what connection does "replay check failed" refer to?

Discussion in 'Cisco' started by Rob, Jan 21, 2011.

  1. Rob

    Rob Guest

    Since a couple of days our 3725 logs messages like this:

    %CRYPTO-4-PKT_REPLAY_ERR: decrypt: replay check failed
    connection id=9, sequence number=52601

    A couple of messages are logged every hour, and the connection id
    changes slowly over time.
    I know that these refer to IPsec connection (replay checking), and I
    already applied a workaround for too small checking window advised in
    a technical document:

    crypto ipsec security-association replay window-size 1024

    However, there is no change.

    What I would like to know is: what command can be used to list the
    connections that the log message refers to (id=9 in this case), shortly
    after a message is logged.
    I would like to know which IPsec peer is causing those messages, so
    that I can investigate the internet connection used by that peer.
    Maybe there is an error that causes packet duplication on that connection.

    Commands that I have used so far (like "show crypto isakmp sa" and
    "show crypto ipsec sa") do not show connection ids that match the
    value logged in the message.

    So, what connection is it referring to?
     
    Rob, Jan 21, 2011
    #1
    1. Advertising

  2. Rob

    Rob Guest

    Rob <> wrote:
    > Commands that I have used so far (like "show crypto isakmp sa" and
    > "show crypto ipsec sa") do not show connection ids that match the
    > value logged in the message.


    In "show crypto ipsec sa" there are connection IDs, but it seems like
    they number from 2000.

    Could it be that the "connection id=19" in the log message corresponds
    to the connection with conn id 2019 in the "show crypto ipsec sa" output?
     
    Rob, Jan 25, 2011
    #2
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Christopher J Pilkington

    What do Coil and Pinnacle refer to on a Cat 65xx?

    Christopher J Pilkington, Aug 20, 2004, in forum: Cisco
    Replies:
    1
    Views:
    545
    Hansang Bae
    Aug 21, 2004
  2. nc

    what does this error number refer to?

    nc, Nov 8, 2003, in forum: Computer Support
    Replies:
    8
    Views:
    13,556
    ianwjensen
    Jun 25, 2007
  3. Jen
    Replies:
    4
    Views:
    658
  4. Mike McGee

    "Refer Madness" R1 DVD, Specs, April 20th

    Mike McGee, Jan 12, 2004, in forum: DVD Video
    Replies:
    7
    Views:
    1,425
    Steve(JazzHunter)
    Jan 13, 2004
  5. =?Utf-8?B?UmVjcnVpdGVy?=

    Can you refer anyone for this job?

    =?Utf-8?B?UmVjcnVpdGVy?=, Mar 16, 2007, in forum: MCSE
    Replies:
    4
    Views:
    421
Loading...

Share This Page