EMC VPN Dialer Version 4.6.00.0045 Copyright (C) 1998-2004 Cisco Systems, Inc. All Rights Reserved. Client Type(s): Windows, WinNT Running on: 5.1.2600 Service Pack 2 Config file directory: C:\Program Files\EMC VPN\VPN Client 1 09:19:25.333 03/29/06 Sev=Info/4 CM/0x63100002 Begin connection process 2 09:19:25.343 03/29/06 Sev=Info/4 CM/0x63100004 Establish secure connection using Ethernet 3 09:19:25.343 03/29/06 Sev=Info/4 CM/0x63100024 Attempt connection with server "usvgw3.emc.com" 4 09:19:25.413 03/29/06 Sev=Info/6 CM/0x6310002F Allocated local TCP port 3306 for TCP connection. 5 09:19:25.423 03/29/06 Sev=Info/4 IPSEC/0x63700008 IPSec driver successfully started 6 09:19:25.423 03/29/06 Sev=Info/4 IPSEC/0x63700014 Deleted all keys 7 09:19:25.423 03/29/06 Sev=Info/6 IPSEC/0x6370002B Sent 18955 packets, 0 were fragmented. 8 09:19:25.423 03/29/06 Sev=Info/6 IPSEC/0x6370001F TCP SYN sent to 137.69.115.15, src port 3306, dst port 4005 9 09:19:25.955 03/29/06 Sev=Info/6 IPSEC/0x6370001C TCP SYN-ACK received from 137.69.115.15, src port 4005, dst port 3306 10 09:19:25.955 03/29/06 Sev=Info/6 IPSEC/0x63700020 TCP ACK sent to 137.69.115.15, src port 3306, dst port 4005 11 09:19:25.955 03/29/06 Sev=Info/4 CM/0x63100029 TCP connection established on port 4005 with server "usvgw3.emc.com" 12 09:19:26.457 03/29/06 Sev=Info/4 CM/0x63100024 Attempt connection with server "usvgw3.emc.com" 13 09:19:26.477 03/29/06 Sev=Info/6 IKE/0x6300003B Attempting to establish a connection with 137.69.115.15. 14 09:19:26.497 03/29/06 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK AG (SA, KE, NON, ID, VID(Xauth), VID(dpd), VID(Unity)) to 137.69.115.15 15 09:19:26.668 03/29/06 Sev=Info/5 IKE/0x6300002F Received ISAKMP packet: peer = 137.69.115.15 16 09:19:26.668 03/29/06 Sev=Info/4 IKE/0x63000014 RECEIVING <<< ISAKMP OAK AG (SA, KE, NON, ID, HASH, VID(Unity), VID(Xauth), VID(dpd), VID(Frag), VID(?), VID(?)) from 137.69.115.15 17 09:19:26.668 03/29/06 Sev=Info/5 IKE/0x63000001 Peer is a Cisco-Unity compliant peer 18 09:19:26.668 03/29/06 Sev=Info/5 IKE/0x63000001 Peer supports XAUTH 19 09:19:26.668 03/29/06 Sev=Info/5 IKE/0x63000001 Peer supports DPD 20 09:19:26.668 03/29/06 Sev=Info/5 IKE/0x63000001 Peer supports DWR Code and DWR Text 21 09:19:26.668 03/29/06 Sev=Info/6 IKE/0x63000001 IOS Vendor ID Contruction successful 22 09:19:26.668 03/29/06 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK AG *(HASH, NOTIFY:STATUS_INITIAL_CONTACT, VID(?), VID(Unity)) to 137.69.115.15 23 09:19:26.668 03/29/06 Sev=Info/4 IKE/0x63000082 IKE Port in use - Local Port = 0x01F4, Remote Port = 0x01F4 24 09:19:26.668 03/29/06 Sev=Info/4 CM/0x6310000E Established Phase 1 SA. 1 Crypto Active IKE SA, 0 User Authenticated IKE SA in the system 25 09:19:26.698 03/29/06 Sev=Info/5 IKE/0x6300002F Received ISAKMP packet: peer = 137.69.115.15 26 09:19:26.698 03/29/06 Sev=Info/4 IKE/0x63000014 RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:LOAD_BALANCE) from 137.69.115.15 27 09:19:26.698 03/29/06 Sev=Info/4 CM/0x6310001B Received alternative server address "137.69.115.17" from primary server 28 09:19:26.698 03/29/06 Sev=Info/4 IKE/0x63000017 Marking IKE SA for deletion (I_Cookie=A395B25E0356734B R_Cookie=B5E24CAEB6334E59) reason = DEL_REASON_LOAD_BALANCING 29 09:19:26.698 03/29/06 