Sophos Firewall

Discussions IKE message with invalid SPI

Sophos Firewall requires membership for participation - click to join

Thread Info

State Not Answered
Locked Locked
Replies 10 replies
Subscribers 26 subscribers
Views 22319 views
Users 0 members are here

Options

Suggested

This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IKE message with invalid SPI

Can carmack over 5 years ago

After latest update;
XG115w (SFOS 17.5.9 MR-9)

VPN connection between Cyberoam started to give this Deny in the log

IPSec

Deny

received IKE message with invalid SPI (CEEC953C) from other side

18050

Any ideas?

This thread was automatically locked due to age.

Parents

0 Keyur over 5 years ago

Hi Can carmack

Please verify the IPsec policy configuration Security Parameter Index SPI is a part of IPsec SA.

Please refer to the article - https://community.sophos.com/kb/en-us/123600
Cancel
Vote Up 0 Vote Down

Cancel
0 Can carmack over 5 years ago in reply to Keyur

Hi

Thank you for response.

Followed the guide but couldn't find any information about SPI.
There is no IKE setting on Cyberoam side. maybe v1 default supported except v2.
Cancel
Vote Up 0 Vote Down

Cancel
0 Keyur over 5 years ago in reply to Can carmack

Hi Can carmack

Cyberoam Support IKE v1 and SPI are the configurations for Phase -1 and Phase -2 configuration of the IPsec policy.

I would request you to verify the Phase -1 and Phase -2 parameters in XG and Cyberoam firewall configuration, you may share the configuration screenshot for IPsec and IPsec policy.
Cancel
Vote Up 0 Vote Down

Cancel
0 Can carmack over 5 years ago in reply to Keyur
2 site to site VPN connections are active;

1st one;

SideA

SideB
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Can carmack over 5 years ago in reply to Keyur
2 site to site VPN connections are active;

1st one;

SideA

SideB
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data