What does this mean?

Fredric Nilsson · ‎10-01-2001

2d17h: %CRYPTO-4-RECVD_PKT_INV_SPI: decaps: rec'd IPSEC packet has invalid spi for

destaddr=208.158.13.98, prot=50, spi=0xC47DC99B(-998389349)

jscinocca · ‎10-01-2001

Hey buddy,

You NEED This page.

Goto this page and then do a find for your string.

http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121sup/121sems/emdindex.htm

FIND: %CRYPTO-4-RECVD_PKT_INV_SPI

Alright man have a good time, let me know how it went????

:)

Jason

Fredric Nilsson · ‎10-03-2001

Thanks!

The link that you provided was great. Unfortuanlly the answer didnt help me because I´ve already tried the solution that they provide but with no success.

But it seems that I have to upgrade my IOS in the 1700-router. Because there is a bug in the IOS thats runnng.

Regards

Fredric

jerry.roy · ‎10-01-2001

It means the set of crypto map attributes do not match between each side.

Veriy the following configs match on each side:

crypto ipsec transform-set (transform set name) ah-sha-hmac esp-3des

crypto map ETH0 1 ipsec-isakmp <-- This must match also

set peer xx.xxx.xxx.xxx

set security-association lifetime seconds 10800

set transform-set (transform set name)

set pfs group2

match address Axcel

Fredric Nilsson · ‎10-03-2001

Hi!

Thanks for the tip, but I´m afraid that the crypto map attributes is correct on both sides.

Regards

Fredric