Invalid Security Parameter Index Recovery
Available Languages
Contents
- Invalid Security Parameter Index Recovery
- Finding Feature Information
- Prerequisites for Invalid Security Parameter Index Recovery
- Restrictions for Invalid Security Parameter Index Recovery
- Information About Invalid Security Parameter Index Recovery
- How the Feature Works
- How to Configure Invalid Security Parameter Index Recovery
- Configuring Invalid Security Parameter Index Recovery
- Verifying a Preshared Configuration
- Configuration Examples for Invalid SecurityParameter Index Recovery
- Invalid Security Parameter Index Recovery Example
- Additional References
- Related Documents
- Standards
- MIBs
- RFCs
- Technical Assistance
- Feature Information for Invalid Security ParameterIndex Recovery
Invalid Security Parameter Index Recovery
When an invalid security parameter index error (shown as “Invalid SPI”) occurs in IP Security (IPsec) packet processing, the Invalid Security Parameter Index Recovery feature allows for an Internet Key Exchange (IKE) security association (SA) to be established. The “IKE” module sends notification of the “Invalid SPI” error to the originating IPsec peer so that Security Association Databases (SADBs) can be resynchronized and successful packet processing can be resumed.
- Finding Feature Information
- Prerequisites for Invalid Security Parameter Index Recovery
- Restrictions for Invalid Security Parameter Index Recovery
- Information About Invalid Security Parameter Index Recovery
- How to Configure Invalid Security Parameter Index Recovery
- Configuration Examples for Invalid SecurityParameter Index Recovery
- Additional References
- Feature Information for Invalid Security ParameterIndex Recovery
Finding Feature Information
Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the Feature Information Table at the end of this document.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Prerequisites for Invalid Security Parameter Index Recovery
Before configuring the Invalid Security Parameter Index Recovery feature, you must have enabled IKE and IPsec on your router.
Restrictions for Invalid Security Parameter Index Recovery
If an IKE SA is being initiated to notify an IPsec peer of an “Invalid SPI” error, there is the risk that a denial-of-service (DoS) attack can occur. The Invalid Security Parameter Index Recovery feature has a built-in mechanism to minimize such a risk, but because there is a risk, the Invalid Security Parameter Index Recovery feature is not enabled by default. You must enable the command using command-line interface (CLI).
Information About Invalid Security Parameter Index Recovery
How the Feature Works
An IPsec “black hole” occurs when one IPsec peer “dies” (for example, a peer can “die” if a reboot occurs or if an IPsec peer somehow gets reset). Because one of the peers (the receiving peer) is completely reset, it loses its IKE SA with the other peer. Generally, when an IPsec peer receives a packet for which it cannot find an SA, it tries to send an IKE “INVALID SPI NOTIFY” message to the data originator. This notification is sent using the IKE SA. If there is no IKE SA available, the receiving peer drops the packet.
 Note |
A single SA has only two peers. However, a SADB can have multiple SAs, whereby each SA has an association with a different peer. |
When an invalid security parameter index (SPI) is encountered, the Invalid Security Parameter Index feature provides for the setting up of an IKE SA with the originator of the data, and the IKE “INVALID SPI NOTIFY” message is sent. The peer that originated the data “sees” the “INVALID SPI NOTIFY” message and deletes the IPsec SA that has the invalid SPI. If there is further traffic from the originating peer, there will not be any IPsec SAs, and new SAs will be set up. Traffic will flow again. The default behavior (that is, without configuring the Invalid Security Parameter Index Recovery feature) is that the data packet that caused the invalid SPI error is dropped. The originating peer keeps on sending the data using the IPsec SA that has the invalid SPI, and the receiving peer keeps dropping the traffic (thus creating the “black hole”).
The IPsec module uses the IKE module to send an IKE “INVALID SPI NOTIFY” message to the other peer. Once the invalid SPI recovery is in place, there should not be any significant dropping of packets although the IPsec SA setup can itself result in the dropping of a few packets.
To configure your router for the Invalid Security Parameter Index Recovery feature, use the crypto isakmp invalid-spi-recovery command. The IKE SA will not be initiated unless you have configured this command.
