I have set up a platform (consisting of 2x ASR1001X) routers as Flexvpn DVTI hubs to terminate different remote sites (mostly ISR1000, but also older C886s) into different VRFs. The authorization backend is a Freeradius.

Enclosed my Hub Config

crypto ikev2 name-mangler MANGLER-1
 email all
crypto ikev2 profile FLEX-BOX-1
 match identity remote address ::/0
 match identity remote address 
 match identity remote email domain *****.com
 identity local fqdn hub1.****.com
 authentication remote pre-share
 authentication local rsa-sig
 keyring aaa NTVPN name-mangler MANGLER-1 password cisco
 pki trustpoint TP-1
 dpd 60 10 periodic
 aaa authorization user psk list VPN name-mangler MANGLER-1 password cisco
 virtual-template 800
crypto ipsec transform-set AES_128-SHA esp-aes esp-sha-hmac 
 mode tunnel
crypto ipsec transform-set AES_128-SHA_256 esp-aes esp-sha256-hmac 
 mode tunnel
crypto ipsec transform-set AES_256-SHA esp-aes 256 esp-sha-hmac 
 mode tunnel
crypto ipsec transform-set AES_256-SHA_256 esp-aes 256 esp-sha256-hmac 
 mode tunnel
crypto ipsec profile IPSEC-1
 set security-association lifetime seconds 7200
 set transform-set AES_256-SHA_256 AES_256-SHA AES_128-SHA_256 AES_128-SHA 
 set pfs group15
 set ikev2-profile FLEX-BOX-1
interface Virtual-Template800 type tunnel
 ip unnumbered Loopback800
 no ip redirects
 no ip proxy-arp
 ip mtu 1400
 ip tcp adjust-mss 1300
 tunnel mode ipsec ipv4
 tunnel path-mtu-discovery
 tunnel protection ipsec profile IPSEC-NTVPN-1

and the Spoke site:

crypto ikev2 client flexvpn default
  peer 1 *****
  no backup group
  client connect Tunnel1
crypto ikev2 authorization policy default
 no route set interface
 route set remote ipv4
crypto ikev2 profile Flex_IKEv2
 match identity remote fqdn domain ***.com
 identity local email ***@***.com
 authentication remote rsa-sig
 authentication local pre-share key *****
 pki trustpoint TP-VPN
 dpd 60 10 periodic
 aaa authorization user cert list default default
crypto ipsec profile default
 set ikev2-profile Flex_IKEv2
interface Tunnel1
 ip address negotiated
 ip mtu 1400
 ip tcp adjust-mss 1300
 tunnel source GigabitEthernet0/0/1
 tunnel destination dynamic
 tunnel path-mtu-discovery
 tunnel protection ipsec profile default

i excluded the whole PKI/AAA/RADIUS stuff because the plain authentication is working fine.

The story works fine as long as the spoke site has a public IP address on the internet. But as soon as the device is behind a NAT I can't get a tunnel anymore.

The hub router logs following hints

Mar 10 15:59:36.976: IKEv2-ERROR:: A supplied parameter is incorrect
Mar 10 15:59:37.692: IKEv2-ERROR:Couldn't find matching SA: Detected an invalid IKE SPI 

Mar 10 15:59:50.443: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access4, changed state to down
Mar 10 15:59:50.455: IKEv2:% DVTI Vi4 created for profile FLEX-BOX-1 with PSH index 2.

Mar 10 15:59:50.455: IKEv2:IPSec policy validate request sent for profile FLEX-BOX-1 with psh index 2.

Mar 10 15:59:50.456: IKEv2:(SA ID = 2):[IPsec -> IKEv2] Callback received for the validate proposal - FAILED.

as soon as i turn back to a WAN access where the Spoke-Side Router has an non-NAT globally reachable address everything works fine again.

any ideas what this could be or how to isolate the root-cause of my problem?

  • I have done some research and I think the problem is that I have not defined SA on the hub router. I have the "Remote Network" transmitted from the spoke site and accept it via the RADIUS attribute: "Cisco-AVPair = ipsec:route-set=interface". The routing on the spoke router itself is static. Commented Mar 10, 2021 at 19:34

1 Answer 1


Solved it...

after monitoring some Packets and noticed a lot of retransmissions we solved the issue by setting

crypto ikev2 fragmentation

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.