VPN error

I have 2 sites with site-to-site VPN. I have a primary and a secondary tunnel. When I did the debug isakmp error command on site A, I got the error below:
ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer is the secondary vpn connection. It is just a backup implemented with a floating static route.
How do I get rid of this error? Thanks
Who is Participating?
asavenerConnect With a Mentor Commented:
If you're using Cisco routers, try adding crypto isakmp invalid-spi-recovery at both ends.

There's a corresponding command for the ASA platform; I'll dig it up if you need it.
btanConnect With a Mentor Exec ConsultantCommented:
If from the show crypto isakmp sa it shows the ISAKMP SA in MM_NO_STATE that would means that main mode has failed. It is also flagged in the erro msg shared. Pse verify that the phase 1 policy is on both peers, and ensure that all the attributes match.

The device that is performing NAT needs to forward the UDP 500, UDP 4500 and Protocol 50 (ESP), also to add on both devices the global configuration command "crypto ipsec nat-transparency spi-matching".

Also to suggest you double check any devices "in front" of the VPN devices to makes sure all access is un-restricted for VPN's.

Ref: IPsec Troubleshooting: Understanding and Using debug Commands
leblancAccountingAuthor Commented:
I only have Cisco routers. What does crypto isakmp invalid-spi-recovery do? Will it be a downtime if I add the command on both side?
Worried about phishing attacks?

90% of attacks start with a phish. It’s critical that IT admins and MSSPs have the right security in place to protect their end users from these phishing attacks. Check out our latest feature brief for tips and tricks to keep your employees off a hackers line!

It does not require any interruption of service.

Basically, it allows the routers to recover if the other end becomes unavailable for a time, or reboots.

The problem you're seeing may be due to one end dropping the VPN (or rebooting), and the other end thinking the VPN is still active.

Once you've entered the command, you may want to find a time when you can bounce the VPNs.  Run "clear crypto ipsec sa" which will force the VPNs to rebuild from scratch.  Typically this causes no down time, as the VPN rebuild process should take less than a second.
leblancAccountingAuthor Commented:
I have two tunnels going between 2 sites. One is the primary and the other one is secondary with a floating static route. So when the primary link is up and running, the route for the secondary link is not in the routing table of the router. I think that is why I see this error. So the crypto isakmp invalid-spi-recovery will not get rid of the error, does it? Thanks
btanExec ConsultantCommented:
The recovery is pertaining to SA getting out of sync, strictly speaking it may recover but root cause is still not established. However, your error doesnt seems to lead to out of sync as sample below. You can see cisco on this command here

Sep  2 13:27:57.707: %CRYPTO-4-RECVD_PKT_INV_SPI: decaps: rec'd IPSEC packet
   has invalid spi for destaddr=, prot=50, spi=0xB761863E(3076621886),
leblancAccountingAuthor Commented:
Yes I don't have that command. Below is my error from debug crypto isakmp error command:
ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer
btanExec ConsultantCommented:
was the first posting possible to help you?
leblancAccountingAuthor Commented:
I did not add any commands in my existing config as everything is currently working fine. I am just curious on those warnings. I said warning because when I did the debug crypto isakmp command error, it did not show that warning as an error. Thanks
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.