D-Link NetDefend SOHO DFL-160 User manual

Log Reference Guide
DFL-160
Ver 2.27.00
Network Security Solution http://www.dlink.com.tw
Security
Security
SOHO UTM Firewall

Log Reference Guide
D-Link DFL-160 Firewall
NetDefendOS Version 2.27.00
D-Link Corporation
No. 289, Sinhu 3rd Rd, Neihu District, Taipei City 114, Taiwan R.O.C.
http://www.DLink.com
Published 2010-05-25
Copyright ©2010

Log Reference Guide
D-Link DFL-160 Firewall
NetDefendOS Version 2.27.00
Published 2010-05-25
Copyright © 2010
Copyright Notice
This publication, including all photographs, illustrations and software, is protected under
international copyright laws, with all rights reserved. Neither this manual, nor any of the material
contained herein, may be reproduced without the written consent of D-Link.
Disclaimer
The information in this document is subject to change without notice. D-Link makes no
representations or warranties with respect to the contents hereof and specifically disclaims any
implied warranties of merchantability or fitness for a particular purpose. D-Link reserves the right to
revise this publication and to make changes from time to time in the content hereof without any
obligation to notify any person or parties of such revision or changes.
Limitations of Liability
UNDER NO CIRCUMSTANCES SHALL D-LINK OR ITS SUPPLIERS BE LIABLE FOR
DAMAGES OF ANY CHARACTER (E.G. DAMAGES FOR LOSS OF PROFIT, SOFTWARE
RESTORATION, WORK STOPPAGE, LOSS OF SAVED DATA OR ANY OTHER
COMMERCIAL DAMAGES OR LOSSES) RESULTING FROM THE APPLICATION OR
IMPROPER USE OF THE D-LINK PRODUCT OR FAILURE OF THE PRODUCT, EVEN IF
D-LINK IS INFORMED OF THE POSSIBILITY OF SUCH DAMAGES. FURTHERMORE,
D-LINK WILL NOT BE LIABLE FOR THIRD-PARTY CLAIMS AGAINST CUSTOMER FOR
LOSSES OR DAMAGES. D-LINK WILL IN NO EVENT BE LIABLE FOR ANY DAMAGES IN
EXCESS OF THE AMOUNT D-LINK RECEIVED FROM THE END-USER FOR THE
PRODUCT.

Table of Contents
Preface ...............................................................................................................22
1. Introduction .....................................................................................................24
1.1. Log Message Structure ............................................................................24
1.2. Context Parameters .................................................................................26
1.3. Severity levels .......................................................................................30
2. Log Message Reference .....................................................................................32
2.1. ALG ....................................................................................................33
2.1.1. alg_session_open (ID: 00200001) ...................................................33
2.1.2. alg_session_closed (ID: 00200002) .................................................33
2.1.3. max_line_length_exceeded (ID: 00200003) ......................................33
2.1.4. alg_session_allocation_failure (ID: 00200009) ..................................34
2.1.5. invalid_client_http_header_received (ID: 00200100) ..........................34
2.1.6. invalid_url_format (ID: 00200101) .................................................34
2.1.7. unknown_client_data_received (ID: 00200105) .................................35
2.1.8. suspicious_data_received (ID: 00200106) .........................................35
2.1.9. invalid_chunked_encoding (ID: 00200107) .......................................36
2.1.10. invalid_server_http_header_received (ID: 00200108) ........................36
2.1.11. compressed_data_received (ID: 00200109) .....................................36
2.1.12. max_http_sessions_reached (ID: 00200110) ....................................37
2.1.13. failed_create_new_session (ID: 00200111) .....................................37
2.1.14. failure_connect_http_server (ID: 00200112) ....................................37
2.1.15. content_type_mismatch (ID: 00200113) .........................................38
2.1.16. wcf_override_full (ID: 00200114) .................................................38
2.1.17. content_filtering_disabled (ID: 00200115) ......................................38
2.1.18. max_download_size_reached (ID: 00200116) ..................................39
2.1.19. blocked_filetype (ID: 00200117) ...................................................39
2.1.20. out_of_memory (ID: 00200118) ....................................................40
2.1.21. wcf_servers_unreachable (ID: 00200119) .......................................40
2.1.22. wcf_srv_connection_error (ID: 00200120) ......................................40
2.1.23. wcf_server_unreachable (ID: 00200121) ........................................41
2.1.24. wcf_connecting (ID: 00200122) ....................................................41
2.1.25. wcf_server_connected (ID: 00200123) ...........................................41
2.1.26. wcf_primary_fallback (ID: 00200124) ...........................................42
2.1.27. request_url (ID: 00200125) ..........................................................42
2.1.28. request_url (ID: 00200126) ..........................................................42
2.1.29. wcf_server_auth_failed (ID: 00200127) ..........................................43
2.1.30. wcf_server_bad_reply (ID: 00200128) ...........................................43
2.1.31. request_url (ID: 00200129) ..........................................................43
2.1.32. out_of_memory (ID: 00200130) ....................................................44
2.1.33. wcf_bad_sync (ID: 00200131) ......................................................44
2.1.34. restricted_site_notice (ID: 00200132) ............................................44
2.1.35. url_reclassification_request (ID: 00200133) ....................................45
2.1.36. request_url (ID: 00200135) ..........................................................45
2.1.37. request_url (ID: 00200136) ..........................................................46
2.1.38. request_url (ID: 00200137) ..........................................................46
2.1.39. restricted_site_notice (ID: 00200138) ............................................47
2.1.40. url_reclassification_request (ID: 00200139) ....................................47
2.1.41. wcf_mem_optimized (ID: 00200140) .............................................48
2.1.42. max_smtp_sessions_reached (ID: 00200150) ..................................48
2.1.43. maximum_email_per_minute_reached (ID: 00200151) ......................48
2.1.44. failed_create_new_session (ID: 00200152) .....................................49
2.1.45. failed_connect_smtp_server (ID: 00200153) ...................................49
2.1.46. invalid_server_response (ID: 00200155) .........................................49
2.1.47. sender_email_id_mismatched (ID: 00200157) .................................50
2.1.48. sender_email_id_is_in_blacklist (ID: 00200158) ..............................50
2.1.49. recipient_email_id_in_blacklist (ID: 00200159) ...............................50
2.1.50. some_recipient_email_ids_are_in_blocklist (ID: 00200160) ...............51
4

2.1.51. base64_decode_failed (ID: 00200164) ...........................................51
2.1.52. base64_decode_failed (ID: 00200165) ...........................................51
2.1.53. blocked_filetype (ID: 00200166) ...................................................52
2.1.54. content_type_mismatch (ID: 00200167) .........................................52
2.1.55. max_email_size_reached (ID: 00200170) .......................................53
2.1.56. content_type_mismatch_mimecheck_disabled (ID: 00200171) ...........53
2.1.57. all_recipient_email_ids_are_in_blocklist (ID: 00200172) ...................54
2.1.58. out_of_memory (ID: 00200175) ....................................................54
2.1.59. invalid_end_of_mail (ID: 00200176) .............................................54
2.1.60. dnsbl_init_error (ID: 00200177) ....................................................55
2.1.61. cmd_too_long (ID: 00200179) ......................................................55
2.1.62. cmd_empty (ID: 00200180) .........................................................55
2.1.63. failed_send_reply_code (ID: 00200181) .........................................56
2.1.64. smtp_no_header (ID: 00200184) ...................................................56
2.1.65. unsupported_extension (ID: 00200185) ..........................................56
2.1.66. cmd_pipelined (ID: 00200186) .....................................................57
2.1.67. smtp_state_violation (ID: 00200190) .............................................57
2.1.68. sender_email_dnsbl_spam_mark_removed_by_whitelist (ID: 00200195)
..........................................................................................................57
2.1.69. illegal_data_direction (ID: 00200202) ............................................58
2.1.70. hybrid_data (ID: 00200206) .........................................................58
2.1.71. hybrid_data (ID: 00200209) .........................................................58
2.1.72. illegal_chars (ID: 00200210) ........................................................59
2.1.73. control_chars (ID: 00200211) .......................................................59
2.1.74. illegal_command (ID: 00200212) ..................................................59
2.1.75. illegal_command (ID: 00200213) ..................................................60
2.1.76. port_command_disabled (ID: 00200214) ........................................60
2.1.77. illegal_command (ID: 00200215) ..................................................61
2.1.78. illegal_ip_address (ID: 00200216) .................................................61
2.1.79. illegal_port_number (ID: 00200217) ..............................................62
2.1.80. failed_to_create_connection1 (ID: 00200218) ..................................62
2.1.81. illegal_command (ID: 00200219) ..................................................62
2.1.82. illegal_direction1 (ID: 00200220) .................................................63
2.1.83. illegal_direction2 (ID: 00200221) .................................................63
2.1.84. illegal_option (ID: 00200222) ......................................................64
2.1.85. illegal_option (ID: 00200223) ......................................................64
2.1.86. unknown_option (ID: 00200224) ..................................................64
2.1.87. illegal_command (ID: 00200225) ..................................................65
2.1.88. unknown_command (ID: 00200226) ..............................................65
2.1.89. illegal_reply (ID: 00200228) ........................................................66
2.1.90. illegal_reply (ID: 00200230) ........................................................66
2.1.91. illegal_reply (ID: 00200231) ........................................................66
2.1.92. illegal_reply (ID: 00200232) ........................................................67
2.1.93. bad_port (ID: 00200233) .............................................................67
2.1.94. bad_ip (ID: 00200234) ................................................................68
2.1.95. failed_to_create_connection2 (ID: 00200235) ..................................68
2.1.96. failed_to_create_server_data_connection (ID: 00200236) ..................68
2.1.97. failed_to_send_port (ID: 00200237) ..............................................69
2.1.98. failed_to_register_rawconn (ID: 00200238) ....................................69
2.1.99. failed_to_merge_conns (ID: 00200239) ..........................................69
2.1.100. max_ftp_sessions_reached (ID: 00200241) ....................................70
2.1.101. failed_create_new_session (ID: 00200242) ....................................70
2.1.102. failure_connect_ftp_server (ID: 00200243) ...................................70
2.1.103. content_type_mismatch (ID: 00200250) .......................................71
2.1.104. failed_to_send_command (ID: 00200251) .....................................71
2.1.105. resumed_compressed_file_transfer (ID: 00200252) .........................71
2.1.106. blocked_filetype (ID: 00200253) .................................................72
2.1.107. resumed_compressed_file_transfer (ID: 00200254) .........................72
2.1.108. failed_to_send_response_code (ID: 00200255) ..............................73
2.1.109. illegal_command (ID: 00200267) ................................................73
2.1.110. packet_failed_initial_test (ID: 00200350) ......................................73
2.1.111. packet_failed_traversal_test (ID: 00200351) ..................................74
2.1.112. command_not_allowed (ID: 00200353) ........................................74
Log Reference Guide
5

