This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

received IKE message with invalid SPI (C8A9D1D2) from other side

check in the blogs and forums and all discussions end in "support engineer solved this" but there is no explanation on how.

we have two XG F/W across a WAN working site-2-site VPN flawlessly for about 4 days, out of the blue one end receives the "received IKE message with invalid SPI (C8A9D1D2) from other side" and the VPN goes down.

One end shows VPN link UP/DOWN the other siteshows UP/UP

This thread was automatically locked due to age.

Parents

0 FormerMember over 4 years ago

Hi Kevin Day,

Thank you for reaching out to the Community!

Could you please share the screenshots of the configured IPsec policies from both firewalls?

Also, ensure that DPD(Dead Peer Detection) isn't set to Re-initiate on the IPsec connection, configured as "Respond only" gateway.

Thanks,
Cancel
Vote Up 0 Vote Down

Cancel
0 Kevin Day over 4 years ago in reply to FormerMember

upon further review, the only option for dead peer connection we have are "Re-initiate","Hold" and "Disconnect" there is no "Respond only" option.
Cancel
Vote Up 0 Vote Down

Cancel
0 FormerMember over 4 years ago in reply to Kevin Day
Hi Kevin Day,

I meant to say, on the gateway type respond only, the DPD settings can't be configured as "re-initiate."

Check out the following document for more info:

Best practice for site-to-site policy-based IPsec VPN

Note: If there’s more than one connection sharing the same policy, avoid making changes to the policy. You could clone the policy and make the required change or create a new policy.

Could you provide more detail on configured IPsec policies on both firewalls?

Thanks,
Cancel
Vote Up 0 Vote Down

Cancel
0 Kevin Day over 4 years ago in reply to FormerMember

upon checking the gateway settings it is actually set to "respond only" already.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Kevin Day over 4 years ago in reply to FormerMember

upon checking the gateway settings it is actually set to "respond only" already.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data