scenario is as follows;
    I have an external provider which connects to me via VPN to a Juniper SSG firewall, that works fine.
    I then have an external site, which does NOT reside in my MPLS cloud, so I have to deploy IPSec via Internet to reach it.
    That also works fine and I have multiple SA's running on that site with no issues or problems.
    The external provider has a small network device deployed on the external site which monitor cooling values in one of our warehouses.
    The external site which is connect via IPSEC has a Cisco 1921 and a numerous Cisco 3550 deployed.
    The VLAN for the cooling provider is vlan 150 and is setup with 10.150.4.0/24 where .1 is the def gw and .10 is the cooling monitor device.
    The external provider's servers are located within 192.168.220.0/24 subnet.
    As of right now, we can reach the Cisco 1921 through the whole IPsec tunnel from 192.168.220.182 with all services, ping, telnet whatnot, but we are unable to ping the cooling device from 192.168.220.0/24.
    However from the Cisco 1921, we can ping both 192.168.220.0/24 and the locally connected 10.150.4.10
    So basicly it seems to be the last bit when the traffic goes through the 1921 and to the switch where it fails and I can't for the life of me figure out why.
    Network diagram attached.. any ideas?
    This is the 1921 config:
    no service pad
    service tcp-keepalives-in
    service tcp-keepalives-out
    service timestamps debug datetime msec localtime
    service timestamps log datetime msec localtime
    service password-encryption
    hostname bergen-vpn-gw
    boot-start-marker
    boot system flash flash:c1841-adventerprisek9-mz.124-25d.bin
    boot-end-marker
    logging buffered 50000
    aaa new-model
    aaa authentication login default local
    aaa authentication enable default enable
    aaa session-id common
    clock timezone CET 1
    clock summer-time CET recurring last Sun Mar 2:00 last Sun Oct 3:00
    no ipv6 cef
    no ip source-route
    ip cef
    no ip bootp server
    no ip domain lookup
    ip domain name xxxxx
    multilink bundle-name authenticated
    license udi pid CISCO1921/K9 sn FCZ1508C1P4
    license boot module c1900 technology-package securityk9
    license boot module c1900 technology-package datak9
    vtp mode client
    redundancy
    crypto isakmp policy 10
    encr 3des
    authentication pre-share
    group 2
    crypto isakmp key harakiri address 1.2.3.4
    crypto ipsec transform-set 3DES-SHA esp-3des esp-sha-hmac
    crypto map VPN 10 ipsec-isakmp
    set peer 1.2.3.4
    set transform-set 3DES-SHA
    match address VPN
    interface GigabitEthernet0/0
    no ip address
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    no ip route-cache cef
    no ip route-cache
    duplex auto
    speed auto
    interface GigabitEthernet0/0.99
    description *** Test VLAN To be removed ***
    encapsulation dot1Q 99
    ip address 10.90.90.1 255.255.255.0
    no ip route-cache
    interface GigabitEthernet0/0.112
    encapsulation dot1Q 112
    ip address 192.168.112.1 255.255.255.0
    ip helper-address 172.30.1.223
    no ip route-cache
    interface GigabitEthernet0/0.150
    encapsulation dot1Q 150
    ip address 10.150.4.1 255.255.255.0
    no ip redirects
    no ip proxy-arp
    no ip route-cache
    interface GigabitEthernet0/0.178
    encapsulation dot1Q 178
    ip address 192.168.178.1 255.255.255.0
    ip helper-address 172.30.1.223
    no ip redirects
    no ip proxy-arp
    no ip route-cache
    interface GigabitEthernet0/0.999
    encapsulation dot1Q 999
    no ip route-cache
    interface GigabitEthernet0/1
    ip address 1.2.3.4 255.255.255.252
    no ip redirects
    no ip proxy-arp