2.1.113. option_value_invalid (ID: 00200354) ...........................................74
2.1.114. option_value_invalid (ID: 00200355) ...........................................75
2.1.115. option_tsize_invalid (ID: 00200356) ............................................75
2.1.116. unknown_option_blocked (ID: 00200357) .....................................75
2.1.117. option_tsize_invalid (ID: 00200358) ............................................76
2.1.118. unknown_option_blocked (ID: 00200359) .....................................76
2.1.119. option_not_sent (ID: 00200360) ..................................................77
2.1.120. option_value_invalid (ID: 00200361) ...........................................77
2.1.121. option_value_invalid (ID: 00200362) ...........................................77
2.1.122. blksize_out_of_range (ID: 00200363) ..........................................78
2.1.123. max_tftp_sessions_reached (ID: 00200364) ...................................78
2.1.124. failed_create_new_session (ID: 00200365) ....................................78
2.1.125. invalid_packet_received (ID: 00200366) .......................................79
2.1.126. failed_create_connection (ID: 00200367) ......................................79
2.1.127. invalid_packet_received_reopen (ID: 00200368) ............................79
2.1.128. packet_out_of_sequence (ID: 00200369) ......................................80
2.1.129. transfer_size_exceeded (ID: 00200370) ........................................80
2.1.130. options_removed (ID: 00200371) ................................................81
2.1.131. failed_strip_option (ID: 00200372) ..............................................81
2.1.132. failed_create_connection (ID: 00200373) ......................................81
2.1.133. invalid_error_message_received (ID: 00200374) ............................82
2.1.134. max_pop3_sessions_reached (ID: 00200380) .................................82
2.1.135. failed_create_new_session (ID: 00200381) ....................................82
2.1.136. failed_connect_pop3_server (ID: 00200382) ..................................83
2.1.137. out_of_memory (ID: 00200383) ..................................................83
2.1.138. blocked_filetype (ID: 00200384) .................................................83
2.1.139. response_blocked_unknown (ID: 00200385) .................................84
2.1.140. base64_decode_failed (ID: 00200386) ..........................................84
2.1.141. possible_invalid_mail_end (ID: 00200387) ...................................84
2.1.142. command_blocked_invalid_len (ID: 00200388) .............................85
2.1.143. response_blocked_invalid_len (ID: 00200389) ...............................85
2.1.144. content_type_mismatch (ID: 00200390) .......................................86
2.1.145. content_type_mismatch_mimecheck_disabled (ID: 00200391) ..........86
2.1.146. command_blocked_invalid_argument (ID: 00200392) .....................86
2.1.147. command_blocked (ID: 00200393) ..............................................87
2.1.148. unknown_command_blocked (ID: 00200394) ................................87
2.1.149. unexpected_mail_end (ID: 00200396) ..........................................87
2.1.150. invalid_line_endings (ID: 00200397) ...........................................88
2.1.151. top_mail_end_blocked (ID: 00200398) .........................................88
2.1.152. max_tls_sessions_reached (ID: 00200450) ....................................88
2.1.153. failed_create_new_session (ID: 00200451) ....................................89
2.1.154. failure_connect_http_server (ID: 00200452) ..................................89
2.1.155. tls_alert_received (ID: 00200453) ................................................89
2.1.156. tls_renegotiation_attempted (ID: 00200454) ..................................90
2.1.157. tls_alert_sent (ID: 00200455) ......................................................90
2.1.158. tls_cipher_suite_certificate_mismatch (ID: 00200456) .....................91
2.1.159. ssl_renegotiation_attempted (ID: 00200457) ..................................91
2.1.160. tls_disallowed_key_exchange (ID: 00200458) ...............................91
2.1.161. tls_invalid_message (ID: 00200459) ............................................92
2.1.162. tls_bad_message_order (ID: 00200460) ........................................92
2.1.163. tls_no_shared_cipher_suites (ID: 00200461) ..................................92
2.1.164. tls_out_of_memory (ID: 00200462) .............................................93
2.1.165. tls_failed_to_verify_finished (ID: 00200463) .................................93
2.1.166. unknown_tls_error (ID: 00200464) ..............................................94
2.1.167. max_pptp_sessions_reached (ID: 00200601) .................................94
2.1.168. failed_create_new_session (ID: 00200602) ....................................94
2.1.169. failed_connect_pptp_server (ID: 00200603) ..................................95
2.1.170. pptp_tunnel_established_client (ID: 00200604) ..............................95
2.1.171. pptp_tunnel_removed_client (ID: 00200605) .................................95
2.1.172. pptp_tunnel_removed_server (ID: 00200606) ................................96
2.1.173. pptp_session_established (ID: 00200607) ......................................96
2.1.174. pptp_session_removed (ID: 00200608) .........................................96
2.1.175. pptp_malformed_packet (ID: 00200609) .......................................96
Log Reference Guide
6

2.1.176. pptp_tunnel_established_server (ID: 00200610) .............................97
2.2. ANTIVIRUS .........................................................................................98
2.2.1. virus_found (ID: 05800001) ...........................................................98
2.2.2. virus_found (ID: 05800002) ...........................................................98
2.2.3. excluded_file (ID: 05800003) .........................................................99
2.2.4. decompression_failed (ID: 05800004) .............................................99
2.2.5. decompression_failed (ID: 05800005) .............................................99
2.2.6. compression_ratio_violation (ID: 05800006) ...................................100
2.2.7. compression_ratio_violation (ID: 05800007) ...................................100
2.2.8. compression_ratio_violation (ID: 05800008) ...................................101
2.2.9. out_of_memory (ID: 05800009) ...................................................101
2.2.10. out_of_memory (ID: 05800010) ..................................................102
2.2.11. virus_scan_failure (ID: 05800011) ..............................................102
2.2.12. virus_scan_failure (ID: 05800012) ..............................................102
2.2.13. no_valid_license (ID: 05800015) ................................................103
2.2.14. no_signature_database (ID: 05800016) ......................................... 103
2.2.15. general_engine_error (ID: 05800017) ..........................................103
2.2.16. out_of_memory (ID: 05800018) ..................................................104
2.2.17. unknown_encoding (ID: 05800182) .............................................104
2.2.18. unknown_encoding (ID: 05800183) .............................................104
2.2.19. unknown_encoding (ID: 05800184) .............................................105
2.2.20. unknown_encoding (ID: 05800185) .............................................105
2.3. ARP ..................................................................................................107
2.3.1. already_exists (ID: 00300001) ......................................................107
2.3.2. no_sender_ip (ID: 00300002) .......................................................107
2.3.3. no_sender_ip (ID: 00300003) .......................................................107
2.3.4. arp_response_broadcast (ID: 00300004) ......................................... 108
2.3.5. arp_response_multicast (ID: 00300005) .........................................108
2.3.6. mismatching_hwaddrs (ID: 00300006) ..........................................108
2.3.7. mismatching_hwaddrs_drop (ID: 00300007) ...................................108
2.3.8. hwaddr_change (ID: 00300008) ....................................................109
2.3.9. arp_cache_size_limit_reached (ID: 00300030) ................................ 109
2.3.10. invalid_arp_sender_ip_address (ID: 00300049) ..............................110
2.3.11. arp_access_allowed_expect (ID: 00300050) ..................................110
2.3.12. impossible_hw_address (ID: 00300051) ....................................... 110
2.3.13. arp_response_broadcast_drop (ID: 00300052) ...............................110
2.3.14. arp_response_multicast_drop (ID: 00300053) ................................111
2.3.15. arp_collides_with_static (ID: 00300054) ...................................... 111
2.3.16. hwaddr_change_drop (ID: 00300055) ..........................................112
2.4. AVUPDATE .......................................................................................113
2.4.1. av_db_update_failure (ID: 05000001) ............................................ 113
2.4.2. av_database_downloaded (ID: 05000002) ...................................... 113
2.4.3. av_db_already_up_to_date (ID: 05000003) ..................................... 113
2.4.4. av_db_update_denied (ID: 05000004) ...........................................113
2.4.5. av_detects_invalid_system_time (ID: 05000005) ............................. 114
2.4.6. downloading_new_database (ID: 05000007) ................................... 114
2.4.7. unsynced_databases (ID: 05000008) ..............................................114
2.5. BUFFERS ..........................................................................................116
2.5.1. buffers_flooded (ID: 00500001) ...................................................116
2.5.2. buffers_profile (ID: 00500002) .....................................................116
2.6. CONN ...............................................................................................117
2.6.1. conn_open (ID: 00600001) ..........................................................117
2.6.2. conn_close (ID: 00600002) ..........................................................117
2.6.3. connection_table_full (ID: 00600003) ............................................117
2.6.4. conn_open_natsat (ID: 00600004) .................................................118
2.6.5. conn_close_natsat (ID: 00600005) ................................................118
2.6.6. out_of_connections (ID: 00600010) ..............................................118
2.6.7. out_of_connections (ID: 00600011) ..............................................119
2.6.8. no_new_conn_for_this_packet (ID: 00600012) ................................119
2.6.9. no_new_conn_for_this_packet (ID: 00600013) ................................119
2.6.10. no_return_route (ID: 00600014) ..................................................120
2.6.11. reverse_connect_attempt (ID: 00600015) ......................................120
2.6.12. port_0_illegal (ID: 00600020) ....................................................120
Log Reference Guide
7

