Cisco ASA Site-to-Site IKEv1 IPsec VPN

Hello Pavan

Recieve errors on an IKEv1 IPSec tunnel usually increase when one of the tests performed during the decapsulation of the ESP fails. These include:

  • Anti-replay out of window errors
  • Digest errors (packet corrupted)
  • Invalid decapsulation length/SA/protocol
  • Any other decapsulation failure

In order to determine in detail where the problem is, you can use various debug commands for IPSec including:

debug crypto ipsec
debug crypto isakmp

If it is an issue with ESP decapsulation, you should pick it up with the first of these debug commands. In the details of the debug you should see the reason for the recv error, and you can continue troubleshooting from there on.

Some helpful Cisco links that may aid in your troubleshooting include:

I hope this has been helpful!

Laz