All tunnels down on Cisco 7204VXR with debug message "Unable to generate DH phase 2 parameters!"

Question

I have 40 or 50 tunnels with over 200 SAs active on a 7204VXR with NPE-G1 using the software crypto engine (no VAS card installed).

The working config was transferred over from a 2821 with AIM-VPN hardware crypto.

Everything was fine for a while then one day all tunnels were down and debug messages were showing Unable to generate DH phase I values! almost identical to this unresolved issue.

IOS was (C7200-ADVENTERPRISEK9-M), Version 15.2(4)M4.

After trying all manner of things to get it back it was ultimately a reload that resolved things.

A couple of days later the same issue occurred again, reload and then a couple of hours later again.

I then upgraded to the latest (C7200-ADVENTERPRISEK9-M), Version 15.2(4)M8 and it's been ok for 4 days and the issue has occurred again with a slightly different error string Unable to generate DH phase 2 parameters! I'm guessing they changed the string rather than it being a different error.

Has anyone experienced this before or have any pointers of something that may have been missed?

Answer 1

Funny you should mention flash. I had to reformat the flash recently as it was hurrendously slow to boot. I think I've got a spare CF card I can try.

Answer 2

This issue was resolved by installing a VAM2+ crypto accelerator card.

DH is now handled by the hardware crypto instead of software crypto

custvpn1#sh crypto engine connections dh 
Number of DH's pregenerated = 2
DH lifetime = 86400 seconds

Software Crypto Engine:
 Conn          Status      Group       Time left 
VAM2+:1:
 Conn          Status      Group       Time left 
 1339            Used    Group 5            6281 
 1751            Used    Group 1           60250 
 2207          Pregen    Group 5              -- 
 2443          Pregen    Group 1              -- 
 2980            Used    Group 2             163 
 3018            Used    Group 2           28501 
 3055          Pregen    Group 2              --

And the hardware crypto tells me it has a DH index limit which software crypto does not report (we may well have been hitting the software crypto limits)

custvpn1#sh crypto engine brief 
    crypto engine name:  Virtual Private Network (VPN) Module
    crypto engine type:  hardware
                 State:  Enabled
              Location:  slot 1
    VPN Module in slot:  1
          Product Name:  VAM2+
     Software Serial #:  55AA
             Device ID:  001F - revision 0000
             Vendor ID:  0000
           Revision No:  0x001F0000
          VSK revision:  0
          Boot version:  902
           DPU version:  0
           HSP version:  3.4(4) (PRODUCTION)
          Time running:  2w0d
           Compression:  Yes
                   DES:  Yes
                 3 DES:  Yes
               AES CBC:  Yes (128,192,256)
              AES CNTR:  No
 Maximum buffer length:  4096
      Maximum DH index:  5120
      Maximum SA index:  5120
    Maximum Flow index:  10230
  Maximum RSA key size:  2048


    crypto engine name:  Cisco VPN Software Implementation
    crypto engine type:  software
         serial number:  0198F273
   crypto engine state:  installed
 crypto engine in slot:  N/A

Answer 3

Not sure if this is any help but sounds reminiscent of a flash corruption i had one time, that or local certificates expire/corrupt - in which case i just regen them.

Cheers,