1

I'm running into a problem with our Cisco ASR-1002HX and ASR-1006X. I have a mix of Juniper and Cisco routers all configured exclusively with IPv6. All of our routers are in the same ospfv3 area 0. We are required to configure OSPF authentication. With ospfv3 and IPv6, we have to do that using ipsec encryption and authentication. Due to the different ways each vendor does this, we decided with our Cisco routers to apply the ipsec configurations at the area level. This is causing an obnoxious problem though. As you can see in the basic drawing I provided, we have several encryption devices throughout our network. The problem that we are seeing is that the encryption devices are sending ipsec packets to each other for their tunnels and the routers are logging that it is receiving ipsec packets with an invalid SPI. There is no issues with our tunnels. The routers continue to forward the packets without issue. The only real problem is that our logs are absolutely flooded with invalid SPI logs. If anyone has any recommendations, I'm all ears. I've opened a TAC case, but haven't received much help. They are pointing the blame to my encryption devices.

enter image description here

Improve this question
5
  • 1
    I assume the IPSEC TUNNEL in your diagram is the virtual link that is actually tunneled across Router A & B. Imho, a router should only interpret AH or ESP packets that are addressed to one of their own, local interfaces - everything else is 'just traffic'. Is their any NAT involved?
    – Zac67 ♦
    Commented Nov 10, 2021 at 15:40
  • @Zac67, no NAT. The tunnel drawing is the tunnel that the two encryption devices build between eachother over the two routers. I asked Cisco if there was a way to ignore ipsec packets not destined to the router itself, but they said there wasn't a way.
    – Ben
    Commented Nov 10, 2021 at 15:46
  • 2
    That I'd call a bug. It's definitely not a feature if you can't turn it off...
    – Zac67 ♦
    Commented Nov 10, 2021 at 15:49
  • 1
    Cisco has gone way down hill if that's true. Traffic is traffic. If it's not your traffic there's nothing for you to do but forward it. (I've had many ipsec flows going through IOS routers without any such issues.)
    – Ricky
    Commented Nov 10, 2021 at 17:43
  • 1
    Did any answer help you? if so, you should accept the answer so that the question does not keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin ♦
    Commented Dec 23, 2021 at 23:08

1 Answer 1

Reset to default
1

I posted about this on Cisco Community as well. A Cisco technician was able to replicate my issue and has recommended that it should be filed as a bug.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.