AIM-VNP/BP module for Cisco Router 2600


We found errors for the router 2600 with AIM module ( WAN Link =

1Mbit ), and LAN = 100Mbit, VPN encryption tunnel is formed over the WAN Link, and found the following issue:


.Mar 22 01:22:05.411 HKT: %HW_VPN-1-HPRXERR: Virtual Private Network (VPN) Module0/2: Packet Encryption/Decryption error, status=4100 Mar 22 08:26:29.253 HKT: %CRYPTO-3-IKE_PAK_IN_Q_TIME_LIMIT_EXCEED: Pak spent too much time in the IKE input queues Mar 22 08:26:39.774 HKT: %OSPF-5-ADJCHG: Process 10, Nbr on Tunnel25 from EXCHANGE to DOWN, Neighbor Down: Dead timer expired


Anybody knows the issue ?

Thanks so much

Reply to
Loading thread data ...

from cisco web site:

a.. f the IKE process is under heavy load, incoming IKE packets may spend too much time in the IKE input queue which will result in the generation of a error level (severity 3) Syslog message. The Syslog message is %CRYPTO-3-IKE_PAK_IN_Q_TIME_LIMIT_EXCEED which has this format: %CRYPTO-3-IKE_PAK_IN_Q_TIME_LIMIT_EXCEED : Pak spent too much time in the IKE input queues Additional information on those syslog messages can be found at

formatting link
%CRYPTO-3-IKE_PAK_IN_Q_TIME_LIMIT_EXCEED messages should be investigated to determine if this issue is being exploited.

a.. Show crypto isakmp sa Use the command show crypto isakmp sa to view the Internet Security Association Key Management Protocol (ISAKMP) security associations (SAs) table to determine if an excessive number of main mode no state (MM_NO_STATE) entries are present. ISAKMP SAs in MM_NO_STATE indicates that the was a main mode failure between IPSec peers and that their IKE phase 1 policies did not match. An excessively large number may be an indication of an attempt to exploit this issue. Example output for show crypto isakmp sa: vpn-router#show crypto isakmp sa | include MM_NO_STATE

Reply to
mixig Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.