Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Strange crypto error in 72xx.. HSPRE...

Hi,

We have two 72xx VPN routers acting as concentrators for around 50 VPN tunnels each. They both run 12.3-8(T11) software and a VAM card. The errors we get doesn't seem to come from IOS but rather from the VAM card - am I correct ? No users have reported any problems so I'm not sure if it's disturbing or not.

** Warning: HSPRE_REPLAY_BAD At File ipsecdecode.c:460 ** Value(0x31B4) is below current window left edge(0x31F3)

** Warning: HSPRE_REPLAY_BAD At File ipsecdecode.c:460 ** Value(0x31B6) is below current window left edge(0x31F3)

** Warning: HSPRE_REPLAY_BAD At File ipsecdecode.c:460 ** Value(0x31B5) is below current window left edge(0x31F3)** Error: HSPS_INPUT_UNDERRUN At File ipsecdecode.c:649 ** Packet too small after stripping off Header of 0x24 bytes and Trailer of 0xC6 Bytes

** Warning: HSPRE_MAC_BAD At File ipsecdecode.c:743 ** MAC Mismatch

** Warning: HSPRE_MAC_BAD At File ipsecdecode.c:743 ** MAC Mismatch** Warning: HSPRF_GP_FLAG At File ipsecdecode.c:602 ** For Tunneled packet: The innermost nextheader field contained a B9 when it should have contained 04 to indicate an IP packet was the payload

** Error: HSPS_INPUT_UNDERRUN At File ipsecdecode.c:649 ** Packet too small after stripping off Header of 0x24 bytes and Trailer of 0x8F Bytes

What is HSPS in this case - any clues ?

3 REPLIES
Cisco Employee

Re: Strange crypto error in 72xx.. HSPRE...

Dan,

Are you doing IPSEC or GRE Over IPSEC Tunnels.

What is the IP MTU Value set to ? Looks like Fragmentation might be the issue. Try to reduce fragmentation if possible.

Do a "Show ip traffic" and look at values under "Frags" and see if the values increase when the log message occurs.

Regards,

Arul

New Member

Re: Strange crypto error in 72xx.. HSPRE...

We are running GRE over IPSEC, I will take a closer look at the fragmentation and see if that can be the problem. MTU is generally set to 1420. Thanks,

// Daniel

Bronze

Re: Strange crypto error in 72xx.. HSPRE...

You may want to look at your VAM module. Updating it to VAM2+ may resolve it as to what happened to my case.

449
Views
0
Helpful
3
Replies
CreatePlease to create content