Cisco ASA IKE Receiver: Runt ISAKMP packet discarded on Port 500

Question

I have lots of ikev1 tunnel running on our production Cisco ASA5585 and today i have configured ikev2 tunnel for one of our new customer and i have started seeing following error, and not sure what is going on. btw we have public IP address on Cisco ASA and don't have any NAT in path.

70.xx.xx.220 this is remote end which is cloud provider VPN to access VPC.

Oct 08 2019 16:31:44 ASA-01 : %ASA-4-713903: IKE Receiver: Runt ISAKMP packet discarded on Port 500 from 70.xx.xx.200:500
Oct 08 2019 16:31:45 ASA-01 : %ASA-4-713903: IKE Receiver: Runt ISAKMP packet discarded on Port 500 from 70.xx.xx.200:500
Oct 08 2019 16:31:45 ASA-01 : %ASA-4-713903: IKE Receiver: Runt ISAKMP packet discarded on Port 500 from 70.xx.xx.200:500
Oct 08 2019 16:31:45 ASA-01 : %ASA-4-713903: IKE Receiver: Runt ISAKMP packet discarded on Port 500 from 70.xx.xx.200:500
Oct 08 2019 16:31:46 ASA-01 : %ASA-4-713903: IKE Receiver: Runt ISAKMP packet discarded on Port 500 from 70.xx.xx.200:500
Oct 08 2019 16:31:47 ASA-01 : %ASA-4-713903: IKE Receiver: Runt ISAKMP packet discarded on Port 500 from 70.xx.xx.200:500

Answer 1

I'm taking a bit of a guess here.

ASA-4-713903: is a VPN peer misbehaving. With a follow on description.

In your case you are seeing discards due to packet size, related to the peer. I believe this is an Ikev2 Keepalive mis-match.

It appears that your end of the tunnel does not match their end of the tunnel for keepalive packets. Keepalives would be header only like a ping and missing the data portion thus they wouldn't be a Ethernet Runt, but they would be a Runt ISAKMP.

It seems plausible since you have lots of working Ikev1 but on your first Ikev2 you start seeing the issue. So it follows that you might have handled keepalive differently. It also follows that the VPC would have a keepalive since it has to know the tunnel is down to failover etc.

Answer 2

This is what i found, we had lots of packet loss on this remote peer IP address was causing isakmp to not correctly form SA (it could be any variable) but when i create new VPN gateway on cloud and with same configuration it works and we have no packetloss on that new gateway.

ASA# show crypto isakmp sa
..
..
IKEv2 SAs:

Session-id:21, Status:UP-ACTIVE, IKE count:1, CHILD count:2

Tunnel-id                                         Local                                        Remote     Status         Role
288826595                           74.xx.xx.10/4500                           70.xx.xx.220/4500      READY    RESPONDER
      Encr: AES-CBC, keysize: 128, Hash: MD596, DH Grp:1, Auth sign: PSK, Auth verify: PSK
      Life/Active Time: 86400/861 sec
Child sa: local selector  10.0.0.0/0 - 10.63.255.255/65535
          remote selector 10.20.1.0/0 - 10.200.1.255/65535
          ESP spi in/out: 0x9a93fe79/0xedd4ddbd
Child sa: local selector  10.0.0.0/0 - 10.63.255.255/65535
          remote selector 10.20.2.0/0 - 10.200.2.255/65535
          ESP spi in/out: 0x6e2b9547/0xdde82764