AIM-VNP/BP module for Cisco Router 2600

Discussion in 'Cisco' started by bensonlei, Mar 23, 2011.

  1. bensonlei

    bensonlei Guest

    Hi,

    We found errors for the router 2600 with AIM module ( WAN Link =
    1Mbit ), and LAN = 100Mbit, VPN encryption tunnel is formed over the
    WAN Link, and found the following issue:

    -----------------------------

    ..Mar 22 01:22:05.411 HKT: %HW_VPN-1-HPRXERR: Virtual Private Network
    (VPN) Module0/2: Packet Encryption/Decryption error, status=4100
    Mar 22 08:26:29.253 HKT: %CRYPTO-3-IKE_PAK_IN_Q_TIME_LIMIT_EXCEED: Pak
    spent too much time in the IKE input queues
    Mar 22 08:26:39.774 HKT: %OSPF-5-ADJCHG: Process 10, Nbr 10.26.9.8 on
    Tunnel25 from EXCHANGE to DOWN, Neighbor Down: Dead timer expired

    ---------------------------


    Anybody knows the issue ?

    Thanks so much
     
    bensonlei, Mar 23, 2011
    #1
    1. Advertisements

  2. bensonlei

    mixig Guest

    from cisco web site:

    a.. f the IKE process is under heavy load, incoming IKE packets may spend
    too much time in the IKE input queue which will result in the generation of
    a error level (severity 3) Syslog message. The Syslog message is
    %CRYPTO-3-IKE_PAK_IN_Q_TIME_LIMIT_EXCEED which has this format:
    %CRYPTO-3-IKE_PAK_IN_Q_TIME_LIMIT_EXCEED : Pak spent too much time in the
    IKE input queues
    Additional information on those syslog messages can be found at
    http://www.cisco.com/en/US/docs/ios/12_3t/system/messages/smg2tmsd.html#wp715560.
    All %CRYPTO-3-IKE_PAK_IN_Q_TIME_LIMIT_EXCEED messages should be investigated
    to determine if this issue is being exploited.

    a.. Show crypto isakmp sa
    Use the command show crypto isakmp sa to view the Internet Security
    Association Key Management Protocol (ISAKMP) security associations (SAs)
    table to determine if an excessive number of main mode no state
    (MM_NO_STATE) entries are present. ISAKMP SAs in MM_NO_STATE indicates that
    the was a main mode failure between IPSec peers and that their IKE phase 1
    policies did not match. An excessively large number may be an indication of
    an attempt to exploit this issue.
    Example output for show crypto isakmp sa:
    vpn-router#show crypto isakmp sa | include MM_NO_STATE
     
    mixig, Mar 23, 2011
    #2
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.