EMC VPN Dialer Version 4.6.00.0045 Copyright (C) 1998-2004 Cisco Systems, Inc. All Rights Reserved. Client Type(s): Windows, WinNT Running on: 5.1.2600 Service Pack 2 Config file directory: C:\Program Files\EMC VPN\VPN Client 1 02:38:49.907 08/17/07 Sev=Info/4 CM/0x63100002 Begin connection process 2 02:38:49.917 08/17/07 Sev=Info/4 CM/0x63100004 Establish secure connection using Ethernet 3 02:38:49.917 08/17/07 Sev=Info/4 CM/0x63100024 Attempt connection with server "usvgw3.emc.com" 4 02:38:49.947 08/17/07 Sev=Info/6 CM/0x6310002F Allocated local TCP port 2166 for TCP connection. 5 02:38:50.127 08/17/07 Sev=Info/4 IPSEC/0x63700008 IPSec driver successfully started 6 02:38:50.127 08/17/07 Sev=Info/4 IPSEC/0x63700014 Deleted all keys 7 02:38:50.127 08/17/07 Sev=Info/6 IPSEC/0x6370002B Sent 2670 packets, 0 were fragmented. 8 02:38:50.127 08/17/07 Sev=Info/6 IPSEC/0x6370001F TCP SYN sent to 137.69.115.15, src port 2166, dst port 4005 9 02:38:50.127 08/17/07 Sev=Info/6 IPSEC/0x6370001C TCP SYN-ACK received from 137.69.115.15, src port 4005, dst port 2166 10 02:38:50.127 08/17/07 Sev=Info/6 IPSEC/0x63700020 TCP ACK sent to 137.69.115.15, src port 2166, dst port 4005 11 02:38:50.127 08/17/07 Sev=Info/4 CM/0x63100029 TCP connection established on port 4005 with server "usvgw3.emc.com" 12 02:38:50.628 08/17/07 Sev=Info/4 CM/0x63100024 Attempt connection with server "usvgw3.emc.com" 13 02:38:50.648 08/17/07 Sev=Info/6 IKE/0x6300003B Attempting to establish a connection with 137.69.115.15. 14 02:38:50.678 08/17/07 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK AG (SA, KE, NON, ID, VID(Xauth), VID(dpd), VID(Unity)) to 137.69.115.15 15 02:38:50.858 08/17/07 Sev=Info/5 IKE/0x6300002F Received ISAKMP packet: peer = 137.69.115.15 16 02:38:50.858 08/17/07 Sev=Info/4 IKE/0x63000014 RECEIVING <<< ISAKMP OAK AG (SA, KE, NON, ID, HASH, VID(Unity), VID(Xauth), VID(dpd), VID(Frag), VID(?), VID(?)) from 137.69.115.15 17 02:38:50.858 08/17/07 Sev=Info/5 IKE/0x63000001 Peer is a Cisco-Unity compliant peer 18 02:38:50.858 08/17/07 Sev=Info/5 IKE/0x63000001 Peer supports XAUTH 19 02:38:50.858 08/17/07 Sev=Info/5 IKE/0x63000001 Peer supports DPD 20 02:38:50.858 08/17/07 Sev=Info/5 IKE/0x63000001 Peer supports DWR Code and DWR Text 21 02:38:50.878 08/17/07 Sev=Info/6 IKE/0x63000001 IOS Vendor ID Contruction successful 22 02:38:50.878 08/17/07 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK AG *(HASH, NOTIFY:STATUS_INITIAL_CONTACT, VID(?), VID(Unity)) to 137.69.115.15 23 02:38:50.878 08/17/07 Sev=Info/4 IKE/0x63000082 IKE Port in use - Local Port = 0x01F4, Remote Port = 0x01F4 24 02:38:50.888 08/17/07 Sev=Info/4 CM/0x6310000E Established Phase 1 SA. 1 Crypto Active IKE SA, 0 User Authenticated IKE SA in the system 25 02:38:50.919 08/17/07 Sev=Info/5 IKE/0x6300002F Received ISAKMP packet: peer = 137.69.115.15 26 02:38:50.919 08/17/07 Sev=Info/4 IKE/0x63000014 RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:LOAD_BALANCE) from 137.69.115.15 27 02:38:50.919 08/17/07 Sev=Info/4 CM/0x6310001B Received alternative server address "137.69.115.16" from primary server 28 02:38:50.929 08/17/07 Sev=Info/4 IKE/0x63000017 Marking IKE SA for deletion (I_Cookie=26CA894170D5917A R_Cookie=5136BDCB67E7B3C4) reason = DEL_REASON_LOAD_BALANCING 29 02:38:50.929 08/17/07 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK INFO *(HASH, DWR) to 137.69.115.15 30 02:38:51.630 08/17/07 Sev=Info/4 IKE/0x6300004A Discarding IKE SA negotiation (I_Cookie=26CA894170D5917A R_Cookie=5136BDCB67E7B3C4) reason = DEL_REASON_LOAD_BALANCING 31 02:38:51.630 08/17/07 Sev=Info/4 CM/0x63100014 Unable to establish Phase 1 SA with server "usvgw3.emc.com" because of "DEL_REASON_LOAD_BALANCING" 32 02:38:51.630 08/17/07 Sev=Info/4 CM/0x63100010 Try alternative server "137.69.115.16" given by the primary server 33 02:38:51.630 08/17/07 Sev=Info/4 CM/0x63100024 Attempt connection with server "137.69.115.16" 34 02:38:51.640 08/17/07 Sev=Info/4 CM/0x6310002D Resetting TCP connection on port 4005 35 02:38:52.130 08/17/07 Sev=Info/6 IPSEC/0x63700022 TCP RST sent to 137.69.115.15, src port 2166, dst port 4005 36 02:38:52.130 08/17/07 Sev=Info/6 IPSEC/0x6370001F TCP SYN sent to 137.69.115.16, src port 2166, dst port 4005 37 02:38:52.130 08/17/07 Sev=Info/6 IPSEC/0x6370001C TCP SYN-ACK received from 137.69.115.16, src port 4005, dst port 2166 38 02:38:52.130 08/17/07 Sev=Info/6 IPSEC/0x63700020 TCP ACK sent to 137.69.115.16, src port 2166, dst port 4005 39 02:38:52.130 08/17/07 Sev=Info/4 CM/0x63100029 TCP connection established on port 4005 with server "137.69.115.16" 40 02:38:52.631 08/17/07 Sev=Info/4 CM/0x63100024 Attempt connection with server "137.69.115.16" 41 02:38:52.671 08/17/07 Sev=Info/6 IKE/0x6300003B Attempting to establish a connection with 137.69.115.16. 42 02:38:52.691 08/17/07 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK AG (SA, KE, NON, ID, VID(Xauth), VID(dpd), VID(Unity)) to 137.69.115.16 43 02:38:52.871 08/17/07 Sev=Info/5 IKE/0x6300002F Received ISAKMP packet: peer = 137.69.115.16 44 02:38:52.871 08/17/07 Sev=Info/4 IKE/0x63000014 RECEIVING <<< ISAKMP OAK AG (SA, KE, NON, ID, HASH, VID(Unity), VID(Xauth), VID(dpd), VID(Frag), VID(?), VID(?)) from 137.69.115.16 45 02:38:52.871 08/17/07 Sev=Info/5 IKE/0x63000001 Peer is a Cisco-Unity compliant peer 46 02:38:52.871 08/17/07 Sev=Info/5 IKE/0x63000001 Peer supports XAUTH 47 02:38:52.871 08/17/07 Sev=Info/5 IKE/0x63000001 Peer supports DPD 48 02:38:52.871 08/17/07 Sev=Info/5 IKE/0x63000001 Peer supports DWR Code and DWR Text 49 02:38:52.891 08/17/07 Sev=Info/6 IKE/0x63000001 IOS Vendor ID Contruction successful 50 02:38:52.891 08/17/07 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK AG *(HASH, NOTIFY:STATUS_INITIAL_CONTACT, VID(?), VID(Unity)) to 137.69.115.16 51 02:38:52.891 08/17/07 Sev=Info/4 IKE/0x63000082 IKE Port in use - Local Port = 0x01F4, Remote Port = 0x01F4 52 02:38:52.891 08/17/07 Sev=Info/4 CM/0x6310000E Established Phase 1 SA. 1 Crypto Active IKE SA, 0 User Authenticated IKE SA in the system 53 02:38:52.941 08/17/07 Sev=Info/5 IKE/0x6300002F Received ISAKMP packet: peer = 137.69.115.16 54 02:38:52.941 08/17/07 Sev=Info/4 IKE/0x63000014 RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 137.69.115.16 55 02:38:52.941 08/17/07 Sev=Info/4 CM/0x63100015 Launch xAuth application 56 02:39:07.522 08/17/07 Sev=Info/4 CM/0x63100017 xAuth application returned 57 02:39:07.522 08/17/07 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 