Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel

A router with VPN Accelerator Module (VAM) displays the %VPN_HW-1-PACKET_ERROR: slot: 6 Packet Encryption/Decryption error,Output replay error(0x08000000) error message

Core issue

These are three conditions that can trigger this error:

  • The IPSec-encrypted packets are forwarded out of order by the encrypting router. This is typically a result of QoS configuration on the encrypting router.

  • The IPSec packets received by the decrypting router are out of order due to packet re-ordering at an intermediate device.

  • The received IPSec packet is fragmented and requires re-assembly before authentication, verification and decryption. Since the re-assembly process takes place at the process level, it is possible that by the time the large packet is re-assembled, 64 smaller packets have already been processed by the crypto engine, thus causing the large packet to miss the anti-replay window.

What is VPN Accelerator Module?

The VPN Acceleration Module is used to achieve

  • High-performance
  • Hardware-assisted encryption
  • Key generation and compression services suitable for both remote access and site-to-site VPN applications.

Resolution

For a workaround, perform these steps:

Fore more information, refer to the IPsec Anti-Replay Window Expansion and Disable Options section of Cisco IOS Software Release 12.3T: Security Features & Hardware, Product Bulletin No. 2358.

In order to configure either of the two options (expansion or disable), refer to IPsec Anti-Replay Window - Expanding and Disabling.

5654
Views
0
Helpful
0
Comments