Hi , I keep ketting these messages on my Cisco router. When these messages come up the VPN goes down for a few minutes and then automatically fixes itself. Here's the message:
IPSEC (decapsulation):error is decapsulation crypto ipsec_sa_exists. crypto-4-recvd_inv_SPI: decaps: rec'd IPSEC packet has invalid SPI destaddr=x.x.x.x, prot=50,spi=0x2f0j2500 ( 535353526) The emote office Cisco router is connected to my firewall using an IPSEC VPN. It's using IKE for the keys. On the Checkpoint firewall1 encryption propeties tab it says "renegotiate IKE SA every 52 minutes" and "renegotiate IPSEC SA's every 3600 seconds. On the Cisco router if I do "sh crypto isakmp policy". I see the lifetime set for 3120 seconds ( which equates to 52 minutes). If I do a "sh crypto ipsec security-association-lifetime". I see 4608000 kilobytes/3600 seconds which also matches the checkpoint properties tab. Please help. -- John A. Gesualdi, CCNP, CCDP, MCSE 2000 [EMAIL PROTECTED] The Providence Journal Company Phone (401)277-8133 Pager (401)785-6938 ================================================= To set vacation, Out Of Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