137.69.115.16 58 02:39:09.906 08/17/07 Sev=Info/5 IKE/0x6300002F Received ISAKMP packet: peer = 137.69.115.16 59 02:39:09.906 08/17/07 Sev=Info/4 IKE/0x63000014 RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 137.69.115.16 60 02:39:09.906 08/17/07 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 137.69.115.16 61 02:39:09.906 08/17/07 Sev=Info/4 CM/0x6310000E Established Phase 1 SA. 1 Crypto Active IKE SA, 1 User Authenticated IKE SA in the system 62 02:39:09.956 08/17/07 Sev=Info/5 IKE/0x6300005D Client sending a firewall request to concentrator 63 02:39:09.956 08/17/07 Sev=Info/5 IKE/0x6300005C Firewall Policy: Product=Cisco Systems Integrated Client, Capability= (Centralized Protection Policy). 64 02:39:09.956 08/17/07 Sev=Info/5 IKE/0x6300005C Firewall Policy: Product=NetworkICE BlackICE Defender, Capability= (Are you There?). 65 02:39:09.956 08/17/07 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 137.69.115.16 66 02:39:15.163 08/17/07 Sev=Info/4 IKE/0x63000021 Retransmitting last packet! 67 02:39:15.163 08/17/07 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK TRANS *(Retransmission) to 137.69.115.16 68 02:39:17.897 08/17/07 Sev=Info/5 IKE/0x6300002F Received ISAKMP packet: peer = 137.69.115.16 69 02:39:17.897 08/17/07 Sev=Info/4 IKE/0x63000014 RECEIVING <<< ISAKMP OAK TRANS *(Retransmission) from 137.69.115.16 70 02:39:17.897 08/17/07 Sev=Info/4 IKE/0x63000021 Retransmitting last packet! 71 02:39:17.897 08/17/07 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK TRANS *(Retransmission) to 137.69.115.16 72 02:39:18.799 08/17/07 Sev=Info/5 IKE/0x6300002F Received ISAKMP packet: peer = 137.69.115.16 73 02:39:18.799 08/17/07 Sev=Info/4 IKE/0x63000014 RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 137.69.115.16 74 02:39:18.799 08/17/07 Sev=Info/5 IKE/0x63000010 MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_ADDRESS: , value = 10.13.6.56 75 02:39:18.799 08/17/07 Sev=Info/5 IKE/0x63000010 MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_NETMASK: , value = 255.255.192.0 76 02:39:18.799 08/17/07 Sev=Info/5 IKE/0x63000010 MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS(1): , value = 137.69.224.15 77 02:39:18.799 08/17/07 Sev=Info/5 IKE/0x63000010 MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS(2): , value = 128.221.12.10 78 02:39:18.799 08/17/07 Sev=Info/5 IKE/0x63000010 MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_NBNS(1) (a.k.a. WINS) : , value = 128.221.12.10 79 02:39:18.799 08/17/07 Sev=Info/5 IKE/0x63000010 MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_NBNS(2) (a.k.a. WINS) : , value = 128.222.67.10 80 02:39:18.799 08/17/07 Sev=Info/5 IKE/0x6300000E MODE_CFG_REPLY: Attribute = MODECFG_UNITY_BANNER, value = ************** EMC Americas West Coast VPN Gateway ************** ATTENTION!!! If you are running a VPN Client version other than 4.6, you must upgrade as soon as possible. Check the title bar of your VPN Dialer application. If it does not start with VPN Dialer-Version 4.6, disconnect from VPN now and visit http://vpndist.emc.com. Download and install "DTP3.6-VPN4.6.EXE". 