2.6.13. udp_src_port_0_illegal (ID: 00600021) ........................................121
2.6.14. udp_src_port_0_forwarded (ID: 00600022) ...................................121
2.6.15. conn_usage (ID: 00600023) .......................................................121
2.6.16. active_data (ID: 00600100) ........................................................122
2.6.17. passive_data (ID: 00600101) ......................................................122
2.6.18. active_data (ID: 00600102) ........................................................122
2.6.19. passive_data (ID: 00600103) ......................................................123
2.7. DHCP ................................................................................................124
2.7.1. offered_ip_occupied (ID: 00700001) .............................................124
2.7.2. lease_changed (ID: 00700002) .....................................................124
2.7.3. lease_acquired (ID: 00700003) .....................................................124
2.7.4. renewed_lease (ID: 00700004) .....................................................125
2.7.5. lease_expired (ID: 00700005) ......................................................125
2.7.6. invalid_lease_time (ID: 00700007) ...............................................125
2.7.7. invalid_server_id (ID: 00700008) .................................................126
2.7.8. invalid_netmask (ID: 00700009) ...................................................126
2.7.9. invalid_broadcast (ID: 00700010) .................................................126
2.7.10. invalid_offered_ip (ID: 00700011) ..............................................127
2.7.11. invalid_gateway (ID: 00700012) .................................................127
2.7.12. offered_broadcast_equals_gateway (ID: 00700013) ........................127
2.7.13. ip_collision (ID: 00700014) .......................................................128
2.7.14. route_collision (ID: 00700015) ...................................................128
2.8. DHCPRELAY .....................................................................................130
2.8.1. unable_to_save_dhcp_relay_list (ID: 00800001) .............................. 130
2.8.2. dhcp_relay_list_saved (ID: 00800002) ........................................... 130
2.8.3. dhcp_pkt_too_small (ID: 00800003) .............................................130
2.8.4. incorrect_bootp_dhcp_cookie (ID: 00800004) ................................. 130
2.8.5. maximum_ppm_for_relayer_reached (ID: 00800005) ....................... 131
2.8.6. relayer_resuming (ID: 00800006) .................................................131
2.8.7. hop_limit_exceeded (ID: 00800007) ..............................................131
2.8.8. client_release (ID: 00800008) ......................................................132
2.8.9. got_reply_without_transaction_state (ID: 00800009) ........................132
2.8.10. maximum_dhcp_client_relay_routes_reached (ID: 00800010) .......... 132
2.8.11. unable_to_add_relay_route_since_out_of_memory (ID: 00800011) ... 133
2.8.12. ignored_relay_request (ID: 00800012) .........................................133
2.8.13. no_message_type (ID: 00800013) ...............................................133
2.8.14. bad_inform_pkt_with_mismatching_source_ip_and_client_ip (ID:
00800014) ........................................................................................134
2.8.15. received_relayed_inform_packet_without_client_ip (ID: 00800015) ..134
2.8.16. maximum_current_dhcp_relays_for_iface (ID: 00800016) ............... 134
2.8.17. dhcp_server_is_unroutable (ID: 00800017) ................................... 135
2.8.18. unable_to_get_free_transaction_state (ID: 00800018) .....................135
2.8.19. invalid_gateway (ID: 00800019) .................................................135
2.8.20. relayed_request (ID: 00800020) ..................................................136
2.8.21. relayed_request (ID: 00800021) ..................................................136
2.8.22. got_reply_on_a_non_security_equivalent_interface (ID: 00800022) .. 136
2.8.23. assigned_ip_not_allowed (ID: 00800023) .....................................137
2.8.24. illegal_client_ip_assignment (ID: 00800024) ................................. 137
2.8.25. ambiguous_host_route (ID: 00800025) .........................................137
2.8.26. relayed_dhcp_reply (ID: 00800026) .............................................138
2.8.27. relayed_bootp_reply (ID: 00800027) ...........................................138
2.8.28. relayed_dhcp_reply (ID: 00800028) .............................................139
2.8.29. relayed_bootp_reply (ID: 00800029) ...........................................139
2.9. DHCPSERVER ...................................................................................140
2.9.1. unable_to_send_response (ID: 00900001) ...................................... 140
2.9.2. option_section_is_too_big_unable_to_reply (ID: 00900002) ..............140
2.9.3. unable_to_save_lease_db (ID: 00900003) .......................................140
2.9.4. lease_db_successfully_saved (ID: 00900004) ..................................140
2.9.5. dhcp_packet_too_small (ID: 00900005) .........................................141
2.9.6. request_for_ip_from_non_bound_client_without_state (ID: 00900006) 141
2.9.7. request_for_ip_from_bound_client_without_state (ID: 00900007) ......141
2.9.8. request_for_ip_from_non_bound_client_without_state (ID: 00900008) 142
2.9.9. all_ip_pools_depleted (ID: 00900010) ...........................................142
Log Reference Guide
8

