2 firewall and 1 cisco router

Unanswered Question
Oct 15th, 2009
User Badges:

Hi,


I have a 1841 cisco router with ports and ip remote access to locally connected 2 firewalls.


Those firewalls stablish 2 vpn tunnels. 1 is up an the other one no.


This warning is show:

packet has invalid spi for dest address=213.171.249.86, prot=50 spi srcaddress=217.204.95.134.


why? ther is no crypto configured at router all vpn traffic is configured into the firewall


Whats wrong?


Best regards

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
asafayan Thu, 10/15/2009 - 16:33
User Badges:

Hi,


Does this scenario / solution apply to your circumstance:

The %PIX-4-402101: decaps: recd IPSEC packet has invalid spi for destaddr=dest_address, prot=protocol, spi=number error message is received on the PIX Firewall

VERSION 2

Core issue

The received IPsec packet specifies a security parameters index (SPI) that does not exist in the security association database (SADB). This can be a temporary condition due to slight differences in the aging of security associations (SAs) between the IPsec peers or it can be due to the clearing of the local SAs. This condition can also be caused by incorrect packets sent by the IPsec peer.

Note: This can also be an attack.

Resolution

The peer may not acknowledge that the local SAs have been cleared. If a new connection is established from the local router, the two peers can then reestablish successfully. Otherwise, if the problem occurs for more than a brief period, either attempt to establish a new connection or contact the peer's administrator.

For more information about PIX Firewall syslog messages, refer to Cisco PIX Firewall System Log Messages, Version 6.3 and Cisco Security Appliance System Log Messages, Version 7.0.

edgar-quintana Sat, 10/31/2009 - 13:27
User Badges:

HI,


As I told you, there are 2 firewalls behind the router, both has as default GW routers ip, 192.168.157.254. If I change the firewall's LAN ip from 192.168.157.252 to 192.168.157.251 it works... if router is switched off same error.. changing the ip and solution.



what's happening?


Sorry about this late response...I was ill


Best regards

Actions

This Discussion