Skip to main content
ZZDVA0B
ZZDVA0B
New Member
February 20, 2020
Question

IPSec Phase1 Error

  • February 20, 2020
  • 2 replies
  • 32221 views

Hi all,

I'm facing a problem with tunnel IPSEC site-to-site. I receiving the log "INVALID-SPI" and after this Received ESP packet with unknown SPI. Does someone have any idea what it could be?

 

Best Regards

Danilo

    2 replies

    ss198939
    ss198939
    New Member
    February 20, 2020
    are you getting second message ? if its main mode ? phase-1 ?
    ZZDVA0B
    ZZDVA0BAuthor
    New Member
    February 20, 2020

    I have a doubt, because the tunnel towards Remote Gateway is a Dialup user with setting on main mode.

    Sorry, but I don't understood what do You mean with "are you getting third message".

     

    Thanks in advance

    ss198939
    ss198939
    New Member
    February 20, 2020
    sorry I wanted to mention second message take packet capture and see how many messages you are getting. main mode have 6 message for phase 1 for aggressive mode its 4 message if you are not getting second message then there is some mismatch in parameters
    adGmail
    adGmail
    New Member
    February 25, 2020

    From Wikipedia;

    "The Security Parameter Index (SPI) is an identification tag added to the header while using IPsec for tunneling the IP traffic. This tag helps the kernel discern between two traffic streams where different encryption rules and algorithms may be in use."

     

    So it looks like either;

    1. the tunnel was setup but it has expired on your end, or

    2. its a stray packet for something else

     

    If #1, then check that the timer and data volume rekeying parameters are the same on both ends of the tunnel

    If #2, do the endpoint IPs match?

     

    My first guess would be that you have a shorter timer on your IPSec SAs than the remote end has, but usually tunnels fail to setup when parameters dont match. I have no experience with Forti IPSec...

    Terms & ConditionsAccessibility statement