    no ip route-cache cef
    no ip route-cache
    duplex auto
    speed auto
    crypto map VPN
    interface FastEthernet0/0/0
    switchport access vlan 99
    interface FastEthernet0/0/1
    interface FastEthernet0/0/2
    interface FastEthernet0/0/3
    interface Vlan1
    no ip address
    ip forward-protocol nd
    no ip http server
    no ip http secure-server
    ip route 0.0.0.0 0.0.0.0 85.200.203.29
    ip access-list extended VPN
    permit ip 10.90.90.0 0.0.0.255 172.30.1.0 0.0.0.255
    permit ip 10.90.90.0 0.0.0.255 172.22.0.0 0.0.255.255
    permit ip 10.90.90.0 0.0.0.255 172.18.5.0 0.0.0.255
    permit ip 10.90.90.0 0.0.0.255 10.50.0.0 0.0.255.255
    permit ip 192.168.112.0 0.0.0.255 172.30.1.0 0.0.0.255
    permit ip 192.168.112.0 0.0.0.255 172.22.0.0 0.0.255.255
    permit ip 192.168.112.0 0.0.0.255 172.18.5.0 0.0.0.255
    permit ip 192.168.112.0 0.0.0.255 10.50.0.0 0.0.255.255
    permit ip 192.168.178.0 0.0.0.255 172.30.1.0 0.0.0.255
    permit ip 192.168.178.0 0.0.0.255 172.22.0.0 0.0.255.255
    permit ip 192.168.178.0 0.0.0.255 172.18.5.0 0.0.0.255
    permit ip 192.168.178.0 0.0.0.255 10.50.0.0 0.0.255.255
    permit ip 192.168.112.0 0.0.0.255 172.30.240.0 0.0.0.255
    permit ip 192.168.178.0 0.0.0.255 172.30.240.0 0.0.0.255
    permit ip 192.168.112.0 0.0.0.255 10.70.0.0 0.0.0.255
    permit ip 192.168.178.0 0.0.0.255 10.70.0.0 0.0.0.255
    permit ip 10.150.4.0 0.0.0.255 192.168.220.0 0.0.0.255 log
    ip sla 1
    icmp-echo 172.30.1.223 source-interface GigabitEthernet0/0.178
    threshold 20
    frequency 120
    ip sla schedule 1 start-time now
    ip sla 2
    icmp-echo 10.50.1.200 source-interface GigabitEthernet0/0.178
    threshold 20
    frequency 120
    ip sla schedule 2 start-time now
    ip sla 3
    icmp-echo 172.18.5.121 source-interface GigabitEthernet0/0.178
    threshold 20
    frequency 120
    ip sla schedule 3 start-time now
    ip sla 4
    icmp-echo 172.22.0.140 source-interface GigabitEthernet0/0.178
    threshold 20
    frequency 120
    ip sla schedule 4 start-time now
    ip sla 5
    icmp-echo 172.30.240.40 source-interface GigabitEthernet0/0.178
    threshold 20
    frequency 120
    ip sla schedule 5 start-time now
    ip sla 6
    icmp-echo 10.70.0.200 source-interface GigabitEthernet0/0.178
    threshold 20
    frequency 120
    ip sla schedule 6 start-time now
    cdp source-interface GigabitEthernet0/0.112
    snmp-server community bamacomro RO
    cdp source-interface GigabitEthernet0/0.112
    snmp-server community bamacomro RO
    snmp-server community bamacomrw RW
    control-plane
    banner motd ^CCC-----------------------------------------------------------------------------
    This system is solely for the use of authorised users for official purposes.
    You have no expectation of privacy in its use and to ensure that the system
    is functioning properly, individuals using this computer system are subject
    to having all their activities monitored and recorded by system personell.
    Use of this system evidence an express consent to such monitoring and
    agreement that if such monitoring reveals evidence of possible abuse or
    criminal activity, system personell may provide the result of such
    monitoring to appropiate officials.
    -----------------------------------------------------------------------------^C
    line con 0
    exec-timeout 5 0
    logging synchronous
    line aux 0
    line vty 0 4
    access-class telnet in
    exec-timeout 180 0
    logging synchronous
    transport input telnet ssh
    line vty 5 15
    access-class telnet in
    exec-timeout 180 0
    password 7 094F471A1A0A
    logging synchronous
    transport input telnet ssh
    scheduler allocate 20000 1000
    end

