1

I have 40 or 50 tunnels with over 200 SAs active on a 7204VXR with NPE-G1 using the software crypto engine (no VAS card installed).

The working config was transferred over from a 2821 with AIM-VPN hardware crypto.

Everything was fine for a while then one day all tunnels were down and debug messages were showing Unable to generate DH phase I values! almost identical to this unresolved issue.

IOS was (C7200-ADVENTERPRISEK9-M), Version 15.2(4)M4.

After trying all manner of things to get it back it was ultimately a reload that resolved things.

A couple of days later the same issue occurred again, reload and then a couple of hours later again.

I then upgraded to the latest (C7200-ADVENTERPRISEK9-M), Version 15.2(4)M8 and it's been ok for 4 days and the issue has occurred again with a slightly different error string Unable to generate DH phase 2 parameters! I'm guessing they changed the string rather than it being a different error.

Has anyone experienced this before or have any pointers of something that may have been missed?

0

Funny you should mention flash. I had to reformat the flash recently as it was hurrendously slow to boot. I think I've got a spare CF card I can try.

| improve this answer | |
0

This issue was resolved by installing a VAM2+ crypto accelerator card.

DH is now handled by the hardware crypto instead of software crypto

custvpn1#sh crypto engine connections dh 
Number of DH's pregenerated = 2
DH lifetime = 86400 seconds

Software Crypto Engine:
 Conn          Status      Group       Time left 
VAM2+:1:
 Conn          Status      Group       Time left 
 1339            Used    Group 5            6281 
 1751            Used    Group 1           60250 
 2207          Pregen    Group 5              -- 
 2443          Pregen    Group 1              -- 
 2980            Used    Group 2             163 
 3018            Used    Group 2           28501 
 3055          Pregen    Group 2              --

And the hardware crypto tells me it has a DH index limit which software crypto does not report (we may well have been hitting the software crypto limits)

custvpn1#sh crypto engine brief 
    crypto engine name:  Virtual Private Network (VPN) Module
    crypto engine type:  hardware
                 State:  Enabled
              Location:  slot 1
    VPN Module in slot:  1
          Product Name:  VAM2+
     Software Serial #:  55AA
             Device ID:  001F - revision 0000
             Vendor ID:  0000
           Revision No:  0x001F0000
          VSK revision:  0
          Boot version:  902
           DPU version:  0
           HSP version:  3.4(4) (PRODUCTION)
          Time running:  2w0d
           Compression:  Yes
                   DES:  Yes
                 3 DES:  Yes
               AES CBC:  Yes (128,192,256)
              AES CNTR:  No
 Maximum buffer length:  4096
      Maximum DH index:  5120
      Maximum SA index:  5120
    Maximum Flow index:  10230
  Maximum RSA key size:  2048


    crypto engine name:  Cisco VPN Software Implementation
    crypto engine type:  software
         serial number:  0198F273
   crypto engine state:  installed
 crypto engine in slot:  N/A
| improve this answer | |
-1

Not sure if this is any help but sounds reminiscent of a flash corruption i had one time, that or local certificates expire/corrupt - in which case i just regen them.

Cheers,

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.