No SPI to identify Phase 2 SA!

[Tekmazter]

ASA 5510 7.2(3) and trying to setup L2L but receive the following error in PHASE II when trying to establish tunnel:

construct_ipsec_delete(): No SPI to identify Phase 2 SA!

This one is new to me. Phase I goes smoothly, Phase II is where the hang up is. I'm waiting to speak to the remote site about what equipment they're using and settings etc... but thought perhaps someone might be familiar with this one.

IPsec settings for this tunnel are as follows:
PFS: NO
Transform Set: ESP-3DES-MD5
Connection Type: bidirectional
SA Lifetime: default (8 hours)
Traffic Volume: default (4608000 Kbytes)
IKE Negotiation: Main Mode
I am not NAT'ing any tunnel traffic on my side.

 

[Tekmazter]

Solved this issue ... subnet mismatch on the IPsec parameters.

Matched subnets, Phase II completed as usual and everything is online.

Curious to note that information on this error was extremely limited on the web. Searching for Security Parameter Index had me looking in the direction of possible authentication mismatch e.g. AH vs ESP.

Hopefully this helps someone out sometime.