How to disable adaptive-encryption from MIST
User might see below errors in logs.
serviceArea.1.log:Jun 01 14:56:39.340 [SESS|SA ] ERROR (SessionProc-00 ) Dropped packet with key: Packet key [src ip 1.1.1.1, dest ip 2.2.2.2, src port 0, dest port 0, proto 17, interface 2.0], is flow miss, detour reason: BFD Pinhole Setup (9), is not bfd tunneled, DSCP steering: None, has Forward Metadata [Metadata Attributes: Forward Session Key IPv4; Session Id; Source Tenant Name; Service Name; Source Peer Name; Source Peer Security Name; Security Identifier; Source Peer Path Identifier; DSCP value to restore;], session key [src ip 10.104.20.15, dest ip 10.197.4.163, src port 636, dest port 48036, proto tcp], session id: 4225bfdc-a45d-4e18-957e-e1d2e5262011, tenant: NET1_A.test_gw1, service: NET1, src peer: b42c396d-1639-47d7-8f18-73d8fcdfdff5, src peer path: 1.1.1.1 due to OutOfOrderAdaptiveEncryption: Attempted to re-modify an adaptive encryption session [discriminator 1425929142273, src ip 10.104.20.15, dest ip 10.197.4.163, src port 636, dest port 48036, proto 6] { receive }
serviceArea.1.log:Jun 01 14:57:14.144 [SESS|SA ] ERROR (SessionProc-00 ) Dropped packet with key: Packet key [src ip 1.1.1.1, dest ip 2.2.2.2, src port 0, dest port 0, proto 17, interface 2.0], is flow miss, detour reason: BFD Pinhole Setup (9), is not bfd tunneled, DSCP steering: None, has Forward Metadata [Metadata Attributes: Forward Session Key IPv4; Session Id; Source Tenant Name; Service Name; Source Peer Name; Source Peer Security Name; Security Identifier; Source Peer Path Identifier; DSCP value to restore;], session key [src ip 10.104.20.15, dest ip 10.197.4.163, src port 636, dest port 48036, proto tcp], session id: 8c9badd9-21b4-4193-a30a-817d6fc014d8, tenant: NET1_A.test_gw1, service: NET1, src peer: b42c396d-1639-47d7-8f18-73d8fcdfdff5, src peer path: 1.1.1.1 due to OutOfOrderAdaptiveEncryption: Attempted to re-modify an adaptive encryption session [discriminator 1425929142273, src ip 10.104.20.15, dest ip 10.197.4.163, src port 636, dest port 48036, proto 6] { receive }
serviceArea.1.log:Jun 01 15:08:07.247 [SESS|SA ] ERROR (SessionProc-00 ) Dropped packet with key: Packet key [src ip 1.1.1.1, dest ip 3.3.3.3, src port 0, dest port 0, proto 17, interface 1.0], is flow miss, detour reason: BFD Pinhole Setup (9), is not bfd tunneled, DSCP steering: None, has Forward Metadata [Metadata Attributes: Forward Session Key IPv4; Session Id; Source Tenant Name; Service Name; Tcp Syn Packet; Source Peer Name; Source Peer Security Name; Security Identifier; Source Peer Path Identifier; DSCP value to restore;], session key [src ip 10.78.6.161, dest ip 10.197.11.3, src port 35244, dest port 3603, proto tcp], session id: cb1e2e9b-1aca-4d35-952b-5b1d6b37950b, tenant: NET1_A.test_gw1, service: NET1, src peer: b42c396d-1639-47d7-8f18-73d8fcdfdff5, src peer path: 1.1.1.1 due to DuplicateInterRouterFlowDuringSessionCreation: Duplicate forward flow while adding session (possibly a network-interface reconfig); current session key [discriminator 1425929142275, src ip 10.78.6.161, dest ip 10.197.11.3, src port 35244, dest port 3603, proto 6]; conflicting session key [discriminator 1425929142273, src ip 10.104.20.15, dest ip 10.197.4.163, src port 636, dest port 48036, proto 6]
serviceArea.1.log:Jun 01 15:11:41.464 [SESS|SA ] ERROR (SessionProc-00 ) Dropped packet with key: Packet key [src ip 1.1.1.1, dest ip 3.3.3.3, src port 0, dest port 0, proto 17, interface 1.0], is flow miss, detour reason: BFD Pinhole Setup (9), is not bfd tunneled, DSCP steering: None, has Forward Metadata [Metadata Attributes: Forward Session Key IPv4; Session Id; Source Tenant Name; Service Name; Tcp Syn Packet; Source Peer Name; Source Peer Security Name; Security Identifier; Source Peer Path Identifier; DSCP value to restore;], session key [src ip 10.78.6.161, dest ip 10.197.11.3, src port 47588, dest port 3603, proto tcp], session id: cddfa7bc-9833-4e8b-90d9-c0a86f8ec3ad, tenant: NET1_A.test_gw1, service: NET1, src peer: b42c396d-1639-47d7-8f18-73d8fcdfdff5, src peer path: 1.1.1.1 due to DuplicateInterRouterFlowDuringSessionCreation: Duplicate forward flow while adding session (possibly a network-interface reconfig); current session key [discriminator 1425929142275, src ip 10.78.6.161, dest ip 10.197.11.3, src port 47588, dest port 3603, proto 6]; conflicting session key [discriminator 1425929142273, src ip 10.104.20.15, dest ip 10.197.4.163, src port 636, dest port 18222, proto 6]
In this case adaptive-encryption is disabled since its dropping the traffic between spoke to hub.
Go to SSR CLI option in the Mist wan edge template and paste the below cmd.
config authority security internal adaptive-encryption false