How to Configure Invalid Security Parameter Index Recovery
Configuring Invalid Security Parameter Index Recovery
DETAILED STEPS
Verifying a Preshared Configuration
To determine the status of the IPsec SA for traffic between two peers, you can use the show crypto ipsec sa command. If the IPsec SA is available on one peer and not on the other, there is a “black hole” situation, in which case you will see the invalid SPI errors being logged for the receiving peer. If you turn console logging on or check the syslog server, you will see that these errors are also being logged.
The daigram below shows the topology of a typical preshared configuration setup. Host 1 is the initiating peer (initiator), and Host 2 is the receiving peer (responder).
DETAILED STEPS
Configuration Examples for Invalid SecurityParameter Index Recovery
Invalid Security Parameter Index Recovery Example
The following example shows that invalid security parameter index recovery has been configured on Router A and Router B. Invalid Security Parameter Index Recovery Example shows the topology used for this example.
Router A
Router# show running-config Building configuration... Current configuration : 2048 bytes ! version 2.1 no service pad service timestamps debug datetime msec localtime service timestamps log datetime msec localtime no service password-encryption service tcp-small-servers ! hostname ipseca-71a ! logging queue-limit 100 no logging console enable secret 5 $1$4GZB$L2YOmnenOCNAu0jgFxebT/ enable password lab ! clock timezone PST -8 clock summer-time PDT recurring ip subnet-zero ! ! no ip domain lookup ! ip cef ip audit notify log ip audit po max-events 100 mpls ldp logging neighbor-changes no ftp-server write-enable ! ! no voice hpi capture buffer no voice hpi capture destination ! ! crypto isakmp policy 1 authentication pre-share lifetime 180 crypto isakmp key 0 1234 address 10.2.2.2 crypto isakmp invalid-spi-recovery ! ! crypto ipsec transform-set auth2 ah-sha-hmac esp-des esp-sha-hmac ! crypto map testtag1 10 ipsec-isakmp set peer 10.2.2.2 set transform-set auth2 match address 150 ! ! controller ISA 5/1 ! ! interface FastEthernet0/0 ip address 10.1.1.1 255.0.0.0 no ip route-cache cef duplex full speed 100 crypto map testtag1 ! interface FastEthernet0/1 ip address 10.0.0.1 255.0.0.0 no ip route-cache cef duplex auto speed auto ! interface Serial1/0 no ip address no ip route-cache no ip mroute-cache shutdown serial restart_delay 0 clockrate 128000 ! interface Serial1/1 no ip address no ip route-cache no ip mroute-cache shutdown serial restart_delay 0 clockrate 128000 ! interface Serial1/2 no ip address no ip route-cache no ip mroute-cache shutdown serial restart_delay 0 ! interface Serial1/3 no ip address no ip route-cache no ip mroute-cache shutdown no keepalive serial restart_delay 0 clockrate 128000 ! ip classless ip route 10.3.3.3 255.0.0.0 10.2.0.1 no ip http server no ip http secure-server ! ! access-list 150 permit ip host 10.0.0.1 host 10.0.2.2 dialer-list 1 protocol ip permit dialer-list 1 protocol ipx permit ! ! call rsvp-sync ! ! mgcp profile default ! ! line con 0 exec-timeout 0 0 line aux 0 line vty 0 4 password lab login ! ! end ipseca-71a#
Router B
Router# show running-config Building configuration... Current configuration : 2849 bytes ! version 2.1 no service pad service timestamps debug datetime msec localtime service timestamps log datetime msec localtime no service password-encryption service udp-small-servers service tcp-small-servers ! hostname ipseca-72a ! logging queue-limit 100 no logging console enable secret 5 $1$kKqL$5Th5Qhw1ubDkkK90KWFxi1 enable password lab ! clock timezone PST -8 clock summer-time PDT recurring ip subnet-zero ! ! no ip domain lookup ! ip cef ip audit notify log ip audit po max-events 100 mpls ldp logging neighbor-changes no ftp-server write-enable ! ! no voice hpi capture buffer no