Symptom
Remote router throws the error "%CRYPTO-6-IKMP_NOT_ENCRYPTED: IKE packet from x.x.x.x was not encrypted and it should've been."
Conditions
Found in ASR1001 running 15.5(3)S7b as a DMVPN Hub
Workaround
Use on demand DPDs rather periodic DPDs on Hub.
Further Problem Description