Pix 515 SPI error

[CSCO10663272]

We have a user that can't view the network with the VPN.

He connects with cisco vpn client, other users also connect with out a problem.

The gold padlock is closed, but can't view anything.

He also get IP address from the pool.

But from the log we get a SPI error

decaps: rec'd IPSEC packet has invalid spi for destaddr=XXX.XXX.XXX.XXX, prot=esp, spi=0x94040000(-1811677184), srcaddr=XXX.XXX.XXX.XXX

So it look like SA's are not getting created.

He informs me he has no firewalls installed on his home PC!!!!

Thanks in advance for any help.

[jmia]

Richard,

It does sound like an issue from the user end, as all your other users are connecting without any problems. For further investigation here’s a useful tool:

http://www.cisco.com/en/US/products/sw/secursw/ps2308/products_tech_note09186a00801f253d.shtml#topic1

Hope this helps and let me know how you get on.

Jay

[CSCO10663272]

Hi Jay,

Will he need port forwarding on his router?

Also we think there might be confficting routes in his routing table.

We are going to try a ipconfig/release.

Richard