2.9.10. request_with_bad_udp_checksum (ID: 00900011) ..........................142
2.9.11. lease_timeout (ID: 00900012) ....................................................143
2.9.12. lease_timeout (ID: 00900013) ....................................................143
2.9.13. pool_depleted (ID: 00900014) ....................................................143
2.9.14. sending_offer (ID: 00900015) ....................................................144
2.9.15. pool_depleted (ID: 00900016) ....................................................144
2.9.16. request_for_non_offered_ip (ID: 00900017) .................................. 144
2.9.17. request_for_non_bound_ip (ID: 00900018) ................................... 145
2.9.18. client_bound (ID: 00900019) ......................................................145
2.9.19. client_renewed (ID: 00900020) ...................................................145
2.9.20. got_inform_request (ID: 00900021) .............................................146
2.9.21. decline_for_ip_on_wrong_iface (ID: 00900022) ............................146
2.9.22. decline_for_non_offered_ip (ID: 00900023) .................................. 146
2.9.23. declined_by_client (ID: 00900024) ..............................................147
2.9.24. request_for_ip_from_bound_client_without_state (ID: 00900025) .....147
2.9.25. release_for_ip_on_wrong_iface (ID: 00900026) .............................148
2.9.26. released_by_client (ID: 00900027) ..............................................148
2.10. FRAG ..............................................................................................149
2.10.1. individual_frag_timeout (ID: 02000001) ....................................... 149
2.10.2. fragact_contains_frags (ID: 02000002) ......................................... 149
2.10.3. fail_suspect_out_of_resources (ID: 02000003) ..............................149
2.10.4. fail_out_of_resources (ID: 02000004) ..........................................150
2.10.5. fail_suspect_timeout (ID: 02000005) ...........................................150
2.10.6. fail_timeout (ID: 02000006) .......................................................151
2.10.7. disallowed_suspect (ID: 02000007) .............................................151
2.10.8. drop_frags_of_disallowed_packet (ID: 02000008) ..........................151
2.10.9. drop_frags_of_illegal_packet (ID: 02000009) ................................152
2.10.10. drop_extraneous_frags_of_completed_packet (ID: 02000010) ........ 152
2.10.11. learn_state (ID: 02000011) .......................................................153
2.10.12. drop_duplicate_frag_suspect_packet (ID: 02000012) ....................153
2.10.13. drop_duplicate_frag (ID: 02000013) .......................................... 153
2.10.14. frag_offset_plus_length_not_in_range (ID: 02000014) ..................154
2.10.15. no_available_fragacts (ID: 02000015) ........................................154
2.10.16. bad_ipdatalen (ID: 02000016) ...................................................155
2.10.17. bad_ipdatalen (ID: 02000017) ...................................................155
2.10.18. overlapping_frag (ID: 02000018) ..............................................155
2.10.19. bad_offs (ID: 02000019) ..........................................................156
2.10.20. duplicate_frag_with_different_length (ID: 02000020) ................... 156
2.10.21. duplicate_frag_with_different_data (ID: 02000021) ......................156
2.10.22. partial_overlap (ID: 02000022) .................................................156
2.10.23. drop_frag_disallowed_suspect_packet (ID: 02000023) ..................157
2.10.24. drop_frag_disallowed_packet (ID: 02000024) .............................. 157
2.10.25. already_completed (ID: 02000025) ............................................157
2.10.26. drop_frag_failed_suspect_packet (ID: 02000026) .........................158
2.10.27. drop_frag_failed_packet (ID: 02000027) ..................................... 158
2.10.28. drop_frag_illegal_packet (ID: 02000028) .................................... 158
2.10.29. fragments_available_freeing (ID: 02000100) ...............................159
2.11. IDP ..................................................................................................160
2.11.1. scan_detected (ID: 01300001) ....................................................160
2.11.2. idp_notice (ID: 01300002) .........................................................160
2.11.3. intrusion_detected (ID: 01300003) ..............................................161
2.11.4. virus_detected (ID: 01300004) ....................................................161
2.11.5. scan_detected (ID: 01300005) ....................................................162
2.11.6. idp_notice (ID: 01300006) .........................................................162
2.11.7. intrusion_detected (ID: 01300007) ..............................................163
2.11.8. virus_detected (ID: 01300008) ....................................................163
2.11.9. invalid_url_format (ID: 01300009) ..............................................164
2.11.10. invalid_url_format (ID: 01300010) ............................................164
2.11.11. idp_evasion (ID: 01300011) .....................................................164
2.11.12. idp_evasion (ID: 01300012) .....................................................165
2.11.13. idp_outofmem (ID: 01300013) ..................................................165
2.11.14. idp_outofmem (ID: 01300014) ..................................................166
2.11.15. idp_failscan (ID: 01300015) .....................................................166
Log Reference Guide
9

2.11.16. idp_failscan (ID: 01300016) .....................................................167
2.12. IDPUPDATE .....................................................................................168
2.12.1. idp_db_update_failure (ID: 01400001) .........................................168
2.12.2. idp_database_downloaded (ID: 01400002) ....................................168
2.12.3. idp_db_already_up_to_date (ID: 01400003) ..................................168
2.12.4. idp_db_update_denied (ID: 01400004) .........................................168
2.12.5. idp_detects_invalid_system_time (ID: 01400005) ..........................169
2.12.6. downloading_new_database (ID: 01400007) ................................. 169
2.12.7. unsynced_databases (ID: 01400009) ............................................169
2.13. IGMP ...............................................................................................171
2.13.1. querier_election_won (ID: 04200001) ..........................................171
2.13.2. querier_election_lost (ID: 04200002) ........................................... 171
2.13.3. invalid_dest_ip_address (ID: 04200003) ....................................... 171
2.13.4. invalid_destination_ethernet_address (ID: 04200004) ..................... 172
2.13.5. failed_restarting_igmp_conn (ID: 04200006) ................................172
2.13.6. invalid_size_query_packet (ID: 04200007) ................................... 172
2.13.7. invalid_query_group_address (ID: 04200008) ............................... 173
2.13.8. igmp_query_dropped (ID: 04200009) .......................................... 173
2.13.9. igmp_query_received (ID: 04200010) ..........................................173
2.13.10. bad_src (ID: 04200011) ...........................................................174
2.13.11. igmp_report_received (ID: 04200012) ........................................174
2.13.12. packet_includes_aux_data (ID: 04200013) ..................................175
2.13.13. invalid_size_report_packet (ID: 04200014) ................................. 175
2.13.14. bad_grp (ID: 04200015) ..........................................................176
2.13.15. invalid_report_grp_record (ID: 04200016) ..................................176
2.13.16. igmp_report_dropped (ID: 04200017) ........................................176
2.13.17. igmp_ruleset_rejects_report (ID: 04200018) ................................177
2.13.18. bad_inet (ID: 04200019) ..........................................................177
2.13.19. max_global_requests_per_second_reached (ID: 04200020) ............177
2.13.20. max_if_requests_per_second_reached (ID: 04200021) .................. 178
2.13.21. disallowed_igmp_version (ID: 04200022) ................................... 178
2.13.22. received_unknown_igmp_type (ID: 04200023) ............................178
2.13.23. older_querier_present (ID: 04200024) ........................................179
2.13.24. older_querier_gone (ID: 04200025) ........................................... 179
2.14. IPSEC ..............................................................................................180
2.14.1. fatal_ipsec_event (ID: 01800100) ................................................180
2.14.2. warning_ipsec_event (ID: 01800101) ........................................... 180
2.14.3. audit_event (ID: 01800103) .......................................................180
2.14.4. audit_flood (ID: 01800104) ........................................................181
2.14.5. ike_delete_notification (ID: 01800105) ........................................181
2.14.6. ike_invalid_payload (ID: 01800106) ............................................181
2.14.7. ike_invalid_proposal (ID: 01800107) ........................................... 182
2.14.8. ike_retry_limit_reached (ID: 01800108) ....................................... 182
2.14.9. ike_quickmode_failed (ID: 01800109) .........................................182
2.14.10. packet_corrupt (ID: 01800110) .................................................183
2.14.11. icv_failure (ID: 01800111) .......................................................183
2.14.12. sequence_number_failure (ID: 01800112) ................................... 183
2.14.13. sa_lookup_failure (ID: 01800113) .............................................184
2.14.14. ip_fragment (ID: 01800114) .....................................................184
2.14.15. sequence_number_overflow (ID: 01800115) ................................184
2.14.16. bad_padding (ID: 01800116) ....................................................185
2.14.17. hardware_accelerator_congested (ID: 01800117) ..........................185
2.14.18. hardware_acceleration_failure (ID: 01800118) ............................. 186
2.14.19. commit_failed (ID: 01800200) ..................................................186
2.14.20. commit succeeded (ID: 01800201) .............................................186
2.14.21. IPsec_successfully_started (ID: 01800202) .................................. 187
2.14.22. x509_init_failed (ID: 01800203) ...............................................187
2.14.23. pm_create_failed (ID: 01800204) ..............................................187
2.14.24. failed_to_start_ipsec (ID: 01800206) ..........................................187
2.14.25. failed_create_audit_module (ID: 01800207) ................................188
2.14.26. failed_to_configure_IPsec (ID: 01800210) ..................................188
2.14.27. reconfig_IPsec (ID: 01800211) .................................................188
2.14.28. IPsec_init_failed (ID: 01800213) ...............................................188
Log Reference Guide
10