81 02:39:18.799 08/17/07 Sev=Info/5 IKE/0x6300000D MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SAVEPWD: , value = 0x00000000 82 02:39:18.799 08/17/07 Sev=Info/5 IKE/0x6300000E MODE_CFG_REPLY: Attribute = MODECFG_UNITY_DEFDOMAIN: , value = corp.emc.com 83 02:39:18.799 08/17/07 Sev=Info/5 IKE/0x6300000D MODE_CFG_REPLY: Attribute = MODECFG_UNITY_PFS: , value = 0x00000000 84 02:39:18.799 08/17/07 Sev=Info/5 IKE/0x6300000E MODE_CFG_REPLY: Attribute = APPLICATION_VERSION, value = Cisco Systems, Inc./VPN 3000 Concentrator Version 4.7.2.B built by vmurphy on Oct 04 2005 02:50:52 85 02:39:18.799 08/17/07 Sev=Info/5 IKE/0x6300000D MODE_CFG_REPLY: Attribute = MODECFG_UNITY_INCLUDE_LOCAL_LAN (# of local_nets), value = 0x00000001 86 02:39:18.799 08/17/07 Sev=Info/5 IKE/0x6300000F LOCAL_NET #1 subnet = 192.168.1.0 mask = 255.255.255.0 protocol = 0 src port = 0 dest port=0 87 02:39:18.799 08/17/07 Sev=Info/4 CM/0x63100019 Mode Config data received 88 02:39:18.809 08/17/07 Sev=Info/4 IKE/0x63000055 Received a key request from Driver: Local IP = 10.13.6.56, GW IP = 137.69.115.16, Remote IP = 0.0.0.0 89 02:39:18.809 08/17/07 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK QM *(HASH, SA, NON, ID, ID) to 137.69.115.16 90 02:39:18.859 08/17/07 Sev=Info/5 IKE/0x6300002F Received ISAKMP packet: peer = 137.69.115.16 91 02:39:18.859 08/17/07 Sev=Info/4 IKE/0x63000014 RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:STATUS_RESP_LIFETIME) from 137.69.115.16 92 02:39:18.859 08/17/07 Sev=Info/5 IKE/0x63000044 RESPONDER-LIFETIME notify has value of 86400 seconds 93 02:39:18.859 08/17/07 Sev=Info/5 IKE/0x63000046 This SA has already been alive for 26 seconds, setting expiry to 86374 seconds from now 94 02:39:18.869 08/17/07 Sev=Info/5 IKE/0x6300002F Received ISAKMP packet: peer = 137.69.115.16 95 02:39:18.869 08/17/07 Sev=Info/4 IKE/0x63000014 RECEIVING <<< ISAKMP OAK QM *(HASH, SA, NON, ID, ID, NOTIFY:STATUS_RESP_LIFETIME) from 137.69.115.16 96 02:39:18.869 08/17/07 Sev=Info/5 IKE/0x63000044 RESPONDER-LIFETIME notify has value of 28800 seconds 97 02:39:18.869 08/17/07 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK QM *(HASH) to 137.69.115.16 98 02:39:18.869 08/17/07 Sev=Info/5 IKE/0x63000058 Loading IPsec SA (MsgID=46C2A23D OUTBOUND SPI = 0x5D39420B INBOUND SPI = 0x1D46BF32) 99 02:39:18.869 08/17/07 Sev=Info/5 IKE/0x63000025 Loaded OUTBOUND ESP SPI: 0x5D39420B 100 02:39:18.869 08/17/07 Sev=Info/5 IKE/0x63000026 Loaded INBOUND ESP SPI: 0x1D46BF32 101 02:39:19.460 08/17/07 Sev=Info/4 CM/0x63100034 The Virtual Adapter was enabled: IP=10.13.6.56/255.255.192.0 DNS=137.69.224.15,128.221.12.10 WINS=128.221.12.10,128.222.67.10 Domain=corp.emc.com Split DNS Names= 102 02:39:19.500 08/17/07 Sev=Info/6 CM/0x63100036 The routing table was updated for the Virtual Adapter 103 02:39:19.660 08/17/07 Sev=Info/4 CM/0x6310001A One secure connection established 104 02:39:19.800 08/17/07 Sev=Info/4 CM/0x63100038 Address watch added for 192.168.1.102. Current address(es): 192.168.1.102, 10.13.6.56, 192.168.186.1, 192.168.121.1. 105 02:39:19.800 08/17/07 Sev=Info/4 CM/0x63100038 Address watch added for 10.13.6.56. Current address(es): 192.168.1.102, 10.13.6.56, 192.168.186.1, 192.168.121.1. 106 02:39:19.860 08/17/07 Sev=Info/4 IPSEC/0x63700014 Deleted all keys 107 02:39:19.860 08/17/07 Sev=Info/6 IPSEC/0x6370002B Sent 10 packets, 0 were fragmented. 