Symptom

Invalid SPI drops can be seen in syslog, for example: %CRYPTO-4-RECVD_PKT_INV_SPI: decaps: rec'd IPSEC packet has invalid spi for destaddr=192.0.2.1, prot=50, spi=0xB610C603(3054552579), srcaddr=192.0.2.100, input interface=Tunnel0

Conditions

- DMVPN spoke-spoke tunnel establishes - IKEv2 protocol is used

Workaround

Further Problem Description

It is possible to see Invalid SPI notifications in spoke to spoke DMVPN scenario. This is a race condition scenario and should not have an impact on functionality.