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK INFO *(HASH, DWR) to 137.69.115.15 30 09:19:27.451 03/29/06 Sev=Info/4 IKE/0x6300004A Discarding IKE SA negotiation (I_Cookie=A395B25E0356734B R_Cookie=B5E24CAEB6334E59) reason = DEL_REASON_LOAD_BALANCING 31 09:19:27.451 03/29/06 Sev=Info/4 CM/0x63100014 Unable to establish Phase 1 SA with server "usvgw3.emc.com" because of "DEL_REASON_LOAD_BALANCING" 32 09:19:27.451 03/29/06 Sev=Info/4 CM/0x63100010 Try alternative server "137.69.115.17" given by the primary server 33 09:19:27.451 03/29/06 Sev=Info/4 CM/0x63100024 Attempt connection with server "137.69.115.17" 34 09:19:27.471 03/29/06 Sev=Info/4 CM/0x6310002D Resetting TCP connection on port 4005 35 09:19:27.963 03/29/06 Sev=Info/6 IPSEC/0x63700022 TCP RST sent to 137.69.115.15, src port 3306, dst port 4005 36 09:19:27.963 03/29/06 Sev=Info/6 IPSEC/0x6370001F TCP SYN sent to 137.69.115.17, src port 3306, dst port 4005 37 09:19:27.963 03/29/06 Sev=Info/6 IPSEC/0x6370001C TCP SYN-ACK received from 137.69.115.17, src port 4005, dst port 3306 38 09:19:27.963 03/29/06 Sev=Info/6 IPSEC/0x63700020 TCP ACK sent to 137.69.115.17, src port 3306, dst port 4005 39 09:19:27.963 03/29/06 Sev=Info/4 CM/0x63100029 TCP connection established on port 4005 with server "137.69.115.17" 40 09:19:28.465 03/29/06 Sev=Info/4 CM/0x63100024 Attempt connection with server "137.69.115.17" 41 09:19:28.475 03/29/06 Sev=Info/6 IKE/0x6300003B Attempting to establish a connection with 137.69.115.17. 42 09:19:28.505 03/29/06 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK AG (SA, KE, NON, ID, VID(Xauth), VID(dpd), VID(Unity)) to 137.69.115.17 43 09:19:28.666 03/29/06 Sev=Info/5 IKE/0x6300002F Received ISAKMP packet: peer = 137.69.115.17 44 09:19:28.666 03/29/06 Sev=Info/4 IKE/0x63000014 RECEIVING <<< ISAKMP OAK AG (SA, KE, NON, ID, HASH, VID(Unity), VID(Xauth), VID(dpd), VID(Frag), VID(?), VID(?)) from 137.69.115.17 45 09:19:28.666 03/29/06 Sev=Info/5 IKE/0x63000001 Peer is a Cisco-Unity compliant peer 46 09:19:28.666 03/29/06 Sev=Info/5 IKE/0x63000001 Peer supports XAUTH 47 09:19:28.666 03/29/06 Sev=Info/5 IKE/0x63000001 Peer supports DPD 48 09:19:28.666 03/29/06 Sev=Info/5 IKE/0x63000001 Peer supports DWR Code and DWR Text 49 09:19:28.676 03/29/06 Sev=Info/6 IKE/0x63000001 IOS Vendor ID Contruction successful 50 09:19:28.676 03/29/06 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK AG *(HASH, NOTIFY:STATUS_INITIAL_CONTACT, VID(?), VID(Unity)) to 137.69.115.17 51 09:19:28.676 03/29/06 Sev=Info/4 IKE/0x63000082 IKE Port in use - Local Port = 0x01F4, Remote Port = 0x01F4 52 09:19:28.676 03/29/06 Sev=Info/4 CM/0x6310000E Established Phase 1 SA. 1 Crypto Active IKE SA, 0 User Authenticated IKE SA in the system 53 09:19:28.706 03/29/06 Sev=Info/5 IKE/0x6300002F Received ISAKMP packet: peer = 137.69.115.17 54 09:19:28.706 03/29/06 Sev=Info/4 IKE/0x63000014 RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 137.69.115.17 55 09:19:28.706 03/29/06 Sev=Info/4 CM/0x63100015 Launch xAuth application 56 09:19:37.239 03/29/06 Sev=Info/4 CM/0x63100017 xAuth application returned 57 09:19:37.239 03/29/06 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 137.69.115.17 58 09:19:42.088 03/29/06 Sev=Info/5 IKE/0x6300002F Received ISAKMP packet: peer = 137.69.115.17 59 09:19:42.088 03/29/06 