Cisco ISR VPN to Transit GW VPC VPN


For a new IPv6 project, we are attempting to connect our office network to a VPC VPN "IPv6 Inside" attached to a Transit Gateway. IKE phase 1 establishes, but IKE phase 2 fails to establish with the following errors:

The error from the Cloudwatch logs is: "AWS tunnel was unable to decrypt the security payload(s)". I am unable to reference this error message in any AWS documentation.

The error on the Cisco ISR is: "NOTIFY INVALID_ID_INFO protocol 3".

I suspect the issue is with PFS or a cipher suite conflict?

However, when I attached a "IPv4 Inside" Tunnel to the same Cisco ISR, the connection is established immediately. I cannot find any documentation concerning this and the "Download configuration" option shows no difference. Should there be any difference?

1 Answer

Managed to resolve this issue. The documentation should be updated when using "Download Configuration" to say that the tunnel interface must instead use:

tunnel mode ipsec ipv4 v6-overlay instead of tunnel mode ipsec ipv4

Plus, the PtP IPv6 address should be used on the interface instead of the IPv4 address. Hopefully this post will save someone a weekend of work!

answered a month ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions