EMC VPN Dialer Version 4.6.00.0045 Copyright (C) 1998-2004 Cisco Systems, Inc. All Rights Reserved. Client Type(s): Windows, WinNT Running on: 5.1.2600 Service Pack 2 Config file directory: C:\Program Files\EMC VPN\VPN Client 1 06:07:15.355 09/26/06 Sev=Info/4 CM/0x63100002 Begin connection process 2 06:07:15.555 09/26/06 Sev=Info/4 CM/0x63100004 Establish secure connection using Ethernet 3 06:07:15.555 09/26/06 Sev=Info/4 CM/0x63100024 Attempt connection with server "usvgw3.emc.com" 4 06:07:33.121 09/26/06 Sev=Info/4 CM/0x6310001D Unable to resolve server address "usvgw3.emc.com" 5 06:07:33.121 09/26/06 Sev=Info/4 CM/0x63100024 Attempt connection with server "usvgw1.emc.com" 6 06:07:50.386 09/26/06 Sev=Info/4 CM/0x6310001D Unable to resolve server address "usvgw1.emc.com" 7 06:07:50.386 09/26/06 Sev=Info/4 CM/0x6310000C All connection attempts with backup server failed 8 06:07:50.386 09/26/06 Sev=Info/5 CM/0x63100025 Initializing CVPNDrv 9 06:07:50.386 09/26/06 Sev=Info/4 IPSEC/0x63700008 IPSec driver successfully started 10 06:07:50.386 09/26/06 Sev=Info/4 IPSEC/0x63700014 Deleted all keys 11 06:07:50.386 09/26/06 Sev=Info/4 IPSEC/0x63700014 Deleted all keys 12 06:07:50.386 09/26/06 Sev=Info/4 IPSEC/0x63700014 Deleted all keys 13 06:07:50.386 09/26/06 Sev=Info/4 IPSEC/0x6370000A IPSec driver successfully stopped 14 06:10:35.306 09/26/06 Sev=Info/4 CM/0x63100002 Begin connection process 15 06:10:35.316 09/26/06 Sev=Info/4 CM/0x63100004 Establish secure connection using Ethernet 16 06:10:35.316 09/26/06 Sev=Info/4 CM/0x63100024 Attempt connection with server "usvgw3.emc.com" 17 06:10:35.326 09/26/06 Sev=Info/6 CM/0x6310002F Allocated local TCP port 1292 for TCP connection. 18 06:10:36.128 09/26/06 Sev=Info/4 IPSEC/0x63700008 IPSec driver successfully started 19 06:10:36.128 09/26/06 Sev=Info/4 IPSEC/0x63700014 Deleted all keys 20 06:10:36.128 09/26/06 Sev=Info/6 IPSEC/0x6370001F TCP SYN sent to 137.69.115.15, src port 1292, dst port 4005 21 06:10:36.128 09/26/06 Sev=Info/6 IPSEC/0x6370001C TCP SYN-ACK received from 137.69.115.15, src port 4005, dst port 1292 22 06:10:36.128 09/26/06 Sev=Info/6 IPSEC/0x63700020 TCP ACK sent to 137.69.115.15, src port 1292, dst port 4005 23 06:10:36.128 09/26/06 Sev=Info/4 CM/0x63100029 TCP connection established on port 4005 with server "usvgw3.emc.com" 24 06:10:36.628 09/26/06 Sev=Info/4 CM/0x63100024 Attempt connection with server "usvgw3.emc.com" 25 06:10:36.648 09/26/06 Sev=Info/6 IKE/0x6300003B Attempting to establish a connection with 137.69.115.15. 26 06:10:36.678 09/26/06 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK AG (SA, KE, NON, ID, VID(Xauth), VID(dpd), VID(Unity)) to 137.69.115.15 27 06:10:36.849 09/26/06 Sev=Info/5 IKE/0x6300002F Received ISAKMP packet: peer = 137.69.115.15 28 06:10:36.849 09/26/06 Sev=Info/4 IKE/0x63000014 RECEIVING <<< ISAKMP OAK AG (SA, KE, NON, ID, HASH, VID(Unity), VID(Xauth), VID(dpd), VID(Frag), VID(?), VID(?)) from 137.69.115.15 29 06:10:36.849 09/26/06 Sev=Info/5 IKE/0x63000001 Peer is a Cisco-Unity compliant peer 30 06:10:36.849 09/26/06 Sev=Info/5 IKE/0x63000001 Peer supports XAUTH 31 06:10:36.849 09/26/06 Sev=Info/5 IKE/0x63000001 Peer supports DPD 32 06:10:36.849 09/26/06 Sev=Info/5 IKE/0x63000001 Peer supports DWR Code and DWR Text 33 06:10:36.859 09/26/06 Sev=Info/6 IKE/0x63000001 IOS Vendor ID Contruction successful 34 06:10:36.859 09/26/06 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK AG *(HASH, NOTIFY:STATUS_INITIAL_CONTACT, VID(?), VID(Unity)) to 137.69.115.15 35 06:10:36.859 09/26/06 Sev=Info/4 IKE/0x63000082 IKE Port in use - Local Port = 0x01F4, Remote Port = 0x01F4 36 06:10:36.859 09/26/06 Sev=Info/4 CM/0x6310000E Established Phase 1 SA. 1 Crypto Active IKE SA, 0 User Authenticated IKE SA in the system 37 06:10:36.889 09/26/06 Sev=Info/5 IKE/0x6300002F Received ISAKMP packet: peer = 137.69.115.15 38 06:10:36.889 09/26/06 