Sev=Info/4 IKE/0x63000014 RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 137.69.115.17 60 09:19:42.088 03/29/06 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 137.69.115.17 61 09:19:42.088 03/29/06 Sev=Info/4 CM/0x6310000E Established Phase 1 SA. 1 Crypto Active IKE SA, 1 User Authenticated IKE SA in the system 62 09:19:42.189 03/29/06 Sev=Info/5 IKE/0x6300005D Client sending a firewall request to concentrator 63 09:19:42.189 03/29/06 Sev=Info/5 IKE/0x6300005C Firewall Policy: Product=Cisco Systems Integrated Client, Capability= (Centralized Protection Policy). 64 09:19:42.189 03/29/06 Sev=Info/5 IKE/0x6300005C Firewall Policy: Product=NetworkICE BlackICE Defender, Capability= (Are you There?). 65 09:19:42.199 03/29/06 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 137.69.115.17 66 09:19:43.062 03/29/06 Sev=Info/5 IKE/0x6300002F Received ISAKMP packet: peer = 137.69.115.17 67 09:19:43.062 03/29/06 Sev=Info/4 IKE/0x63000014 RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 137.69.115.17 68 09:19:43.062 03/29/06 Sev=Info/5 IKE/0x63000010 MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_ADDRESS: , value = 10.13.32.169 69 09:19:43.062 03/29/06 Sev=Info/5 IKE/0x63000010 MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_NETMASK: , value = 255.255.192.0 70 09:19:43.062 03/29/06 Sev=Info/5 IKE/0x63000010 MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS(1): , value = 137.69.224.15 71 09:19:43.062 03/29/06 Sev=Info/5 IKE/0x63000010 MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS(2): , value = 128.221.12.10 72 09:19:43.062 03/29/06 Sev=Info/5 IKE/0x63000010 MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_NBNS(1) (a.k.a. WINS) : , value = 128.221.12.10 73 09:19:43.062 03/29/06 Sev=Info/5 IKE/0x63000010 MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_NBNS(2) (a.k.a. WINS) : , value = 128.222.67.10 74 09:19:43.062 03/29/06 Sev=Info/5 IKE/0x6300000E MODE_CFG_REPLY: Attribute = MODECFG_UNITY_BANNER, value = ************** EMC Americas West Coast VPN Gateway ************** ATTENTION!!! If you are running a VPN Client version other than 4.6, you must upgrade as soon as possible. Check the title bar of your VPN Dialer application. If it does not start with VPN Dialer-Version 4.6, disconnect from VPN now and visit http://vpndist.emc.com. Download and install "DTP3.6-VPN4.6.EXE". 75 09:19:43.062 03/29/06 Sev=Info/5 IKE/0x6300000D MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SAVEPWD: , value = 0x00000000 76 09:19:43.062 03/29/06 Sev=Info/5 IKE/0x6300000E MODE_CFG_REPLY: Attribute = MODECFG_UNITY_DEFDOMAIN: , value = corp.emc.com 77 09:19:43.062 03/29/06 Sev=Info/5 IKE/0x6300000D MODE_CFG_REPLY: Attribute = MODECFG_UNITY_PFS: , value = 0x00000000 78 09:19:43.062 03/29/06 Sev=Info/5 IKE/0x6300000E MODE_CFG_REPLY: Attribute = APPLICATION_VERSION, value = Cisco Systems, Inc./VPN 3000 Concentrator Version 4.7.2.B built by vmurphy on Oct 04 2005 02:50:52 79 09:19:43.062 03/29/06 Sev=Info/5 IKE/0x6300000D MODE_CFG_REPLY: Attribute = MODECFG_UNITY_INCLUDE_LOCAL_LAN (# of local_nets), value = 0x00000001 80 09:19:43.062 03/29/06 Sev=Info/5 IKE/0x6300000F LOCAL_NET #1 subnet = 192.168.1.0 mask = 255.255.255.0 protocol = 0 src port = 0 dest port=0 81 09:19:43.072 03/29/06 Sev=Info/4 CM/0x63100019 Mode Config data received 82 09:19:43.082 03/29/06 Sev=Info/4 IKE/0x63000055 Received a key request from Driver: Local IP = 10.13.32.169, GW IP = 137.69.115.17, Remote IP = 0.0.0.0 83 09:19:43.082 03/29/06 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK QM *(HASH, SA, NON, ID, ID) to 137.69.115.17 84 09:19:43.112 03/29/06 Sev=Info/5 IKE/0x6300002F Received ISAKMP packet: peer = 137.69.115.17 85 09:19:43.112 03/29/06 Sev=Info/4 IKE/0x63000014 RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:STATUS_RESP_LIFETIME) from 137.69.115.17 86 09:19:43.122 03/29/06 Sev=Info/5 IKE/0x63000044 RESPONDER-LIFETIME notify has value of 86400 seconds 87 09:19:43.122 03/29/06 Sev=Info/5 IKE/0x63000046 This SA has already been alive for 15 seconds, setting expiry to 86385 seconds from now 88 09:19:43.122 03/29/06 Sev=Info/5 IKE/0x6300002F Received ISAKMP packet: peer = 137.69.115.17 89 09:19:43.122 03/29/06 Sev=Info/4 IKE/0x63000014 RECEIVING <<< ISAKMP OAK QM *(HASH, SA, NON, ID, ID, NOTIFY:STATUS_RESP_LIFETIME) from 137.69.115.17 90 09:19:43.122 03/29/06 Sev=Info/5 IKE/0x63000044 RESPONDER-LIFETIME notify has value of 28800 seconds 91 09:19:43.122 03/29/06 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK QM *(HASH) to 137.69.115.17 92 09:19:43.122 03/29/06 Sev=Info/5 IKE/0x63000058 Loading IPsec SA (MsgID=13F98D5B OUTBOUND SPI = 0x08391F8F INBOUND SPI = 0xD5D56BDB) 93 09:19:43.122 03/29/06 Sev=Info/5 IKE/0x63000025 Loaded OUTBOUND ESP SPI: 0x08391F8F 94 09:19:43.122 03/29/06 Sev=Info/5 IKE/0x63000026 Loaded INBOUND ESP SPI: 0xD5D56BDB 95 09:19:43.795 03/29/06 Sev=Info/4 CM/0x63100034 The Virtual Adapter was enabled: IP=10.13.32.169/255.255.192.0 DNS=137.69.224.15,128.221.12.10 WINS=128.221.12.10,128.222.67.10 Domain=corp.emc.com Split DNS Names= 96 09:19:43.925 03/29/06 Sev=Info/6 CM/0x63100036 The routing table was updated for the Virtual Adapter 97 09:19:43.955 03/29/06 Sev=Info/4 CM/0x6310001A One secure connection established 98 09:19:43.975 03/29/06 Sev=Info/4 CM/0x63100038 Address watch added for 192.168.1.9. Current address(es): 192.168.1.9, 10.13.32.169. 99 09:19:43.975 03/29/06 Sev=Info/4 CM/0x63100038 Address watch added for 10.13.32.169. Current address(es): 192.168.1.9, 10.13.32.169. 100 09:19:44.135 03/29/06 Sev=Info/4 IPSEC/0x63700014 Deleted all keys 101 09:19:44.135 03/29/06 Sev=Info/6 IPSEC/0x6370002B Sent 8 packets, 0 were fragmented. 102 09:19:44.135 03/29/06 Sev=Info/4 IPSEC/0x63700010 Created a new key structure 103 09:19:44.135 03/29/06 Sev=Info/4 IPSEC/0x6370000F Added key with SPI=0x8f1f3908 into key list 104 09:19:44.135 03/29/06 Sev=Info/4 IPSEC/0x63700010 Created a new key structure 105 09:19:44.135 03/29/06 Sev=Info/4 IPSEC/0x6370000F Added key with SPI=0xdb6bd5d5 into key list 106 09:19:44.135 03/29/06 Sev=Info/4 IPSEC/0x6370002E Assigned VA private interface addr 10.13.32.169 107 09:19:48.021 03/29/06 Sev=Info/4 IPSEC/0x63700019 Activate outbound key with SPI=0x8f1f3908 for inbound key with SPI=0xdb6bd5d5 108 09:24:28.935 03/29/06 Sev=Info/6 IPSEC/0x63700021 TCP heartbeat sent to 137.69.115.17, src port 3306, dst port 4005 109 09:28:06.247 03/29/06 Sev=Info/6 IPSEC/0x63700023 CNIReceiveComplete: Invalid TCP checksum 110 09:28:06.247 03/29/06 Sev=Warning/3 IPSEC/0xA370001C Bad cTCP trailer, Rsvd 0, Magic# 696c4521h, trailer len 0, MajorVer 