2.14.29. ipsec_started_successfully (ID: 01800214) ..................................189
2.14.30. Failed_to_add_certificate (ID: 01800302) ................................... 189
2.14.31. Default_IKE_DH_groups_will_be_used (ID: 01800303) ...............189
2.14.32. failed_to_set_algorithm_properties (ID: 01800304) ......................189
2.14.33. failed_to_set_algorithm_properties (ID: 01800305) ......................190
2.14.34. failed_to_add_root_certificate (ID: 01800306) ............................. 190
2.14.35. dns_resolve_failed (ID: 01800308) ............................................190
2.14.36. dns_resolve_failed (ID: 01800309) ............................................191
2.14.37. failed_to_add_peer (ID: 01800312) ............................................ 191
2.14.38. failed_to_add_rules (ID: 01800313) ........................................... 191
2.14.39. failed_to_add_rules (ID: 01800314) ........................................... 192
2.14.40. new_remote_gw_ip (ID: 01800315) ...........................................192
2.14.41. no_policymanager (ID: 01800316) .............................................192
2.14.42. peer_is_dead (ID: 01800317) ....................................................193
2.14.43. failed_to_set_dpd_cb (ID: 01800318) .........................................193
2.14.44. failed_to_add_key_provider (ID: 01800321) ................................193
2.14.45. failed_to_add_certificate (ID: 01800322) .................................... 194
2.14.46. failed_to_set_remote_ID (ID: 01800323) .................................... 194
2.14.47. failed_to_create_authorization (ID: 01800327) .............................194
2.14.48. Failed_to_set_xauth (ID: 01800328) .......................................... 194
2.14.49. Failed_to_create_xauth_group (ID: 01800329) .............................195
2.14.50. IPSec_tunnel_added (ID: 01800333) ..........................................195
2.14.51. IPSec_tunnel_added_bySGW (ID: 01800334) ..............................195
2.14.52. IPSec_tunnel_modified_bySGW (ID: 01800335) .........................196
2.14.53. IPSec_tunnel_modified (ID: 01800336) ......................................196
2.14.54. IPSec_tunnel_removed (ID: 01800337) ......................................196
2.14.55. tunnel_disabled (ID: 01800340) ................................................197
2.14.56. tunnel_cfg_error (ID: 01800341) ...............................................197
2.14.57. ippool_does_not_exist (ID: 01800400) ....................................... 197
2.14.58. cfgmode_ip_freed (ID: 01800402) .............................................197
2.14.59. recieved_packet_to_disabled_IPsec (ID: 01800500) ......................198
2.14.60. recieved_packet_to_disabled_IPsec (ID: 01800501) ......................198
2.14.61. Recieved_plaintext_packet_for_disabled_IPsec_interface (ID: 01800502)
........................................................................................................198
2.14.62. no_remote_gateway (ID: 01800503) .......................................... 199
2.14.63. no_route (ID: 01800504) .........................................................199
2.14.64. ping_keepalive_failed_in_tunnel (ID: 01800505) .........................199
2.14.65. ipsec_interface_disabled (ID: 01800506) ....................................199
2.14.66. maximum_allowed_tunnels_limit_reached (ID: 01800900) ............ 200
2.14.67. SAs_not_killed_for_remote_peer (ID: 01800901) .........................200
2.14.68. sa_write_congestion (ID: 01801337) ..........................................200
2.14.69. sa_write_congestion (ID: 01801338) ..........................................201
2.14.70. trigger_non_ip_packet (ID: 01802001) ....................................... 201
2.14.71. rule_not_active (ID: 01802002) .................................................201
2.14.72. malformed_packet (ID: 01802003) ............................................202
2.14.73. max_ipsec_sa_negotiations_reached (ID: 01802004) ..................... 202
2.14.74. max_number_of_tunnels_reached (ID: 01802011) ........................202
2.14.75. ike_sa_failed (ID: 01802022) ....................................................202
2.14.76. ike_sa_negotiation_completed (ID: 01802024) ............................. 203
2.14.77. ike_sa_negotiation_failed (ID: 01802030) ................................... 203
2.14.78. ike_sa_negotiation_failed (ID: 01802031) ................................... 203
2.14.79. ipsec_sa_negotiation_completed (ID: 01802040) .......................... 204
2.14.80. ipsec_sa_informal (ID: 01802041) .............................................204
2.14.81. ipsec_sa_informal (ID: 01802043) .............................................204
2.14.82. ipsec_sa_informal (ID: 01802044) .............................................205
2.14.83. ipsec_sa_lifetime (ID: 01802045) ..............................................205
2.14.84. ipsec_sa_lifetime (ID: 01802046) ..............................................205
2.14.85. ipsec_sa_lifetime (ID: 01802047) ..............................................206
2.14.86. ipsec_sa_lifetime (ID: 01802048) ..............................................206
2.14.87. ipsec_sa_informal (ID: 01802058) .............................................206
2.14.88. ipsec_invalid_protocol (ID: 01802059) ....................................... 207
2.14.89. ipsec_sa_negotiation_aborted (ID: 01802060) .............................. 207
2.14.90. create_rules_failed (ID: 01802080) ............................................207
Log Reference Guide
11

2.14.91. create_rules_failed (ID: 01802081) ............................................207
2.14.92. no_authentication_method_specified (ID: 01802100) ....................208
2.14.93. no_key_method_configured_for tunnel (ID: 01802102) .................208
2.14.94. invalid_configuration_of_force_open (ID: 01802104) ................... 208
2.14.95. invalid_rule_setting (ID: 01802105) ........................................... 209
2.14.96. invalid_rule_setting (ID: 01802106) ........................................... 209
2.14.97. invalid_rule_setting (ID: 01802107) ........................................... 209
2.14.98. invalid_rule_setting (ID: 01802108) ........................................... 209
2.14.99. invalid_rule_setting (ID: 01802109) ........................................... 210
2.14.100. max_number_of_policy_rules_reached (ID: 01802110) ...............210
2.14.101. suspicious_outbound_rule (ID: 01802114) ................................. 210
2.14.102. no_algorithms_configured_for_tunnel (ID: 01802200) .................210
2.14.103. no_encryption_algorithm_configured_for_tunnel (ID: 01802201) ..211
2.14.104. no_authentication_algorithm_specified (ID: 01802203) ...............211
2.14.105. AH_not_supported (ID: 01802204) ..........................................211
2.14.106. invalid_tunnel_configuration (ID: 01802208) ............................. 212
2.14.107. invalid_tunnel_configuration (ID: 01802209) ............................. 212
2.14.108. invalid_tunnel_configuration (ID: 01802210) ............................. 212
2.14.109. out_of_memory_for_tunnel (ID: 01802211) ...............................213
2.14.110. invalid_key_size (ID: 01802214) .............................................213
2.14.111. invalid_key_size (ID: 01802215) .............................................213
2.14.112. invalid_key_size (ID: 01802216) .............................................213
2.14.113. invalid_key_size (ID: 01802217) .............................................214
2.14.114. invalid_cipher_keysize (ID: 01802218) .....................................214
2.14.115. invalid_key_size (ID: 01802219) .............................................214
2.14.116. invalid_cipher_keysize (ID: 01802220) .....................................215
2.14.117. malformed_tunnel_id_configured (ID: 01802225) ....................... 215
2.14.118. malformed_psk_configured (ID: 01802229) ............................... 215
2.14.119. rule_selection_failed (ID: 01802300) ........................................ 215
2.14.120. max_phase1_sa_reached (ID: 01802400) ...................................216
2.14.121. max_phase1_negotiations_reached (ID: 01802402) .....................216
2.14.122. max_active_quickmode_negotiation_reached (ID: 01802403) ....... 216
2.14.123. could_not_decode_certificate (ID: 01802600) ............................216
2.14.124. could_not_convert_certificate (ID: 01802601) ............................217
2.14.125. could_not_get_subject_nam_from_ca_cert (ID: 01802602) ........... 217
2.14.126. could_not_set_cert_to_non_CRL_issuer (ID: 01802603) ..............217
2.14.127. could_not_force_cert_to_be_trusted (ID: 01802604) ................... 218
2.14.128. could_not_trusted_set_for_cert (ID: 01802605) .......................... 218
2.14.129. could_not_insert_cert_to_db (ID: 01802606) .............................218
2.14.130. could_not_decode_certificate (ID: 01802607) ............................218
2.14.131. could_not_loack_certificate (ID: 01802608) ..............................219
2.14.132. could_not_insert_cert_to_db (ID: 01802609) .............................219
2.14.133. could_not_decode_crl (ID: 01802610) ......................................219
2.14.134. ike_sa_negotiation_completed (ID: 01802703) ...........................219
2.14.135. ike_sa_negotiation_completed (ID: 01802704) ...........................220
2.14.136. Certificate_contains_bad_IP_address (ID: 01802705) ..................220
2.14.137. dn_name_as_subject_alt_name (ID: 01802706) .......................... 220
2.14.138. could_not_decode_certificate (ID: 01802707) ............................221
2.14.139. ike_sa_destroyed (ID: 01802708) .............................................221
2.14.140. cfgmode_exchange_event (ID: 01802709) ................................. 221
2.14.141. remote_access_address (ID: 01802710) ..................................... 222
2.14.142. remote_access_dns (ID: 01802711) ..........................................222
2.14.143. remote_access_wins (ID: 01802712) ........................................222
2.14.144. remote_access_dhcp (ID: 01802713) ........................................223
2.14.145. remote_access_subnets (ID: 01802714) ..................................... 223
2.14.146. event_on_ike_sa (ID: 01802715) .............................................223
2.14.147. ipsec_sa_selection_failed (ID: 01802717) .................................. 223
2.14.148. certificate_search_failed (ID: 01802718) ................................... 224
2.14.149. ipsec_sa_event (ID: 01802730) ...............................................224
2.14.150. ipsec_sa_event (ID: 01802731) ...............................................224
2.14.151. ipsec_sa_destroyed (ID: 01802732) ..........................................225
2.14.152. (ID: 01802735) .....................................................................225
2.14.153. (ID: 01802736) .....................................................................225
Log Reference Guide
12

