IKE protocol notification message received: INVALID-SPI (11).

[Ammar]

Dears,

I have a site to site VPN between PAN 7.1.6 and Cisco ASA 8.2.5, I'm receiving a lot of Invalid SPI error. I tried to reset the VPN many times and still having the same issue. This issue by the way is casusing a lot of packet dropes in the VPN

'IKE protocol notification message received: INVALID-SPI (11).'

Did any one faced a similer issue or have an idea on how to mitigate such issue ?

[athalman]

I've had this issue since December and have multiple tickets open with Palo and Rackspace where our ASA is terminated on the other end. Both parties have had multiple engineers looking into this and I still can't get it resolved. Really hoping to find a fix ASAP as it cuts off the tunnel and causes outages.

[lucagerm11]

Hi everyone, we also have the same problem. On one side we have an ASA and on the others side a Palo Alto fw. Randomly a tunnel vpn flapping. From Asa we have this loggin:

IKEv1 was unsuccessful at setting up a tunnel. Map Tag = xyz. Map Sequence Number = x.

Tunnel Manager has failed to establish an L2L SA. All configured IKE versions failed to establish the tunnel. Map Tag= xyz. Map Sequence Number = x.

and from Palo Alto we have this loggin:

IKE protocol notification message received: INVALID-SPI (11)

Was a solution found for this?

[athalman]

Hey Ammar,

I had this exact same problem for months on one of my tunnels! Palo to ASA as well. I could have sworn it was an ISP issue, but turns out it was an upgrade on the Palo side that fixed the problem. I went from 9.1.9 to 10.1.5-h2 and that fixed my issue. Haven’t had an Invalid SPI error since.