    I had that issue 1 year go
    "decrypted packet failed SA identity check" means that we have decrypted a traffic that does not match the proxy ID negotiated
    Juniper is violating RFC4301. there is nothing we can do against RFC violation
    As mentioned in Section 4.4.1, "The Security Policy Database (SPD)",
    the SPD (or associated caches) MUST be consulted during the
    processing of all traffic that crosses the IPsec protection boundary,
    including IPsec management traffic.  If no policy is found in the SPD
    that matches a packet (for either inbound or outbound traffic), the
    packet MUST be discarded.
    I know JNPR can do 2 vpn modes. There is one where we could use a VTI instead of a crypto map on the Cisco side. That was the solution to the problem we had.
    Cheers,

  • Database Integrity check failed, how to find an un-corrupted backup for recovery

    I got database integrity check task that runs weekly. The job ran March 23rd but failed on March 30th. We have identified that there is a corruption in database and now the task is to restore it from backup (with data loss). We have database backup running
    every-night and I need to know how can I find which is the latest backup that's not corrupted.
    The MSDN documentation says "RESTORE VERIFYONLY" command does not verify whether the structure of the data contained within the backup set is correct. Does it mean the restore command will not able to detect corruption in the database and I just
    need to restore each of the backs starting from the latest to see if integrity check fails after restore ? OR RESTORE VERIFYONLY will confirm if the database is un-corrupted ?

    The MSDN documentation says "RESTORE VERIFYONLY" command does not verify whether the structure of the data contained within the backup set is correct. Does it mean the restore command will not able to detect corruption in the database and I just need to
    restore each of the backs starting from the latest to see if integrity check fails after restore ? OR RESTORE VERIFYONLY will confirm if the database is un-corrupted ?
    As the documentation suggests, RESTORE VERIFYONLY checks the structure of the backup but not the database itself.  You'll need to restore the backup to check the database consistency.
    Dan Guzman, SQL Server MVP, http://www.dbdelta.com

  • Integrity check fails on column key

    Dear DBA's,
    I am getting error while creating encrypted tablespace "ORA-S8342: Integrity check fails on column key"
    actually i am trying to work on Wallet,
    I created wallet key without auto login option initially and i created the tablespaces, user and tables associated to the tablespace.
    after that i dropped the tablespace, user and tables as well as wallet key using Metalink ID 757936.1.
    after that i created wallet key using orapki option after I tried to create the tablespace it is giving above error.
    kindly help me how to resolve this issue.
    I have one doubt that we can create encrypted tablespace only ones for a database instance?
    to create one more encrypted tablespace what will be the procedure to remove the previous encrypted tablespace?
    Best Regards,
    SG

    after that i created wallet key using orapki option after I tried to create the tablespace it is giving above error.Please log a SR for this issue.
    I have one doubt that we can create encrypted tablespace only ones for a database instance?You can create more than one.
    to create one more encrypted tablespace what will be the procedure to remove the previous encrypted tablespace?Drop the encrypted tablespace like dropping any other tablespace -- Use "DROP TABLESPACE <tablespace name> INCLUDING CONTENTS AND DATAFILES;" command.
    See this link in addition to Oracle documentation -- http://www.oracle-base.com/articles/11g/TablespaceEncryption_11gR1.php
    Thanks,
    Hussein

