Launching soon: The world's first vendor agnostic bug scrubLearn more & join waitlist
OPERATIONAL DEFECT DATABASE
...
...
IPSec IKEv1 tunnel, using MD5 as the algorithm in the IPSec transform set, fails to create QM keys. The following syslogs are generated: *May 3 07:27:11.202: %CRYPTO_ENGINE-3-CSDL_COMPLIANCE_FAIL: Cisco PSB security compliance violation is detected. Use of MD5 by IPSEC key engine is denied *May 3 07:27:11.202: %CRYPTO_ENGINE-3-CSDL_COMPLIANCE_FAIL: Cisco PSB security compliance violation is detected. Use of MD5 by IPSEC key engine is denied Specifically, the following shows up in debugs: *May 3 07:32:28.316: IPSEC(crypto_ipsec_create_ipsec_sas): Map found Tunnel200-head-0, 65537 *May 3 07:32:28.316: crypto_engine: Generate IKE QM keys *May 3 07:32:28.316: crypto_engine: weak algorithm MD5 not CSDL compliant *May 3 07:32:28.316: %CRYPTO_ENGINE-3-CSDL_COMPLIANCE_FAIL: Cisco PSB security compliance violation is detected. Use of MD5 by IPSEC key engine is denied *May 3 07:32:28.316: [Ident 4000000D]: request create_ipsec_sa_by_qm got error 9 *May 3 07:32:28.317: crypto_engine: Generate IKE QM keys *May 3 07:32:28.317: crypto_engine: weak algorithm MD5 not CSDL compliant *May 3 07:32:28.317: %CRYPTO_ENGINE-3-CSDL_COMPLIANCE_FAIL: Cisco PSB security compliance violation is detected. Use of MD5 by IPSEC key engine is denied *May 3 07:32:28.317: [Ident 4000000D]: request create_ipsec_sa_by_qm got error 9 *May 3 07:32:28.317: IPSEC(get_old_outbound_sa_for_peer): No outbound SA found for peer 7FBE31C05698 *May 3 07:32:28.317: IPSEC(update_current_outbound_sa): updated peer 20.1.1.2 current outbound sa to SPI 0 *May 3 07:32:28.317: IPSEC(send_delete_notify_kmi): ASSERT FAILED: Decrement count mismatch for sibling :7FBE34F257D8 *May 3 07:32:28.317: IPSEC(send_delete_notify_kmi): not sending KEY_ENGINE_DELETE_SAS *May 3 07:32:28.317: crypto engine: deleting IPSec SA ??? *May 3 07:32:28.317: delete_ipsec_sa: no such crypto engine
IPSec tunnel configured with DES/3DES as the encryption algorithm or MD5 HMAC algorithm in the transform set.
Use different encryption or HMAC algorithm within the IPSec transform set.
An additional fix from CSCwb78173 is needed to completely fix this issue.