Sev=Info/4 IKE/0x63000014 RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:LOAD_BALANCE) from 137.69.115.15 39 06:10:36.889 09/26/06 Sev=Info/4 CM/0x6310001B Received alternative server address "137.69.115.16" from primary server 40 06:10:36.889 09/26/06 Sev=Info/4 IKE/0x63000017 Marking IKE SA for deletion (I_Cookie=A0D3560833598862 R_Cookie=C3D2E1A6238873C4) reason = DEL_REASON_LOAD_BALANCING 41 06:10:36.889 09/26/06 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK INFO *(HASH, DWR) to 137.69.115.15 42 06:10:37.630 09/26/06 Sev=Info/4 IKE/0x6300004A Discarding IKE SA negotiation (I_Cookie=A0D3560833598862 R_Cookie=C3D2E1A6238873C4) reason = DEL_REASON_LOAD_BALANCING 43 06:10:37.630 09/26/06 Sev=Info/4 CM/0x63100014 Unable to establish Phase 1 SA with server "usvgw3.emc.com" because of "DEL_REASON_LOAD_BALANCING" 44 06:10:37.630 09/26/06 Sev=Info/4 CM/0x63100010 Try alternative server "137.69.115.16" given by the primary server 45 06:10:37.630 09/26/06 Sev=Info/4 CM/0x63100024 Attempt connection with server "137.69.115.16" 46 06:10:37.630 09/26/06 Sev=Info/4 CM/0x6310002D Resetting TCP connection on port 4005 47 06:10:38.130 09/26/06 Sev=Info/6 IPSEC/0x63700022 TCP RST sent to 137.69.115.15, src port 1292, dst port 4005 48 06:10:38.130 09/26/06 Sev=Info/6 IPSEC/0x6370001F TCP SYN sent to 137.69.115.16, src port 1292, dst port 4005 49 06:10:38.130 09/26/06 Sev=Info/6 IPSEC/0x6370001C TCP SYN-ACK received from 137.69.115.16, src port 4005, dst port 1292 50 06:10:38.130 09/26/06 Sev=Info/6 IPSEC/0x63700020 TCP ACK sent to 137.69.115.16, src port 1292, dst port 4005 51 06:10:38.130 09/26/06 Sev=Info/4 CM/0x63100029 TCP connection established on port 4005 with server "137.69.115.16" 52 06:10:38.631 09/26/06 Sev=Info/4 CM/0x63100024 Attempt connection with server "137.69.115.16" 53 06:10:38.641 09/26/06 Sev=Info/6 IKE/0x6300003B Attempting to establish a connection with 137.69.115.16. 54 06:10:38.641 09/26/06 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK AG (SA, KE, NON, ID, VID(Xauth), VID(dpd), VID(Unity)) to 137.69.115.16 55 06:10:38.821 09/26/06 Sev=Info/5 IKE/0x6300002F Received ISAKMP packet: peer = 137.69.115.16 56 06:10:38.821 09/26/06 Sev=Info/4 IKE/0x63000014 RECEIVING <<< ISAKMP OAK AG (SA, KE, NON, ID, HASH, VID(Unity), VID(Xauth), VID(dpd), VID(Frag), VID(?), VID(?)) from 137.69.115.16 57 06:10:38.821 09/26/06 Sev=Info/5 IKE/0x63000001 Peer is a Cisco-Unity compliant peer 58 06:10:38.821 09/26/06 Sev=Info/5 IKE/0x63000001 Peer supports XAUTH 59 06:10:38.821 09/26/06 Sev=Info/5 IKE/0x63000001 Peer supports DPD 60 06:10:38.821 09/26/06 Sev=Info/5 IKE/0x63000001 Peer supports DWR Code and DWR Text 61 06:10:38.831 09/26/06 Sev=Info/6 IKE/0x63000001 IOS Vendor ID Contruction successful 62 06:10:38.831 09/26/06 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK AG *(HASH, NOTIFY:STATUS_INITIAL_CONTACT, VID(?), VID(Unity)) to 137.69.115.16 63 06:10:38.831 09/26/06 Sev=Info/4 IKE/0x63000082 IKE Port in use - Local Port = 0x01F4, Remote Port = 0x01F4 64 06:10:38.831 09/26/06 Sev=Info/4 CM/0x6310000E Established Phase 1 SA. 1 Crypto Active IKE SA, 0 User Authenticated IKE SA in the system 65 06:10:38.851 09/26/06 Sev=Info/5 IKE/0x6300002F Received ISAKMP packet: peer = 137.69.115.16 66 06:10:38.851 09/26/06 Sev=Info/4 IKE/0x63000014 RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 137.69.115.16 67 06:10:38.851 09/26/06 Sev=Info/4 CM/0x63100015 Launch xAuth application 68 06:10:54.675 09/26/06 Sev=Info/4 CM/0x63100017 xAuth application returned 69 06:10:54.675 09/26/06 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 137.69.115.16 70 06:10:56.778 09/26/06 Sev=Info/5 IKE/0x6300002F Received ISAKMP packet: peer = 137.69.115.16 71 06:10:56.778 09/26/06 Sev=Info/4 IKE/0x63000014 RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 137.69.115.16 72 06:10:56.778 09/26/06 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 