Crypto Error

[kianaun]

Hi,

Has everyone ever experience this error log before from the router?

4w5d: %CRYPTO-4-PKT_REPLAY_ERR: decrypt: replay check failed

connection id=3

Thanks in advanced.

ken

[ankurbhasin]

Hi Ken,

This output shows an example of the 'Replay Check Failed' error:

"%CRYPTO-4-PKT_REPLAY_ERR: decrypt: replay check failed connection id=#." This error is a result of reordering in transmission medium (especially if parallel paths exist), or unequal paths of packet processing inside Cisco IOS for large versus small packets plus under load. Change the transform-set to reflect this. The reply check is only seen when transform-set esp-md5-hmac is enabled. In order to surpress this error message, disable esp-md5-hmac and do encryption only

Have a look at this link

http://www.cisco.com/warp/public/707/ipsec_debug.html

HTH, if yes please rate the post.

Ankur

[kianaun]

Thanks Ankur for your reply. But if this transform-set-esp-md5-hmac setting is needed, how to overcome this problem?

What is it happening at the first place since there is this option to set it as transform-set-esp-md5-mdac?

thanks,

ken

[spremkumar]

Hi

These are the following Acceptable transform combinations :

ah-md5-hmac

esp-des

esp-3des and esp-md5-hmac

ah-sha-hmac and esp-des and esp-sha-hmac

comp-lzs

Suggested transform combinations:

esp-des and esp-sha-hmac

ah-sha-hmac and esp-des and esp-sha-hmac

Instead of using esp-md5-hmac as your ESP Authentication Transform try esp-sha-hmac..

check this link for more info on the options available ..

http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/fsecur_r/fipsencr/srfipsec.htm#xtocid4

regds

[kianaun]

Hi Kumar,

Thanks for your reply.

I have checked on the router, it's transform set is :

XXXX#: sh crypto ipsec transform-set

Transform set setXXX1: { esp-3des esp-sha-hmac }

will negotiate = { Transport, },

And on the peer router, I also found this error message. Not too sure if this is related or some other issue relates to VPN Hardware Module?

011809: Apr 24 15:59:06: %VPN_HW-1-PACKET_ERROR: slot: 0 Packet Encryption/Decryption error, Output replay error(0x08000000)