2.14.154. outofmem_create_engine (ID: 01802901) ..................................226
2.14.155. init_rulelooklup_failed (ID: 01802903) .....................................226
2.14.156. init_rule_looklup_failed (ID: 01802904) ................................... 226
2.14.157. init_rule_looklup_failed (ID: 01802905) ................................... 227
2.14.158. init_mutexes_failed (ID: 01802906) .........................................227
2.14.159. init_interface_table_failed (ID: 01802907) ................................227
2.14.160. init_flow_id_table_failed (ID: 01802908) ..................................227
2.14.161. init_flow_table_failed (ID: 01802909) ......................................228
2.14.162. init_next_hop_table_failed (ID: 01802910) ................................228
2.14.163. init_transform_table_failed (ID: 01802911) ...............................228
2.14.164. init_peer_hash_failed (ID: 01802912) ....................................... 228
2.14.165. init_peer_id_hash_failed (ID: 01802913) ...................................229
2.14.166. init_rule_table_failed (ID: 01802914) ....................................... 229
2.14.167. init_inbound_spi_hash_failed (ID: 01802915) ............................229
2.14.168. init_transform_context_hash_failed (ID: 01802916) ....................229
2.14.169. init_packet_context_cache_failed (ID: 01802917) ....................... 230
2.14.170. init_transform_context_table_failed (ID: 01802918) .................... 230
2.14.171. init_nat_table_failed (ID: 01802919) ........................................230
2.14.172. init_frag_table_failed (ID: 01802920) ....................................... 230
2.14.173. init_engine_tables_failed (ID: 01802921) ..................................231
2.14.174. init_interceptor_failed (ID: 01802922) ......................................231
2.14.175. malformed_ike_sa_proposal (ID: 01803000) .............................. 231
2.14.176. failed_to_select_policy_rule (ID: 01803001) .............................. 231
2.14.177. failed_to_select_ike_sa (ID: 01803002) ....................................232
2.14.178. ike_phase1_notification (ID: 01803003) ....................................232
2.14.179. ipsec_sa_failed (ID: 01803020) ...............................................232
2.14.180. ipsec_sa_statistics (ID: 01803021) ...........................................233
2.14.181. config_mode_exchange_event (ID: 01803022) ...........................233
2.14.182. config_mode_exchange_event (ID: 01803023) ...........................233
2.14.183. xauth_exchange_done (ID: 01803024) ......................................234
2.14.184. config_mode_exchange_event (ID: 01803025) ...........................234
2.14.185. config_mode_exchange_event (ID: 01803026) ...........................234
2.14.186. rejecting_ipsec_sa_delete (ID: 01803027) .................................234
2.14.187. rejecting_ipsec_sa_delete (ID: 01803028) .................................235
2.14.188. ike_phase2_notification (ID: 01803029) ....................................235
2.14.189. ike_qm_notification (ID: 01803030) .........................................235
2.14.190. failed_to_verify_peer_identity (ID: 01803040) ...........................236
2.14.191. malformed_ipsec_sa_proposal (ID: 01803050) ...........................236
2.14.192. malformed_ipsec_esp_proposal (ID: 01803051) ......................... 236
2.14.193. malformed_ipsec_ah_proposal (ID: 01803052) ........................... 237
2.14.194. failed_to_select_ipsec_proposal (ID: 01803053) ......................... 237
2.14.195. failed_to_select_ipsec_sa (ID: 01803054) .................................. 237
2.14.196. ike_responder_mode_not_available (ID: 01803101) ....................237
2.14.197. audit_event (ID: 01803200) ....................................................238
2.14.198. ipsec_hwaccel_failed (ID: 01803410) ....................................... 238
2.15. IP_ERROR .......................................................................................239
2.15.1. too_small_packet (ID: 01500001) ...............................................239
2.15.2. disallwed_ip_ver (ID: 01500002) ................................................239
2.15.3. invalid_ip_length (ID: 01500003) ...............................................239
2.15.4. invalid_ip_length (ID: 01500004) ...............................................240
2.15.5. invalid_ip_checksum (ID: 01500005) ..........................................240
2.16. IP_FLAG ..........................................................................................241
2.16.1. ttl_low (ID: 01600001) ..............................................................241
2.16.2. ip_rsv_flag_set (ID: 01600002) ..................................................241
2.16.3. ip_rsv_flag_set (ID: 01600003) ..................................................241
2.17. IP_OPT ............................................................................................243
2.17.1. source_route (ID: 01700001) ......................................................243
2.17.2. timestamp (ID: 01700002) .........................................................243
2.17.3. router_alert (ID: 01700003) .......................................................243
2.17.4. ipopt_present (ID: 01700004) .....................................................244
2.17.5. ipoptlen_too_small (ID: 01700010) .............................................244
2.17.6. ipoptlen_invalid (ID: 01700011) .................................................244
2.17.7. multiple_ip_option_routes (ID: 01700012) ....................................245
Log Reference Guide
13

2.17.8. bad_length (ID: 01700013) ........................................................245
2.17.9. bad_route_pointer (ID: 01700014) ...............................................245
2.17.10. source_route_disallowed (ID: 01700015) .................................... 246
2.17.11. multiple_ip_option_timestamps (ID: 01700016) ...........................246
2.17.12. bad_timestamp_len (ID: 01700017) ...........................................246
2.17.13. bad_timestamp_pointer (ID: 01700018) ......................................247
2.17.14. bad_timestamp_pointer (ID: 01700019) ......................................247
2.17.15. timestamp_disallowed (ID: 01700020) .......................................247
2.17.16. router_alert_bad_len (ID: 01700021) ..........................................248
2.17.17. router_alert_disallowed (ID: 01700022) ......................................248
2.17.18. ipopt_present_disallowed (ID: 01700023) ................................... 248
2.18. IP_PROTO ........................................................................................250
2.18.1. multicast_ethernet_ip_address_missmatch (ID: 07000011) ...............250
2.18.2. invalid_ip4_header_length (ID: 07000012) ................................... 250
2.18.3. ttl_zero (ID: 07000013) .............................................................250
2.18.4. ttl_low (ID: 07000014) ..............................................................251
2.18.5. ip_rsv_flag_set (ID: 07000015) ..................................................251
2.18.6. oversize_tcp (ID: 07000018) ......................................................251
2.18.7. invalid_tcp_header (ID: 07000019) .............................................252
2.18.8. oversize_udp (ID: 07000021) .....................................................252
2.18.9. invalid_udp_header (ID: 07000022) .............................................252
2.18.10. oversize_icmp (ID: 07000023) ..................................................253
2.18.11. invalid_icmp_header (ID: 07000024) .........................................253
2.18.12. multicast_ethernet_ip_address_missmatch (ID: 07000033) ............. 254
2.18.13. oversize_gre (ID: 07000050) ....................................................254
2.18.14. oversize_esp (ID: 07000051) ....................................................254
2.18.15. oversize_ah (ID: 07000052) .....................................................255
2.18.16. oversize_skip (ID: 07000053) ...................................................255
2.18.17. oversize_ospf (ID: 07000054) ...................................................255
2.18.18. oversize_ipip (ID: 07000055) ...................................................256
2.18.19. oversize_ipcomp (ID: 07000056) ...............................................256
2.18.20. oversize_l2tp (ID: 07000057) ...................................................256
2.18.21. oversize_ip (ID: 07000058) ......................................................257
2.18.22. fragmented_icmp (ID: 07000070) ..............................................257
2.18.23. invalid_icmp_data_too_small (ID: 07000071) .............................. 257
2.18.24. invalid_icmp_data_ip_ver (ID: 07000072) ..................................258
2.18.25. invalid_icmp_data_too_small (ID: 07000073) .............................. 258
2.18.26. invalid_icmp_data_invalid_ip_length (ID: 07000074) ...................259
2.18.27. invalid_icmp_data_invalid_paramprob (ID: 07000075) ................. 259
2.19. L2TP ................................................................................................260
2.19.1. l2tpclient_resolve_successful (ID: 02800001) ................................260
2.19.2. l2tpclient_resolve_failed (ID: 02800002) ......................................260
2.19.3. l2tpclient_init (ID: 02800003) ....................................................260
2.19.4. l2tp_connection_disallowed (ID: 02800004) .................................261
2.19.5. unknown_l2tp_auth_source (ID: 02800005) ..................................261
2.19.6. only_routes_set_up_by_server_iface_allowed (ID: 02800006) .......... 261
2.19.7. l2tp_session_closed (ID: 02800007) ............................................262
2.19.8. l2tp_tunnel_closed (ID: 02800008) ..............................................262
2.19.9. session_closed (ID: 02800009) ...................................................262
2.19.10. l2tp_session_request (ID: 02800010) ..........................................263
2.19.11. l2tp_session_up (ID: 02800011) ................................................263
2.19.12. l2tp_no_userauth_rule_found (ID: 02800014) ..............................263
2.19.13. l2tp_session_request (ID: 02800015) ..........................................264
2.19.14. l2tp_session_up (ID: 02800016) ................................................264
2.19.15. failure_init_radius_accounting (ID: 02800017) ............................ 264
2.19.16. l2tpclient_tunnel_up (ID: 02800018) ..........................................265
2.19.17. malformed_packet (ID: 02800019) ............................................265
2.19.18. waiting_for_ip_to_listen_on (ID: 02800050) ............................... 265
2.20. LICUPDATE .....................................................................................266
2.20.1. license_update_failure (ID: 05500001) .........................................266
2.20.2. license_downloaded (ID: 05500002) ............................................266
2.20.3. license_already_up_to_date (ID: 05500003) ..................................266
2.21. PPP ..................................................................................................267
Log Reference Guide
14

