AIM-VNP/BP module for Cisco Router 2600

from cisco web site:

a.. f the IKE process is under heavy load, incoming IKE packets may spend too much time in the IKE input queue which will result in the generation of a error level (severity 3) Syslog message. The Syslog message is %CRYPTO-3-IKE_PAK_IN_Q_TIME_LIMIT_EXCEED which has this format: %CRYPTO-3-IKE_PAK_IN_Q_TIME_LIMIT_EXCEED : Pak spent too much time in the IKE input queues Additional information on those syslog messages can be found at

%CRYPTO-3-IKE_PAK_IN_Q_TIME_LIMIT_EXCEED messages should be investigated to determine if this issue is being exploited.

a.. Show crypto isakmp sa Use the command show crypto isakmp sa to view the Internet Security Association Key Management Protocol (ISAKMP) security associations (SAs) table to determine if an excessive number of main mode no state (MM_NO_STATE) entries are present. ISAKMP SAs in MM_NO_STATE indicates that the was a main mode failure between IPSec peers and that their IKE phase 1 policies did not match. An excessively large number may be an indication of an attempt to exploit this issue. Example output for show crypto isakmp sa: vpn-router#show crypto isakmp sa | include MM_NO_STATE