137.69.115.16 73 06:10:56.778 09/26/06 Sev=Info/4 IKE/0x63000017 Marking IKE SA for deletion (I_Cookie=7B18BB8746470DD1 R_Cookie=36FA86C1792D419E) reason = DEL_REASON_WE_FAILED_AUTH 74 06:10:56.778 09/26/06 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK INFO *(HASH, DWR) to 137.69.115.16 75 06:10:56.828 09/26/06 Sev=Info/5 IKE/0x6300002F Received ISAKMP packet: peer = 137.69.115.16 76 06:10:56.828 09/26/06 Sev=Info/4 IKE/0x63000057 Received an ISAKMP message for a non-active SA, I_Cookie=7B18BB8746470DD1 R_Cookie=36FA86C1792D419E 77 06:10:56.828 09/26/06 Sev=Info/4 IKE/0x63000014 RECEIVING <<< ISAKMP OAK INFO *(Dropped) from 137.69.115.16 78 06:10:57.158 09/26/06 Sev=Info/6 IPSEC/0x6370001D TCP RST received from 137.69.115.16, src port 4005, dst port 1292 79 06:10:57.659 09/26/06 Sev=Info/4 IKE/0x6300004A Discarding IKE SA negotiation (I_Cookie=7B18BB8746470DD1 R_Cookie=36FA86C1792D419E) reason = DEL_REASON_WE_FAILED_AUTH 80 06:10:57.659 09/26/06 Sev=Info/4 CM/0x63100014 Unable to establish Phase 1 SA with server "137.69.115.16" because of "DEL_REASON_WE_FAILED_AUTH" 81 06:10:57.659 09/26/06 Sev=Info/5 CM/0x63100025 Initializing CVPNDrv 82 06:10:57.659 09/26/06 Sev=Info/4 CM/0x6310002D Resetting TCP connection on port 4005 83 06:10:57.669 09/26/06 Sev=Info/6 CM/0x63100030 Removed local TCP port 1292 for TCP connection. 84 06:10:57.669 09/26/06 Sev=Info/4 IKE/0x63000001 IKE received signal to terminate VPN connection 85 06:10:57.669 09/26/06 Sev=Info/6 IPSEC/0x63700022 TCP RST sent to 137.69.115.16, src port 1292, dst port 4005 86 06:10:57.669 09/26/06 Sev=Info/4 IPSEC/0x63700014 Deleted all keys 87 06:10:57.669 09/26/06 Sev=Info/4 IPSEC/0x63700014 Deleted all keys 88 06:10:57.669 09/26/06 Sev=Info/4 IPSEC/0x63700014 Deleted all keys 89 06:10:57.669 09/26/06 Sev=Info/4 IPSEC/0x6370000A IPSec driver successfully stopped 90 06:11:02.867 09/26/06 Sev=Info/4 CM/0x63100002 Begin connection process 91 06:11:02.877 09/26/06 Sev=Info/4 CM/0x63100004 Establish secure connection using Ethernet 92 06:11:02.877 09/26/06 Sev=Info/4 CM/0x63100024 Attempt connection with server "usvgw3.emc.com" 93 06:11:02.877 09/26/06 Sev=Info/6 CM/0x6310002F Allocated local TCP port 1302 for TCP connection. 94 06:11:03.177 09/26/06 Sev=Info/4 IPSEC/0x63700008 IPSec driver successfully started 95 06:11:03.177 09/26/06 Sev=Info/4 IPSEC/0x63700014 Deleted all keys 96 06:11:03.177 09/26/06 Sev=Info/6 IPSEC/0x6370002B Sent 8 packets, 0 were fragmented. 97 06:11:03.177 09/26/06 Sev=Info/6 IPSEC/0x6370001F TCP SYN sent to 137.69.115.15, src port 1302, dst port 4005 98 06:11:03.177 09/26/06 Sev=Info/6 IPSEC/0x6370001C TCP SYN-ACK received from 137.69.115.15, src port 4005, dst port 1302 99 06:11:03.177 09/26/06 Sev=Info/6 IPSEC/0x63700020 TCP ACK sent to 137.69.115.15, src port 1302, dst port 4005 100 06:11:03.177 09/26/06 Sev=Info/4 CM/0x63100029 TCP connection established on port 4005 with server "usvgw3.emc.com" 101 06:11:03.678 09/26/06 Sev=Info/4 CM/0x63100024 Attempt connection with server "usvgw3.emc.com" 102 06:11:03.688 09/26/06 Sev=Info/6 IKE/0x6300003B Attempting to establish a connection with 137.69.115.15. 103 06:11:03.698 09/26/06 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK AG (SA, KE, NON, ID, VID(Xauth), VID(dpd), VID(Unity)) to 137.69.115.15 104 06:11:03.888 09/26/06 Sev=Info/5 IKE/0x6300002F Received ISAKMP packet: peer = 137.69.115.15 105 06:11:03.888 09/26/06 Sev=Info/4 IKE/0x63000014 RECEIVING <<< ISAKMP OAK AG (SA, KE, NON, ID, HASH, VID(Unity), VID(Xauth), VID(dpd), VID(Frag), VID(?), VID(?)) from 137.69.115.15 106 06:11:03.888 09/26/06 Sev=Info/5 IKE/0x63000001 Peer is a Cisco-Unity compliant peer 107 06:11:03.888 09/26/06 Sev=Info/5 IKE/0x63000001 Peer supports XAUTH 108 06:11:03.888 09/26/06 Sev=Info/5 IKE/0x63000001 Peer supports DPD 109 06:11:03.888 09/26/06 Sev=Info/5 IKE/0x63000001 Peer supports DWR