Received encrypted packet with no matching SA, dropping

[rbogman79]

Hello,

One of my customers has a problem with several VPN tunnels (site-to-site).

HQ ? PIX515E v7.04

Branch Office ? PIX501 v6.3(1)

In the morning around 12 branch offices need to connect to the HQ. When a branch office wants to connect, this will not work. In the logging I find a message called; received encrypted packet with no matching sa, dropped.

When I start a ping in the HQ to the branch office, the VPN tunnel will be build. So the temporary solution at this moment is to start a ping to all the 12 branch offices in the morning.

Does anyone recognize this problem? Hopefully someone can help us.

Kind regards,

Ron

[mmorris11]

It sounds like the tunnel is terminating at HQ during the night but not at the branch site. Are your timers the same?

[rbogman79]

Hello,

at first thanks for your tips&tricks. The timers are the same and the IKE policy is the same as well. I noticed something else and that is that the clock on several branch offices are not the same as in the HQ. Could this be some part of the problem?

[rbogman79]

Hello,

I found something else, in the IKE policy the SA lifetime is 86400 seconds (24 hours). In the IPSEC Tunnel policy the SA lifetime is 8 hours or 4608000 kilobytes. Could this be the problem?

Kind regards,

Ron