108 02:39:19.860 08/17/07 Sev=Info/4 IPSEC/0x63700010 Created a new key structure 109 02:39:19.860 08/17/07 Sev=Info/4 IPSEC/0x6370000F Added key with SPI=0x0b42395d into key list 110 02:39:19.860 08/17/07 Sev=Info/4 IPSEC/0x63700010 Created a new key structure 111 02:39:19.860 08/17/07 Sev=Info/4 IPSEC/0x6370000F Added key with SPI=0x32bf461d into key list 112 02:39:19.860 08/17/07 Sev=Info/4 IPSEC/0x6370002E Assigned VA private interface addr 10.13.6.56 113 02:39:23.175 08/17/07 Sev=Info/4 IPSEC/0x63700019 Activate outbound key with SPI=0x0b42395d for inbound key with SPI=0x32bf461d 114 02:41:04.320 08/17/07 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK INFO *(HASH, DEL) to 137.69.115.16 115 02:41:04.320 08/17/07 Sev=Info/5 IKE/0x63000018 Deleting IPsec SA: (OUTBOUND SPI = 5D39420B INBOUND SPI = 1D46BF32) 116 02:41:04.320 08/17/07 Sev=Info/4 IKE/0x63000048 Discarding IPsec SA negotiation, MsgID=46C2A23D 117 02:41:04.320 08/17/07 Sev=Info/4 IKE/0x63000017 Marking IKE SA for deletion (I_Cookie=76CF80932342268A R_Cookie=35505A86482BD5B9) reason = DEL_REASON_RESET_SADB 118 02:41:04.320 08/17/07 Sev=Info/4 IKE/0x63000013 SENDING >>> ISAKMP OAK INFO *(HASH, DWR) to 137.69.115.16 119 02:41:04.320 08/17/07 Sev=Info/4 IKE/0x6300004A Discarding IKE SA negotiation (I_Cookie=76CF80932342268A R_Cookie=35505A86482BD5B9) reason = DEL_REASON_RESET_SADB 120 02:41:04.320 08/17/07 Sev=Info/4 CM/0x63100013 Phase 1 SA deleted cause by DEL_REASON_RESET_SADB. 0 Crypto Active IKE SA, 0 User Authenticated IKE SA in the system 121 02:41:04.320 08/17/07 Sev=Info/5 CM/0x63100025 Initializing CVPNDrv 122 02:41:04.320 08/17/07 Sev=Info/4 CM/0x6310002D Resetting TCP connection on port 4005 123 02:41:04.320 08/17/07 Sev=Info/6 CM/0x63100030 Removed local TCP port 2166 for TCP connection. 124 02:41:04.320 08/17/07 Sev=Info/6 CM/0x63100031 Tunnel to headend device 137.69.115.16 disconnected: duration: 0 days 0:1:45 125 02:41:04.320 08/17/07 Sev=Info/4 IKE/0x63000001 IKE received signal to terminate VPN connection 126 02:41:04.330 08/17/07 Sev=Info/6 CM/0x63100037 The routing table was returned to orginal state prior to Virtual Adapter 127 02:41:05.762 08/17/07 Sev=Info/4 CM/0x63100035 The Virtual Adapter was disabled 128 02:41:17.219 08/17/07 Sev=Critical/1 FIREWALL/0xE3A00003 Fatal error trying to start the firewall. The firewall has not been started. 129 02:41:19.322 08/17/07 Sev=Info/4 IPSEC/0x63700013 Delete internal key with SPI=0x32bf461d 130 02:41:19.322 08/17/07 Sev=Info/4 IPSEC/0x6370000C Key deleted by SPI 0x32bf461d 131 02:41:19.322 08/17/07 Sev=Info/4 IPSEC/0x63700013 Delete internal key with SPI=0x0b42395d 132 02:41:19.322 08/17/07 Sev=Info/4 IPSEC/0x6370000C Key deleted by SPI 0x0b42395d 133 02:41:19.322 08/17/07 Sev=Info/6 IPSEC/0x63700022 TCP RST sent to 137.69.115.16, src port 2166, dst port 4005 134 02:41:19.322 08/17/07 Sev=Info/4 IPSEC/0x63700014 Deleted all keys 135 02:41:19.322 08/17/07 Sev=Info/4 IPSEC/0x63700014 Deleted all keys 136 02:41:19.322 08/17/07 Sev=Info/4 IPSEC/0x6370000A IPSec driver successfully stopped 137 02:41:19.322 08/17/07 Sev=Info/4 IPSEC/0x63700014 Deleted all keys 138 02:41:19.322 08/17/07 Sev=Info/4 IPSEC/0x63700014 Deleted all keys