Code and DWR Text 110 06:11:03.898 09/26/06 Sev=Info/6 IKE/0x63000001 IOS Vendor ID Contruction successful 111 06:11:03.898 09/26/06 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK AG *(HASH, NOTIFY:STATUS_INITIAL_CONTACT, VID(?), VID(Unity)) to 137.69.115.15 112 06:11:03.898 09/26/06 Sev=Info/4 IKE/0x63000082 IKE Port in use - Local Port = 0x01F4, Remote Port = 0x01F4 113 06:11:03.898 09/26/06 Sev=Info/4 CM/0x6310000E Established Phase 1 SA. 1 Crypto Active IKE SA, 0 User Authenticated IKE SA in the system 114 06:11:03.928 09/26/06 Sev=Info/5 IKE/0x6300002F Received ISAKMP packet: peer = 137.69.115.15 115 06:11:03.928 09/26/06 Sev=Info/4 IKE/0x63000014 RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:LOAD_BALANCE) from 137.69.115.15 116 06:11:03.928 09/26/06 Sev=Info/4 CM/0x6310001B Received alternative server address "137.69.115.17" from primary server 117 06:11:03.928 09/26/06 Sev=Info/4 IKE/0x63000017 Marking IKE SA for deletion (I_Cookie=A11DF3403645028C R_Cookie=CD526FAFE90D6374) reason = DEL_REASON_LOAD_BALANCING 118 06:11:03.928 09/26/06 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK INFO *(HASH, DWR) to 137.69.115.15 119 06:11:04.679 09/26/06 Sev=Info/4 IKE/0x6300004A Discarding IKE SA negotiation (I_Cookie=A11DF3403645028C R_Cookie=CD526FAFE90D6374) reason = DEL_REASON_LOAD_BALANCING 120 06:11:04.679 09/26/06 Sev=Info/4 CM/0x63100014 Unable to establish Phase 1 SA with server "usvgw3.emc.com" because of "DEL_REASON_LOAD_BALANCING" 121 06:11:04.679 09/26/06 Sev=Info/4 CM/0x63100010 Try alternative server "137.69.115.17" given by the primary server 122 06:11:04.679 09/26/06 Sev=Info/4 CM/0x63100024 Attempt connection with server "137.69.115.17" 123 06:11:04.679 09/26/06 Sev=Info/4 CM/0x6310002D Resetting TCP connection on port 4005 124 06:11:05.190 09/26/06 Sev=Info/6 IPSEC/0x63700022 TCP RST sent to 137.69.115.15, src port 1302, dst port 4005 125 06:11:05.190 09/26/06 Sev=Info/6 IPSEC/0x6370001F TCP SYN sent to 137.69.115.17, src port 1302, dst port 4005 126 06:11:05.190 09/26/06 Sev=Info/6 IPSEC/0x6370001C TCP SYN-ACK received from 137.69.115.17, src port 4005, dst port 1302 127 06:11:05.190 09/26/06 Sev=Info/6 IPSEC/0x63700020 TCP ACK sent to 137.69.115.17, src port 1302, dst port 4005 128 06:11:05.190 09/26/06 Sev=Info/4 CM/0x63100029 TCP connection established on port 4005 with server "137.69.115.17" 129 06:11:05.681 09/26/06 Sev=Info/4 CM/0x63100024 Attempt connection with server "137.69.115.17" 130 06:11:05.681 09/26/06 Sev=Info/6 IKE/0x6300003B Attempting to establish a connection with 137.69.115.17. 131 06:11:05.691 09/26/06 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK AG (SA, KE, NON, ID, VID(Xauth), VID(dpd), VID(Unity)) to 137.69.115.17 132 06:11:05.861 09/26/06 Sev=Info/5 IKE/0x6300002F Received ISAKMP packet: peer = 137.69.115.17 133 06:11:05.861 09/26/06 Sev=Info/4 IKE/0x63000014 RECEIVING <<< ISAKMP OAK AG (SA, KE, NON, ID, HASH, VID(Unity), VID(Xauth), VID(dpd), VID(Frag), VID(?), VID(?)) from 137.69.115.17 134 06:11:05.861 09/26/06 Sev=Info/5 IKE/0x63000001 Peer is a Cisco-Unity compliant peer 135 06:11:05.861 09/26/06 Sev=Info/5 IKE/0x63000001 Peer supports XAUTH 136 06:11:05.861 09/26/06 Sev=Info/5 IKE/0x63000001 Peer supports DPD 137 06:11:05.861 09/26/06 Sev=Info/5 IKE/0x63000001 Peer supports DWR Code and DWR Text 138 06:11:05.871 09/26/06 Sev=Info/6 IKE/0x63000001 IOS Vendor ID Contruction successful 139 06:11:05.871 09/26/06 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK AG *(HASH, NOTIFY:STATUS_INITIAL_CONTACT, VID(?), VID(Unity)) to 137.69.115.17 140 06:11:05.871 09/26/06 Sev=Info/4 IKE/0x63000082 IKE Port in use - Local Port = 0x01F4, Remote Port = 0x01F4 141 06:11:05.871 09/26/06 Sev=Info/4 CM/0x6310000E Established Phase 1 SA. 1 Crypto Active IKE SA, 0 User Authenticated IKE SA in the system 142 06:11:05.901 09/26/06 Sev=Info/5 IKE/0x6300002F Received