voice hpi capture destination ! ! mta receive maximum-recipients 0 ! ! crypto isakmp policy 1 authentication pre-share lifetime 180 crypto isakmp key 0 1234 address 10.1.1.1 crypto isakmp invalid-spi-recovery ! ! crypto ipsec transform-set auth2 ah-sha-hmac esp-des esp-sha-hmac ! crypto map testtag1 10 ipsec-isakmp set peer 10.1.1.1 set transform-set auth2 match address 150 ! ! controller ISA 5/1 ! ! interface FastEthernet0/0 no ip address no ip route-cache no ip mroute-cache shutdown duplex half ! interface FastEthernet1/0 ip address 10.2.2.2 255.0.0.0 no ip route-cache cef duplex half crypto map testtag1 ! interface FastEthernet1/1 ip address 10.0.2.2 255.0.0.0 no ip route-cache cef duplex half ! interface FastEthernet1/2 no ip address no ip route-cache no ip mroute-cache shutdown duplex half ! interface FastEthernet1/3 no ip address no ip route-cache no ip mroute-cache shutdown duplex half ! interface FastEthernet1/4 no ip address no ip route-cache no ip mroute-cache shutdown duplex half ! interface FastEthernet1/5 no ip address no ip route-cache no ip mroute-cache shutdown duplex half ! interface FastEthernet1/6 no ip address no ip route-cache no ip mroute-cache shutdown duplex half ! interface FastEthernet1/7 no ip address no ip route-cache no ip mroute-cache shutdown duplex half ! interface Serial3/0 no ip address no ip route-cache no ip mroute-cache shutdown serial restart_delay 0 ! interface Serial3/1 no ip address no ip route-cache no ip mroute-cache shutdown serial restart_delay 0 clockrate 128000 ! interface Serial3/2 no ip address no ip route-cache no ip mroute-cache shutdown serial restart_delay 0 ! interface Serial3/3 no ip address no ip route-cache no ip mroute-cache shutdown no keepalive serial restart_delay 0 clockrate 128000 ! ip classless ip route 10.0.0.0 255.0.0.0 10.2.0.1 no ip http server no ip http secure-server ! ! access-list 150 permit ip host 10.0.2.2 host 10.0.0.1 dialer-list 1 protocol ip permit dialer-list 1 protocol ipx permit ! ! call rsvp-sync ! ! mgcp profile default ! dial-peer cor custom ! ! gatekeeper shutdown ! ! line con 0 exec-timeout 0 0 stopbits 1 line aux 0 stopbits 1 line vty 0 4 password lab login ! ! end
Additional References
The following sections provide references relate to Invalid Security Parameter Index Recovery.
Related Documents
MIBs
Technical Assistance
| Description |
Link |
|---|---|
| The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies. To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds. Access to most tools on the Cisco Support website requires a Cisco.com user ID and password. |
Feature Information for Invalid Security ParameterIndex Recovery
The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
| Feature Name |
Releases |
Feature Information |
|---|---|---|
| Invalid Special Parameter Index (SPI) Recovery |
Cisco IOS XE Release 2.1 |
When an invalid SPI occurs in IPsec packet processing, the Invalid Security Parameter Index Recovery feature allows for an IKE SA to be established. The “IKE” module sends notification of the “Invalid SPI” error to the originating IPsec peer so that Security Association Databases (SADBs) can be resynchronized and successful packet processing can be resumed. The following command was introduced or modified: crypto isakmp invalid-spi-recovery. |
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.
FeedbackContact Cisco
- Open a Support Case
- (Requires a Cisco Service Contract)
This Document Applies to These Products
- Collaboration Endpoints - Retired Products
- Conferencing - Retired Products
- Contact Center - Retired Products
- Optical Networking - Retired Products
- Routers - Retired Products
- Security - Retired Products
- Servers - Unified Computing (UCS) Retired Products
- Storage Networking Retired Products
- Switches - Retired Products
- Video - Retired Products
- Wireless - Retired Products