VPN session flaps seen and session reported down with error as "IKE-Error:"Invalid hash information"

Products

• VMware NSX

Issue/Introduction

VPN session is reported down with error as "IKE-Error:"Invalid hash information". As NSX Edge is configured as IKE initiator role in this VPN session, the cycle repeats where session is re-negotiated and again brought down with the same error. Here IKE negotiation is successful, but child negotiation fails.

Environment

VMware NSX

Cause

The problem is due to Peer device config issue. Peer device disables only available IPsec tunnel configuration. So when NSX Edge sends child SA request, peer is sending INVALID_ID_INFORMATION notification first and when Edge still further tries to negotiate, peer sends INVALID_HASH_INFORMATION notification. Due to which NSX Edge eventually clears the session and re-negotiates. And hence the cycle repeats. 

Resolution

Enable IPsec tunnel configuration on the peer side to resolve the issue.