ISAKMP packet: peer = 137.69.115.17 143 06:11:05.901 09/26/06 Sev=Info/4 IKE/0x63000014 RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 137.69.115.17 144 06:11:05.901 09/26/06 Sev=Info/4 CM/0x63100015 Launch xAuth application 145 06:11:15.024 09/26/06 Sev=Info/4 CM/0x63100017 xAuth application returned 146 06:11:15.024 09/26/06 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 137.69.115.17 147 06:11:17.348 09/26/06 Sev=Info/5 IKE/0x6300002F Received ISAKMP packet: peer = 137.69.115.17 148 06:11:17.348 09/26/06 Sev=Info/4 IKE/0x63000014 RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 137.69.115.17 149 06:11:17.348 09/26/06 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 137.69.115.17 150 06:11:17.348 09/26/06 Sev=Info/4 CM/0x6310000E Established Phase 1 SA. 1 Crypto Active IKE SA, 1 User Authenticated IKE SA in the system 151 06:11:17.408 09/26/06 Sev=Info/5 IKE/0x6300005D Client sending a firewall request to concentrator 152 06:11:17.408 09/26/06 Sev=Info/5 IKE/0x6300005C Firewall Policy: Product=Cisco Systems Integrated Client, Capability= (Centralized Protection Policy). 153 06:11:17.408 09/26/06 Sev=Info/5 IKE/0x6300005C Firewall Policy: Product=NetworkICE BlackICE Defender, Capability= (Are you There?). 154 06:11:17.408 09/26/06 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 137.69.115.17 155 06:11:18.359 09/26/06 Sev=Info/5 IKE/0x6300002F Received ISAKMP packet: peer = 137.69.115.17 156 06:11:18.359 09/26/06 Sev=Info/4 IKE/0x63000014 RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 137.69.115.17 157 06:11:18.359 09/26/06 Sev=Info/5 IKE/0x63000010 MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_ADDRESS: , value = 10.13.32.100 158 06:11:18.359 09/26/06 Sev=Info/5 IKE/0x63000010 MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_NETMASK: , value = 255.255.192.0 159 06:11:18.359 09/26/06 Sev=Info/5 IKE/0x63000010 MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS(1): , value = 137.69.224.15 160 06:11:18.359 09/26/06 Sev=Info/5 IKE/0x63000010 MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS(2): , value = 128.221.12.10 161 06:11:18.359 09/26/06 Sev=Info/5 IKE/0x63000010 MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_NBNS(1) (a.k.a. WINS) : , value = 128.221.12.10 162 06:11:18.359 09/26/06 Sev=Info/5 IKE/0x63000010 MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_NBNS(2) (a.k.a. WINS) : , value = 128.222.67.10 163 06:11:18.359 09/26/06 Sev=Info/5 IKE/0x6300000E MODE_CFG_REPLY: Attribute = MODECFG_UNITY_BANNER, value = ************** EMC Americas West Coast VPN Gateway ************** ATTENTION!!! If you are running a VPN Client version other than 4.6, you must upgrade as soon as possible. Check the title bar of your VPN Dialer application. If it does not start with VPN Dialer-Version 4.6, disconnect from VPN now and visit http://vpndist.emc.com. Download and install "DTP3.6-VPN4.6.EXE". 164 06:11:18.359 09/26/06 Sev=Info/5 IKE/0x6300000D MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SAVEPWD: , value = 0x00000000 165 06:11:18.359 09/26/06 Sev=Info/5 IKE/0x6300000E MODE_CFG_REPLY: Attribute = MODECFG_UNITY_DEFDOMAIN: , value = corp.emc.com 166 06:11:18.359 09/26/06 Sev=Info/5 IKE/0x6300000D MODE_CFG_REPLY: Attribute = MODECFG_UNITY_PFS: , value = 0x00000000 167 06:11:18.359 09/26/06 Sev=Info/5 IKE/0x6300000E MODE_CFG_REPLY: Attribute = APPLICATION_VERSION, value = Cisco Systems, Inc./VPN 3000 Concentrator Version 4.7.2.B built by vmurphy on Oct 04 2005 02:50:52 168 06:11:18.359 09/26/06 Sev=Info/5 IKE/0x6300000D MODE_CFG_REPLY: Attribute = MODECFG_UNITY_INCLUDE_LOCAL_LAN (# of local_nets), value = 0x00000001 169 06:11:18.359 09/26/06 Sev=Info/5 IKE/0x6300000F LOCAL_NET #1 subnet = 192.168.1.0 mask = 255.255.255.0 protocol = 0 src port = 0 dest port=0 170 06:11:18.359 09/26/06 Sev=Info/4 CM/0x63100019 Mode Config data received 171 06:11:18.359 09/26/06 