2.21.1. ip_pool_empty (ID: 02500001) ...................................................267
2.21.2. ip_address_required_but_not_received (ID: 02500002) ................... 267
2.21.3. primary_dns_address_required_but_not_received (ID: 02500003) ..... 267
2.21.4. seconday_dns_address_required_but_not_received (ID: 02500004) ... 268
2.21.5. primary_nbns_address_required_but_not_received (ID: 02500005) ... 268
2.21.6. seconday_nbns_address_required_but_not_received (ID: 02500006) . 268
2.21.7. failed_to_agree_on_authentication_protocol (ID: 02500050) ............269
2.21.8. peer_refuses_to_use_authentication (ID: 02500051) ....................... 269
2.21.9. lcp_negotiation_stalled (ID: 02500052) ........................................269
2.21.10. ppp_tunnel_limit_exceeded (ID: 02500100) ................................ 270
2.21.11. authentication_failed (ID: 02500101) .........................................270
2.21.12. response_value_too_long (ID: 02500150) ................................... 270
2.21.13. username_too_long (ID: 02500151) ........................................... 271
2.21.14. username_too_long (ID: 02500201) ........................................... 271
2.21.15. username_too_long (ID: 02500301) ........................................... 271
2.21.16. username_too_long (ID: 02500350) ........................................... 271
2.21.17. password_too_long (ID: 02500351) ...........................................272
2.21.18. unsupported_auth_server (ID: 02500500) ....................................272
2.21.19. radius_error (ID: 02500501) .....................................................272
2.21.20. authdb_error (ID: 02500502) ....................................................273
2.21.21. ldap_error (ID: 02500503) .......................................................273
2.21.22. MPPE_decrypt_fail (ID: 02500600) ........................................... 273
2.22. PPPOE .............................................................................................274
2.22.1. pppoe_tunnel_up (ID: 02600001) ................................................274
2.22.2. pppoe_tunnel_closed (ID: 02600002) ........................................... 274
2.23. PPTP ................................................................................................275
2.23.1. pptpclient_resolve_successful (ID: 02700001) ...............................275
2.23.2. pptpclient_resolve_failed (ID: 02700002) .....................................275
2.23.3. pptp_connection_disallowed (ID: 02700003) ................................. 275
2.23.4. unknown_pptp_auth_source (ID: 02700004) .................................276
2.23.5. user_disconnected (ID: 02700005) ..............................................276
2.23.6. only_routes_set_up_by_server_iface_allowed (ID: 02700006) .......... 276
2.23.7. mppe_required (ID: 02700007) ...................................................277
2.23.8. pptp_session_closed (ID: 02700008) ............................................277
2.23.9. pptp_session_request (ID: 02700009) ..........................................277
2.23.10. unsupported_message (ID: 02700010) ........................................278
2.23.11. failure_init_radius_accounting (ID: 02700011) ............................ 278
2.23.12. pptp_session_up (ID: 02700012) ...............................................278
2.23.13. pptp_session_up (ID: 02700013) ...............................................279
2.23.14. tunnel_idle_timeout (ID: 02700014) ..........................................279
2.23.15. session_idle_timeout (ID: 02700015) .........................................280
2.23.16. pptpclient_start (ID: 02700017) .................................................280
2.23.17. pptpclient_connected (ID: 02700018) .........................................280
2.23.18. pptp_tunnel_up (ID: 02700019) ................................................281
2.23.19. ctrlconn_refused (ID: 02700020) ...............................................281
2.23.20. pptp_tunnel_up (ID: 02700021) ................................................281
2.23.21. pptp_tunnel_closed (ID: 02700022) ...........................................282
2.23.22. pptp_connection_disallowed (ID: 02700024) ...............................282
2.23.23. unknown_pptp_auth_source (ID: 02700025) ................................282
2.23.24. pptp_no_userauth_rule_found (ID: 02700026) ............................. 283
2.23.25. malformed_packet (ID: 02700027) ............................................283
2.23.26. waiting_for_ip_to_listen_on (ID: 02700050) ............................... 283
2.24. REASSEMBLY .................................................................................284
2.24.1. ack_of_not_transmitted_data (ID: 04800002) ................................284
2.24.2. invalid_tcp_checksum (ID: 04800003) .........................................284
2.24.3. mismatching_data_in_overlapping_tcp_segment (ID: 04800004) ...... 284
2.24.4. memory_allocation_failure (ID: 04800005) ...................................285
2.24.5. drop_due_to_buffer_starvation (ID: 04800007) ..............................285
2.24.6. failed_to_send_ack (ID: 04800008) .............................................285
2.24.7. processing_memory_limit_reached (ID: 04800009) ........................285
2.24.8. maximum_connections_limit_reached (ID: 04800010) ....................286
2.24.9. state_memory_allocation_failed (ID: 04800011) ............................286
2.25. RULE ..............................................................................................287
Log Reference Guide
15

2.25.1. ruleset_fwdfast (ID: 06000003) ..................................................287
2.25.2. ip_verified_access (ID: 06000005) ..............................................287
2.25.3. rule_match (ID: 06000006) ........................................................287
2.25.4. rule_match (ID: 06000007) ........................................................288
2.25.5. block0net (ID: 06000010) ..........................................................288
2.25.6. block0net (ID: 06000011) ..........................................................288
2.25.7. block127net (ID: 06000012) .......................................................289
2.25.8. block127net (ID: 06000013) .......................................................289
2.25.9. directed_broadcasts (ID: 06000030) .............................................289
2.25.10. directed_broadcasts (ID: 06000031) ........................................... 290
2.25.11. unknown_vlanid (ID: 06000040) ...............................................290
2.25.12. ruleset_reject_packet (ID: 06000050) .........................................290
2.25.13. ruleset_drop_packet (ID: 06000051) .......................................... 290
2.25.14. unhandled_local (ID: 06000060) ...............................................291
2.26. SESMGR ..........................................................................................292
2.26.1. sesmgr_session_created (ID: 04900001) ....................................... 292
2.26.2. sesmgr_session_denied (ID: 04900002) ........................................ 292
2.26.3. sesmgr_session_removed (ID: 04900003) .....................................292
2.26.4. sesmgr_access_set (ID: 04900004) ..............................................293
2.26.5. sesmgr_session_timeout (ID: 04900005) ...................................... 293
2.26.6. sesmgr_upload_denied (ID: 04900006) ........................................293
2.26.7. sesmgr_console_denied (ID: 04900007) ....................................... 294
2.26.8. sesmgr_session_maximum_reached (ID: 04900008) ....................... 294
2.26.9. sesmgr_allocate_error (ID: 04900009) ......................................... 294
2.26.10. sesmgr_session_activate (ID: 04900010) ..................................... 295
2.26.11. sesmgr_session_disabled (ID: 04900011) .................................... 295
2.26.12. sesmgr_console_denied_init (ID: 04900012) ............................... 295
2.26.13. sesmgr_session_access_missing (ID: 04900015) ..........................296
2.26.14. sesmgr_session_old_removed (ID: 04900016) .............................296
2.26.15. sesmgr_file_error (ID: 04900017) ..............................................296
2.26.16. sesmgr_techsupport (ID: 04900018) ........................................... 297
2.27. SMTPLOG ........................................................................................298
2.27.1. unable_to_establish_connection (ID: 03000001) ............................298
2.27.2. connect_timeout (ID: 03000002) .................................................298
2.27.3. send_failure (ID: 03000004) .......................................................298
2.27.4. receive_timeout (ID: 03000005) ..................................................299
2.27.5. rejected_connect (ID: 03000006) ................................................299
2.27.6. rejected_ehlo_helo (ID: 03000007) ..............................................299
2.27.7. rejected_sender (ID: 03000008) ..................................................299
2.27.8. rejected_recipient (ID: 03000009) ...............................................300
2.27.9. rejected_all_recipients (ID: 03000010) .........................................300
2.27.10. rejected_data (ID: 03000011) ....................................................300
2.27.11. rejected_message_text (ID: 03000012) ....................................... 301
2.28. SYSTEM ..........................................................................................302
2.28.1. demo_expired (ID: 03200020) ....................................................302
2.28.2. demo_mode (ID: 03200021) .......................................................302
2.28.3. reset_clock (ID: 03200100) ........................................................302
2.28.4. reset_clock (ID: 03200101) ........................................................303
2.28.5. invalid_ip_match_access_section (ID: 03200110) ..........................303
2.28.6. nitrox2_watchdog_triggered (ID: 03200207) ................................. 303
2.28.7. nitrox2_restarted (ID: 03200208) ................................................303
2.28.8. hardware_watchdog_initialized (ID: 03200260) ............................. 304
2.28.9. port_bind_failed (ID: 03200300) .................................................304
2.28.10. port_bind_failed (ID: 03200301) ...............................................304
2.28.11. port_hlm_conversion (ID: 03200302) .........................................305
2.28.12. port_llm_conversion (ID: 03200303) ..........................................305
2.28.13. log_messages_lost_due_to_throttling (ID: 03200400) ....................305
2.28.14. log_messages_lost_due_to_log_buffer_exhaust (ID: 03200401) ...... 306
2.28.15. ssl_encryption_failed (ID: 03200450) .........................................306
2.28.16. bidir_fail (ID: 03200600) .........................................................306
2.28.17. disk_cannot_remove_file (ID: 03200601) ...................................307
2.28.18. file_open_failed (ID: 03200602) ...............................................307
2.28.19. disk_cannot_remove (ID: 03200603) ..........................................307
Log Reference Guide
16

