This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IKE message with invalid SPI

Can carmack over 5 years ago

After latest update;
XG115w (SFOS 17.5.9 MR-9)

VPN connection between Cyberoam started to give this Deny in the log

IPSec

Deny

received IKE message with invalid SPI (CEEC953C) from other side

18050

Any ideas?

This thread was automatically locked due to age.

Parents

0 Keyur over 5 years ago

Hi Can carmack

Please verify the IPsec policy configuration Security Parameter Index SPI is a part of IPsec SA.

Please refer to the article - https://community.sophos.com/kb/en-us/123600
Cancel
Vote Up 0 Vote Down

Cancel
0 Can carmack over 5 years ago in reply to Keyur

Hi

Thank you for response.

Followed the guide but couldn't find any information about SPI.
There is no IKE setting on Cyberoam side. maybe v1 default supported except v2.
Cancel
Vote Up 0 Vote Down

Cancel
0 Keyur over 5 years ago in reply to Can carmack

Hi Can carmack

Cyberoam Support IKE v1 and SPI are the configurations for Phase -1 and Phase -2 configuration of the IPsec policy.

I would request you to verify the Phase -1 and Phase -2 parameters in XG and Cyberoam firewall configuration, you may share the configuration screenshot for IPsec and IPsec policy.
Cancel
Vote Up 0 Vote Down

Cancel
0 Can carmack over 5 years ago in reply to Keyur
2 site to site VPN connections are active;

1st one;

SideA

SideB
Cancel
Vote Up 0 Vote Down

Cancel
0 Can carmack over 5 years ago in reply to Keyur
2 site to site VPN connections are active;

2nd one;

SideA

SideB
Cancel
Vote Up 0 Vote Down

Cancel
0 Keyur over 5 years ago in reply to Can carmack

Hi Can carmack

How many IPsec VPN tunnel configured in the Cyberoam and XG?

Are they connected to different remote WAN IP or the same WAN IP?

Policy configuration seems to be correct, I would recommend you to contact technical support and open a service request.
Cancel
Vote Up 0 Vote Down

Cancel
0 Can carmack over 5 years ago in reply to Keyur

Hi Keyur

2 vpn connections, 4 different WAN IPs.

This small issue occured after firmware update on XG side.

Contacted support, no solution yet.

Waiting Senior support.
Cancel
Vote Up 0 Vote Down

Cancel
0 Keyur over 5 years ago in reply to Can carmack

Hi Can carmack

Thank you for your reply. Could you please PM us the service request number to check the history of the case?
Cancel
Vote Up 0 Vote Down

Cancel
0 Can carmack over 5 years ago in reply to Keyur

Hi Keyur

I see new firmware update for Sophos XG.
Do you recommend?

Any update on the case?
Cancel
Vote Up 0 Vote Down

Cancel
0 Keyur over 5 years ago in reply to Can carmack

Hi Can carmack

You may upgrade the firmware version.

For the provided case ID in the DM, the support engineer has resolved the issue and share the required details over the email and close the case with your agreement.

Please let us know if you require any further assistance on the reported query/case
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Keyur over 5 years ago in reply to Can carmack

Hi Can carmack

You may upgrade the firmware version.

For the provided case ID in the DM, the support engineer has resolved the issue and share the required details over the email and close the case with your agreement.

Please let us know if you require any further assistance on the reported query/case
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data