Sev=Info/4 IKE/0x63000055 Received a key request from Driver: Local IP = 10.13.32.100, GW IP = 137.69.115.17, Remote IP = 0.0.0.0 172 06:11:18.359 09/26/06 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK QM *(HASH, SA, NON, ID, ID) to 137.69.115.17 173 06:11:18.429 09/26/06 Sev=Info/5 IKE/0x6300002F Received ISAKMP packet: peer = 137.69.115.17 174 06:11:18.429 09/26/06 Sev=Info/4 IKE/0x63000014 RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:STATUS_RESP_LIFETIME) from 137.69.115.17 175 06:11:18.429 09/26/06 Sev=Info/5 IKE/0x63000044 RESPONDER-LIFETIME notify has value of 86400 seconds 176 06:11:18.429 09/26/06 Sev=Info/5 IKE/0x63000046 This SA has already been alive for 13 seconds, setting expiry to 86387 seconds from now 177 06:11:18.429 09/26/06 Sev=Info/5 IKE/0x6300002F Received ISAKMP packet: peer = 137.69.115.17 178 06:11:18.429 09/26/06 Sev=Info/4 IKE/0x63000014 RECEIVING <<< ISAKMP OAK QM *(HASH, SA, NON, ID, ID, NOTIFY:STATUS_RESP_LIFETIME) from 137.69.115.17 179 06:11:18.429 09/26/06 Sev=Info/5 IKE/0x63000044 RESPONDER-LIFETIME notify has value of 28800 seconds 180 06:11:18.429 09/26/06 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK QM *(HASH) to 137.69.115.17 181 06:11:18.429 09/26/06 Sev=Info/5 IKE/0x63000058 Loading IPsec SA (MsgID=39938141 OUTBOUND SPI = 0x0761A648 INBOUND SPI = 0xC5430292) 182 06:11:18.429 09/26/06 Sev=Info/5 IKE/0x63000025 Loaded OUTBOUND ESP SPI: 0x0761A648 183 06:11:18.429 09/26/06 Sev=Info/5 IKE/0x63000026 Loaded INBOUND ESP SPI: 0xC5430292 184 06:11:21.333 09/26/06 Sev=Info/4 CM/0x63100034 The Virtual Adapter was enabled: IP=10.13.32.100/255.255.192.0 DNS=137.69.224.15,128.221.12.10 WINS=128.221.12.10,128.222.67.10 Domain=corp.emc.com Split DNS Names= 185 06:11:21.373 09/26/06 Sev=Info/6 CM/0x63100036 The routing table was updated for the Virtual Adapter 186 06:11:21.514 09/26/06 Sev=Info/4 CM/0x6310001A One secure connection established 187 06:11:21.544 09/26/06 Sev=Info/4 CM/0x63100038 Address watch added for 192.168.1.2. Current address(es): 192.168.1.2, 10.13.32.100. 188 06:11:21.544 09/26/06 Sev=Info/4 CM/0x63100038 Address watch added for 10.13.32.100. Current address(es): 192.168.1.2, 10.13.32.100. 189 06:11:21.664 09/26/06 Sev=Info/4 IPSEC/0x63700014 Deleted all keys 190 06:11:21.664 09/26/06 Sev=Info/6 IPSEC/0x6370002B Sent 8 packets, 0 were fragmented. 191 06:11:21.664 09/26/06 Sev=Info/4 IPSEC/0x63700010 Created a new key structure 192 06:11:21.664 09/26/06 Sev=Info/4 IPSEC/0x6370000F Added key with SPI=0x48a66107 into key list 193 06:11:21.664 09/26/06 Sev=Info/4 IPSEC/0x63700010 Created a new key structure 194 06:11:21.664 09/26/06 Sev=Info/4 IPSEC/0x6370000F Added key with SPI=0x920243c5 into key list 195 06:11:21.664 09/26/06 Sev=Info/4 IPSEC/0x6370002E Assigned VA private interface addr 10.13.32.100 196 06:11:22.205 09/26/06 Sev=Info/4 IPSEC/0x63700019 Activate outbound key with SPI=0x48a66107 for inbound key with SPI=0x920243c5 197 06:16:06.644 09/26/06 Sev=Info/6 IPSEC/0x63700021 TCP heartbeat sent to 137.69.115.17, src port 1302, dst port 4005 198 06:16:23.167 09/26/06 Sev=Info/6 IPSEC/0x63700023 CNIReceiveComplete: Invalid TCP checksum 199 06:16:23.167 09/26/06 Sev=Warning/2 IPSEC/0xE3700010 BSafe ESP Decrypt HMAC mismatch. 200 06:16:23.167 09/26/06 Sev=Warning/2 IPSEC/0xE3700003 Function BSafeESPDecrypt() failed with an error code of 0xffffffff (IpSecDrvTransform.c:1652) 201 06:21:08.127 09/26/06 Sev=Info/6 IPSEC/0x63700021 TCP heartbeat sent to 137.69.115.17, src port 1302, dst port 4005 202 06:26:08.128 09/26/06 Sev=Info/6 IPSEC/0x63700021 TCP heartbeat sent to 137.69.115.17, src port 1302, dst port 4005 203 06:31:08.600 09/26/06 Sev=Info/6 IPSEC/0x63700021 TCP heartbeat sent to 137.69.115.17, src port 1302, dst port 4005 204 06:36:09.032 09/26/06 Sev=Info/6 IPSEC/0x63700021 TCP heartbeat sent to 137.69.115.17, src port 1302, dst port 4005 205 06:41:09.505 