  • [SOLVED]package integrity check fails

    I recently ran a pacman -Syu so it downloaded all the files I wanted but when it went to install the packages, the integrity check failed at opera, the error I got was: http://pastebin.com/m447d9848
    my questions are, what is the problem? how can I fix it? Is the package corrupted, if so how can I delete it? will deleting the package fix it? thank you for your help
    Last edited by MONODA (2008-06-24 06:10:34)

    Well,  it isn't the package integrety that is failing.  You just have file conflicts on your system.
    Now to fixing them.  Most of these are to do with opera9.50.  Did you previously install opera 9.50 on your system without using pacman?  You should be safe doing a "pacman -Sf opera" to get rid of this.  I would do a "pacman -Qo <file>" on a few of those files to check nothing owns them first, just to be really safe.  You can do the same thing with shared-mime-info.
    The /usr/local/share/man issue is a bit more compllicated.  Check what files you have in that directory.  I would move them all to a temporary directory, install the filesystem package, then move them back.  The filesystem package now symlinks /usr/local/man and /usr/local/share/man

  • Which exception to be thrown when integrity check fails

    hey guys just a scenario for ya.
    During the developmen of an API for Global Platform,if an integrity check failure occurs reading a value should an exception be thrown, if not then wat procedure should be followed.
    put some light on this

    dude,the scenario is as mentioned...
    an applet calls an api which inturn returns a value.This value is a critical value of th card.So in the memory this value will be stored along with its compliment.
    In the api,first of all it has to be checked whether the value and it compliment when 'AND ed' gives zero,this is to ensure that memory is corrupted.So if this check fails in the API what shoukd be done.
    Should and exception be thrown or an error status word be return to the terminl

  • Install fails every time - integrity check

    Trying to install 10.1
    Dowload Manager starts ... gets to end of download, and then after a while gives first error window which states "Installer did not pass integrity check" with option to resume.
    When I try resume ... it start again and this time fails with error "Installer did not pass integrity check  (16262.304.371)
    Tried it several times - same result.

    Hi, please read this thread and post back the info: http://forums.adobe.com/thread/657743
    Thanks,
    eidnolb

  • Lightroom 5.3 fails integrity check

    I have been using LR5.3 since the update. For the past couple of weeks I've been having difficulty with backup. The error message is that it is failing the integrity check and won't backup. If I uncheck the integrity box, it does backup. If I check the integrity box it fails backup and say that the catalog is corrupt. When I restart LR, it does repair and I;m back where I began. This problem began cropping up a couple of weeks ago. I've reinstalled LR, I've done a full scan of my computer and still, it continues. I'm on Windows 7. What can do to fix this?

    Try creating a new catalog and then importing from the old or use Export as catalog to create a new one.

  • ITunes database integrity check?

    In iTunes I have a few ! that have appeared in the first column indicating iTunes can't find the file. So far I have found three folders (albums) that are missing from my music library disc and I don't understand how or when they dissappeared. I haven't found any individual missing files yet, just missing whole folders. It appears iTunes doesn't update the ! indicator until it has some reason to actually go open the file. Is there a way to automate this? So far I've been looking at each song with Command-I to check the Where info under Summary, or selecting the first song of an album and using Command-R to view the songs in finder. This is going to take a long time with nearly 8000 songs in my library. I'm trying to get an handle on the extent of the problem. I am careful to only use iTunes to manage the library (I don't move files around with finder). My library is on an external Firewire drive. Ideally, I would like there to be an "iTunes database integrity check" command.

    The MSDN documentation says "RESTORE VERIFYONLY" command does not verify whether the structure of the data contained within the backup set is correct. Does it mean the restore command will not able to detect corruption in the database and I just need to
    restore each of the backs starting from the latest to see if integrity check fails after restore ? OR RESTORE VERIFYONLY will confirm if the database is un-corrupted ?
    As the documentation suggests, RESTORE VERIFYONLY checks the structure of the backup but not the database itself.  You'll need to restore the backup to check the database consistency.
    Dan Guzman, SQL Server MVP, http://www.dbdelta.com

Maybe you are looking for