please read below:

Error Message %PIX|ASA-4-402116: IPSEC: Received an protocol packet (SPI=spi, sequence

number= seq_num) from remote_IP (username) to local_IP . The decapsulated inner

packet doesn't match the negotiated policy in the SA. The packet specifies its

destination as pkt_daddr, its source as pkt_saddr, and its protocol as pkt_prot . The

SA specifies its local proxy as id_daddr /id_dmask /id_dprot /id_dport and its remote

proxy as id_saddr /id_smask /id_sprot /id_sport .

Explanation This message is displayed when a decapsulated IPSec packet does not match the negotiated identity. The peer is sending other traffic through this security association. It may be due to a security association selection error by the peer, or it may be part of an attack. This message is rate limited to no more than one message every five seconds.

protocol-IPSec protocol

spi-IPSec Security Parameters Index

seq_num-IPSec sequence number

remote_IP-IP address of the remote endpoint of the tunnel

username-Username associated with the IPSec tunnel

local_IP-IP address of the local endpoint of the tunnel

pkt_daddr-Destination address from the decapsulated packet

pkt_saddr-Source address from the decapsulated packet

pkt_prot-Transport protocol from the decapsulated packet

id_daddr-Local proxy IP address

id_dmask-Local proxy IP subnet mask

id_dprot-Local proxy transport protocol

id_dport-Local proxy port

id_saddr-Remote proxy IP address

id_smask-Remote proxy IP subnet mask

id_sprot-Remote proxy transport protocol

id_sport-Remote proxy port

Recommended Action Contact the peer administrator and compare policy settings.