09/26/06 Sev=Info/6 IPSEC/0x63700021 TCP heartbeat sent to 137.69.115.17, src port 1302, dst port 4005 206 06:46:09.987 09/26/06 Sev=Info/6 IPSEC/0x63700021 TCP heartbeat sent to 137.69.115.17, src port 1302, dst port 4005 207 06:51:09.988 09/26/06 Sev=Info/6 IPSEC/0x63700021 TCP heartbeat sent to 137.69.115.17, src port 1302, dst port 4005 208 06:56:10.430 09/26/06 Sev=Info/6 IPSEC/0x63700021 TCP heartbeat sent to 137.69.115.17, src port 1302, dst port 4005 209 07:01:10.812 09/26/06 Sev=Info/6 IPSEC/0x63700021 TCP heartbeat sent to 137.69.115.17, src port 1302, dst port 4005 210 07:01:18.323 09/26/06 Sev=Info/6 IPSEC/0x63700023 CNIReceiveComplete: Invalid TCP checksum 211 07:01:18.323 09/26/06 Sev=Warning/2 IPSEC/0xE3700010 BSafe ESP Decrypt HMAC mismatch. 212 07:01:18.323 09/26/06 Sev=Warning/2 IPSEC/0xE3700003 Function BSafeESPDecrypt() failed with an error code of 0xffffffff (IpSecDrvTransform.c:1652) 213 07:06:10.813 09/26/06 Sev=Info/6 IPSEC/0x63700021 TCP heartbeat sent to 137.69.115.17, src port 1302, dst port 4005 214 07:11:11.776 09/26/06 Sev=Info/6 IPSEC/0x63700021 TCP heartbeat sent to 137.69.115.17, src port 1302, dst port 4005 215 07:16:11.717 09/26/06 Sev=Info/6 IPSEC/0x63700021 TCP heartbeat sent to 137.69.115.17, src port 1302, dst port 4005 216 07:21:12.189 09/26/06 Sev=Info/6 IPSEC/0x63700021 TCP heartbeat sent to 137.69.115.17, src port 1302, dst port 4005 217 07:23:03.349 09/26/06 Sev=Info/6 IPSEC/0x63700023 CNIReceiveComplete: Invalid TCP checksum 218 07:23:03.349 09/26/06 Sev=Warning/2 IPSEC/0xE3700010 BSafe ESP Decrypt HMAC mismatch. 219 07:23:03.349 09/26/06 Sev=Warning/2 IPSEC/0xE3700003 Function BSafeESPDecrypt() failed with an error code of 0xffffffff (IpSecDrvTransform.c:1652) 220 07:26:13.132 09/26/06 Sev=Info/6 IPSEC/0x63700021 TCP heartbeat sent to 137.69.115.17, src port 1302, dst port 4005 221 07:31:13.574 09/26/06 Sev=Info/6 IPSEC/0x63700021 TCP heartbeat sent to 137.69.115.17, src port 1302, dst port 4005 222 07:36:13.535 09/26/06 Sev=Info/6 IPSEC/0x63700021 TCP heartbeat sent to 137.69.115.17, src port 1302, dst port 4005 223 07:40:23.895 09/26/06 Sev=Info/4 IPSEC/0x63700005 Packet size greater than ip header 224 07:40:23.895 09/26/06 Sev=Info/6 IPSEC/0x63700023 CNIReceiveComplete: Invalid TCP checksum 225 07:40:23.895 09/26/06 Sev=Warning/3 IPSEC/0xA370001C Bad cTCP trailer, Rsvd 32541, Magic# dd53fbb0h, trailer len 198, MajorVer 188, MinorVer 152 226 07:41:13.967 09/26/06 Sev=Info/6 IPSEC/0x63700021 TCP heartbeat sent to 137.69.115.17, src port 1302, dst port 4005 227 07:46:14.399 09/26/06 Sev=Info/6 IPSEC/0x63700021 TCP heartbeat sent to 137.69.115.17, src port 1302, dst port 4005 228 07:51:14.831 09/26/06 Sev=Info/6 IPSEC/0x63700021 TCP heartbeat sent to 137.69.115.17, src port 1302, dst port 4005 229 07:56:10.266 09/26/06 Sev=Info/4 IPSEC/0x63700005 Packet size greater than ip header 230 07:56:10.266 09/26/06 Sev=Info/6 IPSEC/0x63700023 CNIReceiveComplete: Invalid TCP checksum 231 07:56:10.266 09/26/06 Sev=Warning/3 IPSEC/0xA370001C Bad cTCP trailer, Rsvd 37182, Magic# 18312a24h, trailer len 230, MajorVer 52, MinorVer 33 232 07:56:15.273 09/26/06 Sev=Info/6 IPSEC/0x63700021 TCP heartbeat sent to 137.69.115.17, src port 1302, dst port 4005 233 08:01:15.465 09/26/06 Sev=Info/6 IPSEC/0x63700021 TCP heartbeat sent to 137.69.115.17, src port 1302, dst port 4005 234 08:06:15.897 09/26/06 Sev=Info/6 IPSEC/0x63700021 TCP heartbeat sent to 137.69.115.17, src port 1302, dst port 4005 235 08:11:16.329 09/26/06 Sev=Info/6 IPSEC/0x63700021 TCP heartbeat sent to 137.69.115.17, src port 1302, dst port 4005 236 08:16:16.761 09/26/06 Sev=Info/6 IPSEC/0x63700021 TCP heartbeat sent to 137.69.115.17, src port 1302, dst port 4005 237 08:21:17.193 09/26/06 Sev=Info/6 IPSEC/0x63700021 TCP heartbeat sent to 137.69.115.17, src port 1302, dst port 4005 238 08:26:17.625 09/26/06 Sev=Info/6 IPSEC/0x63700021 TCP