0, MinorVer 92 111 09:29:29.867 03/29/06 Sev=Info/6 IPSEC/0x63700021 TCP heartbeat sent to 137.69.115.17, src port 3306, dst port 4005 112 09:34:29.819 03/29/06 Sev=Info/6 IPSEC/0x63700021 TCP heartbeat sent to 137.69.115.17, src port 3306, dst port 4005 113 09:39:30.741 03/29/06 Sev=Info/6 IPSEC/0x63700021 TCP heartbeat sent to 137.69.115.17, src port 3306, dst port 4005 114 09:44:31.684 03/29/06 Sev=Info/6 IPSEC/0x63700021 TCP heartbeat sent to 137.69.115.17, src port 3306, dst port 4005 115 09:49:32.161 03/29/06 Sev=Info/6 IPSEC/0x63700021 TCP heartbeat sent to 137.69.115.17, src port 3306, dst port 4005 116 09:54:31.875 03/29/06 Sev=Info/6 IPSEC/0x63700021 TCP heartbeat sent to 137.69.115.17, src port 3306, dst port 4005 117 09:57:43.222 03/29/06 Sev=Info/4 CM/0x6310000A Secure connections terminated 118 09:57:43.222 03/29/06 Sev=Info/4 IKE/0x63000001 IKE received signal to terminate VPN connection 119 09:57:43.222 03/29/06 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK INFO *(HASH, DEL) to 137.69.115.17 120 09:57:43.222 03/29/06 Sev=Info/5 IKE/0x63000018 Deleting IPsec SA: (OUTBOUND SPI = 8391F8F INBOUND SPI = D5D56BDB) 121 09:57:43.222 03/29/06 Sev=Info/4 IKE/0x63000048 Discarding IPsec SA negotiation, MsgID=13F98D5B 122 09:57:43.222 03/29/06 Sev=Info/4 IKE/0x63000017 Marking IKE SA for deletion (I_Cookie=D415E2E7B646CB11 R_Cookie=BC5E5A6497E31BB2) reason = DEL_REASON_RESET_SADB 123 09:57:43.222 03/29/06 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK INFO *(HASH, DWR) to 137.69.115.17 124 09:57:43.222 03/29/06 Sev=Info/4 IKE/0x6300004A Discarding IKE SA negotiation (I_Cookie=D415E2E7B646CB11 R_Cookie=BC5E5A6497E31BB2) reason = DEL_REASON_RESET_SADB 125 09:57:43.222 03/29/06 Sev=Info/4 CM/0x63100013 Phase 1 SA deleted cause by DEL_REASON_RESET_SADB. 0 Crypto Active IKE SA, 0 User Authenticated IKE SA in the system 126 09:57:43.222 03/29/06 Sev=Info/5 CM/0x63100025 Initializing CVPNDrv 127 09:57:43.222 03/29/06 Sev=Info/4 CM/0x6310002D Resetting TCP connection on port 4005 128 09:57:43.222 03/29/06 Sev=Info/6 CM/0x63100030 Removed local TCP port 3306 for TCP connection. 129 09:57:43.222 03/29/06 Sev=Info/6 CM/0x63100031 Tunnel to headend device 137.69.115.17 disconnected: duration: 0 days 0:38:0 130 09:57:43.222 03/29/06 Sev=Info/6 CM/0x63100037 The routing table was returned to orginal state prior to Virtual Adapter 131 09:57:45.600 03/29/06 Sev=Info/4 CM/0x63100035 The Virtual Adapter was disabled 132 09:57:45.600 03/29/06 Sev=Info/5 CM/0x63100025 Initializing CVPNDrv 133 09:57:45.610 03/29/06 Sev=Info/4 IPSEC/0x63700013 Delete internal key with SPI=0xdb6bd5d5 134 09:57:45.610 03/29/06 Sev=Info/4 IPSEC/0x6370000C Key deleted by SPI 0xdb6bd5d5 135 09:57:45.610 03/29/06 Sev=Info/4 IPSEC/0x63700013 Delete internal key with SPI=0x8f1f3908 136 09:57:45.610 03/29/06 Sev=Info/4 IPSEC/0x6370000C Key deleted by SPI 0x8f1f3908 137 09:57:45.610 03/29/06 Sev=Info/6 IPSEC/0x63700022 TCP RST sent to 137.69.115.17, src port 3306, dst port 4005 138 09:57:45.610 03/29/06 Sev=Info/4 IPSEC/0x63700014 Deleted all keys 139 09:57:45.610 03/29/06 Sev=Info/4 IPSEC/0x63700014 Deleted all keys 140 09:57:45.610 03/29/06 Sev=Info/4 IPSEC/0x6370000A IPSec driver successfully stopped 141 09:57:45.610 03/29/06 Sev=Info/4 IPSEC/0x63700014 Deleted all keys