heartbeat sent to 137.69.115.17, src port 1302, dst port 4005 239 08:31:18.057 09/26/06 Sev=Info/6 IPSEC/0x63700021 TCP heartbeat sent to 137.69.115.17, src port 1302, dst port 4005 240 08:36:18.489 09/26/06 Sev=Info/6 IPSEC/0x63700021 TCP heartbeat sent to 137.69.115.17, src port 1302, dst port 4005 241 08:41:19.452 09/26/06 Sev=Info/6 IPSEC/0x63700021 TCP heartbeat sent to 137.69.115.17, src port 1302, dst port 4005 242 08:44:11.219 09/26/06 Sev=Info/4 IPSEC/0x63700005 Packet size greater than ip header 243 08:44:11.219 09/26/06 Sev=Info/6 IPSEC/0x63700023 CNIReceiveComplete: Invalid TCP checksum 244 08:44:11.219 09/26/06 Sev=Warning/3 IPSEC/0xA370001C Bad cTCP trailer, Rsvd 16249, Magic# 891dd625h, trailer len 183, MajorVer 146, MinorVer 88 245 08:44:22.395 09/26/06 Sev=Info/6 IPSEC/0x63700023 CNIReceiveComplete: Invalid TCP checksum 246 08:46:19.413 09/26/06 Sev=Info/6 IPSEC/0x63700021 TCP heartbeat sent to 137.69.115.17, src port 1302, dst port 4005 247 08:51:19.875 09/26/06 Sev=Info/6 IPSEC/0x63700021 TCP heartbeat sent to 137.69.115.17, src port 1302, dst port 4005 248 08:56:20.367 09/26/06 Sev=Info/6 IPSEC/0x63700021 TCP heartbeat sent to 137.69.115.17, src port 1302, dst port 4005 249 09:01:20.829 09/26/06 Sev=Info/6 IPSEC/0x63700021 TCP heartbeat sent to 137.69.115.17, src port 1302, dst port 4005 250 09:02:38.411 09/26/06 Sev=Info/4 CM/0x6310000A Secure connections terminated 251 09:02:38.411 09/26/06 Sev=Info/4 IKE/0x63000001 IKE received signal to terminate VPN connection 252 09:02:38.411 09/26/06 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK INFO *(HASH, DEL) to 137.69.115.17 253 09:02:38.411 09/26/06 Sev=Info/5 IKE/0x63000018 Deleting IPsec SA: (OUTBOUND SPI = 761A648 INBOUND SPI = C5430292) 254 09:02:38.411 09/26/06 Sev=Info/4 IKE/0x63000048 Discarding IPsec SA negotiation, MsgID=39938141 255 09:02:38.411 09/26/06 Sev=Info/4 IKE/0x63000017 Marking IKE SA for deletion (I_Cookie=FC358DE7E0A8A827 R_Cookie=946A8621554E7B76) reason = DEL_REASON_RESET_SADB 256 09:02:38.411 09/26/06 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK INFO *(HASH, DWR) to 137.69.115.17 257 09:02:38.411 09/26/06 Sev=Info/4 IKE/0x6300004A Discarding IKE SA negotiation (I_Cookie=FC358DE7E0A8A827 R_Cookie=946A8621554E7B76) reason = DEL_REASON_RESET_SADB 258 09:02:38.411 09/26/06 Sev=Info/4 CM/0x63100013 Phase 1 SA deleted cause by DEL_REASON_RESET_SADB. 0 Crypto Active IKE SA, 0 User Authenticated IKE SA in the system 259 09:02:38.421 09/26/06 Sev=Info/5 CM/0x63100025 Initializing CVPNDrv 260 09:02:38.421 09/26/06 Sev=Info/4 CM/0x6310002D Resetting TCP connection on port 4005 261 09:02:38.421 09/26/06 Sev=Info/6 CM/0x63100030 Removed local TCP port 1302 for TCP connection. 262 09:02:38.421 09/26/06 Sev=Info/6 CM/0x63100031 Tunnel to headend device 137.69.115.17 disconnected: duration: 0 days 2:51:17 263 09:02:38.431 09/26/06 Sev=Info/6 CM/0x63100037 The routing table was returned to orginal state prior to Virtual Adapter 264 09:02:40.644 09/26/06 Sev=Info/4 CM/0x63100035 The Virtual Adapter was disabled 265 09:02:40.644 09/26/06 Sev=Info/5 CM/0x63100025 Initializing CVPNDrv 266 09:02:40.644 09/26/06 Sev=Info/4 IPSEC/0x63700013 Delete internal key with SPI=0x920243c5 267 09:02:40.644 09/26/06 Sev=Info/4 IPSEC/0x6370000C Key deleted by SPI 0x920243c5 268 09:02:40.644 09/26/06 Sev=Info/4 IPSEC/0x63700013 Delete internal key with SPI=0x48a66107 269 09:02:40.644 09/26/06 Sev=Info/4 IPSEC/0x6370000C Key deleted by SPI 0x48a66107 270 09:02:40.644 09/26/06 Sev=Info/6 IPSEC/0x63700022 TCP RST sent to 137.69.115.17, src port 1302, dst port 4005 271 09:02:40.644 09/26/06 Sev=Info/4 IPSEC/0x63700014 Deleted all keys 272 09:02:40.644 09/26/06 Sev=Info/4 IPSEC/0x63700014 Deleted all keys 273 09:02:40.644 09/26/06 Sev=Info/4 IPSEC/0x6370000A IPSec driver successfully stopped 274 09:02:40.644 09/26/06 Sev=Info/4 IPSEC/0x63700014 Deleted all keys