2.28.20. disk_cannot_rename (ID: 03200604) ..........................................308
2.28.21. cfg_switch_fail (ID: 03200605) .................................................308
2.28.22. core_switch_fail (ID: 03200606) ...............................................308
2.28.23. bidir_ok (ID: 03200607) ..........................................................308
2.28.24. shutdown (ID: 03201000) ........................................................309
2.28.25. shutdown (ID: 03201010) ........................................................309
2.28.26. shutdown (ID: 03201011) ........................................................309
2.28.27. config_activation (ID: 03201020) ..............................................310
2.28.28. reconfiguration (ID: 03201021) .................................................310
2.28.29. startup_normal (ID: 03202000) .................................................310
2.28.30. startup_echo (ID: 03202001) ....................................................311
2.28.31. shutdown (ID: 03202500) ........................................................311
2.28.32. admin_login (ID: 03203000) ....................................................312
2.28.33. admin_logout (ID: 03203001) ...................................................312
2.28.34. admin_login_failed (ID: 03203002) ...........................................312
2.28.35. activate_changes_failed (ID: 03204000) .....................................313
2.28.36. accept_configuration (ID: 03204001) .........................................313
2.28.37. reject_configuration (ID: 03204002) .......................................... 313
2.28.38. date_time_modified (ID: 03205000) ..........................................314
2.28.39. admin_timeout (ID: 03206000) .................................................314
2.28.40. admin_login_group_mismatch (ID: 03206001) ............................ 314
2.28.41. admin_login_internal_error (ID: 03206002) ................................315
2.29. TCP_FLAG .......................................................................................316
2.29.1. tcp_flags_set (ID: 03300001) .....................................................316
2.29.2. tcp_flags_set (ID: 03300002) .....................................................316
2.29.3. tcp_flag_set (ID: 03300003) .......................................................316
2.29.4. tcp_flag_set (ID: 03300004) .......................................................317
2.29.5. tcp_null_flags (ID: 03300005) ....................................................317
2.29.6. tcp_flags_set (ID: 03300008) .....................................................317
2.29.7. tcp_flag_set (ID: 03300009) .......................................................318
2.29.8. unexpected_tcp_flags (ID: 03300010) ..........................................318
2.29.9. mismatched_syn_resent (ID: 03300011) ....................................... 318
2.29.10. mismatched_first_ack_seqno (ID: 03300012) ..............................319
2.29.11. mismatched_first_ack_seqno (ID: 03300013) ..............................319
2.29.12. rst_out_of_bounds (ID: 03300015) ............................................320
2.29.13. tcp_seqno_too_low (ID: 03300016) ...........................................320
2.29.14. unacceptable_ack (ID: 03300017) ..............................................320
2.29.15. rst_without_ack (ID: 03300018) ................................................321
2.29.16. tcp_seqno_too_high (ID: 03300019) .......................................... 321
2.29.17. tcp_recv_windows_drained (ID: 03300022) ................................322
2.29.18. tcp_snd_windows_drained (ID: 03300023) ..................................322
2.29.19. tcp_get_freesocket_failed (ID: 03300024) ................................... 322
2.29.20. tcp_seqno_too_low_with_syn (ID: 03300025) .............................323
2.30. TCP_OPT .........................................................................................324
2.30.1. tcp_mss_too_low (ID: 03400001) ...............................................324
2.30.2. tcp_mss_too_low (ID: 03400002) ...............................................324
2.30.3. tcp_mss_too_high (ID: 03400003) ...............................................324
2.30.4. tcp_mss_too_high (ID: 03400004) ...............................................325
2.30.5. tcp_mss_above_log_level (ID: 03400005) ....................................325
2.30.6. tcp_option (ID: 03400006) .........................................................325
2.30.7. tcp_option_strip (ID: 03400007) .................................................326
2.30.8. bad_tcpopt_length (ID: 03400010) ..............................................326
2.30.9. bad_tcpopt_length (ID: 03400011) ..............................................327
2.30.10. bad_tcpopt_length (ID: 03400012) .............................................327
2.30.11. tcp_mss_too_low (ID: 03400013) ..............................................327
2.30.12. tcp_mss_too_high (ID: 03400014) .............................................328
2.30.13. tcp_option_disallowed (ID: 03400015) ....................................... 328
2.30.14. tcp_null_flags (ID: 03400016) ..................................................328
2.30.15. multiple_tcp_ws_options (ID: 03400017) ....................................329
2.30.16. too_large_tcp_window_scale (ID: 03400018) ..............................329
2.30.17. mismatching_tcp_window_scale (ID: 03400019) ..........................329
2.31. TIMESYNC ......................................................................................331
2.31.1. synced_clock (ID: 03500001) .....................................................331
Log Reference Guide
17

2.31.2. failure_communicate_with_timeservers (ID: 03500002) ..................331
2.31.3. clockdrift_too_high (ID: 03500003) .............................................331
2.32. TRANSPARENCY .............................................................................333
2.32.1. impossible_hw_sender_address (ID: 04400410) ............................. 333
2.32.2. enet_hw_sender_broadcast (ID: 04400411) ................................... 333
2.32.3. enet_hw_sender_broadcast (ID: 04400412) ................................... 333
2.32.4. enet_hw_sender_broadcast (ID: 04400413) ................................... 334
2.32.5. enet_hw_sender_multicast (ID: 04400414) ...................................334
2.32.6. enet_hw_sender_multicast (ID: 04400415) ...................................334
2.32.7. enet_hw_sender_multicast (ID: 04400416) ...................................335
2.32.8. relay_stp_frame (ID: 04400417) .................................................335
2.32.9. dropped_stp_frame (ID: 04400418) .............................................335
2.32.10. invalid_stp_frame (ID: 04400419) .............................................336
2.32.11. relay_mpls_frame (ID: 04400420) .............................................336
2.32.12. dropped_mpls_packet (ID: 04400421) ........................................336
2.32.13. invalid_mpls_packet (ID: 04400422) ..........................................336
2.33. USERAUTH .....................................................................................338
2.33.1. accounting_start (ID: 03700001) .................................................338
2.33.2. invalid_accounting_start_server_response (ID: 03700002) ............... 338
2.33.3. no_accounting_start_server_response (ID: 03700003) .....................338
2.33.4. invalid_accounting_start_server_response (ID: 03700004) ............... 339
2.33.5. no_accounting_start_server_response (ID: 03700005) .....................339
2.33.6. invalid_accounting_start_server_response (ID: 03700006) ............... 339
2.33.7. failed_to_send_accounting_stop (ID: 03700007) ............................340
2.33.8. accounting_stop (ID: 03700008) .................................................340
2.33.9. invalid_accounting_stop_server_response (ID: 03700009) ............... 341
2.33.10. no_accounting_stop_server_response (ID: 03700010) ................... 341
2.33.11. invalid_accounting_stop_server_response (ID: 03700011) .............341
2.33.12. failure_init_radius_accounting (ID: 03700012) ............................ 342
2.33.13. invalid_accounting_start_request (ID: 03700013) ......................... 342
2.33.14. no_accounting_start_server_response (ID: 03700014) ................... 342
2.33.15. user_timeout (ID: 03700020) ....................................................343
2.33.16. user_timeout_removed_delayed_user (ID: 03700021) ................... 343
2.33.17. group_list_too_long (ID: 03700030) .......................................... 343
2.33.18. accounting_alive (ID: 03700050) ...............................................344
2.33.19. accounting_interim_failure (ID: 03700051) ................................. 344
2.33.20. no_accounting_interim_server_response (ID: 03700052) ............... 344
2.33.21. invalid_accounting_interim_server_response (ID: 03700053) ......... 345
2.33.22. invalid_accounting_interim_server_response (ID: 03700054) ......... 345
2.33.23. relogin_from_new_srcip (ID: 03700100) ....................................346
2.33.24. already_logged_in (ID: 03700101) .............................................346
2.33.25. user_login (ID: 03700102) .......................................................346
2.33.26. bad_user_credentials (ID: 03700104) .........................................347
2.33.27. radius_auth_timeout (ID: 03700105) ..........................................347
2.33.28. manual_logout (ID: 03700106) .................................................347
2.33.29. userauthrules_disallowed (ID: 03700107) ...................................347
2.33.30. challenges_not_supported (ID: 03700108) ...................................348
2.33.31. ldap_auth_error (ID: 03700109) ................................................348
2.33.32. user_logout (ID: 03700110) ......................................................348
2.33.33. ldap_session_new_out_of_memory (ID: 03700401) ......................349
2.33.34. cant_create_new_request (ID: 03700402) ....................................349
2.33.35. ldap_user_authentication_successful (ID: 03700403) ....................349
2.33.36. ldap_user_authentication_failed (ID: 03700404) ........................... 350
2.33.37. ldap_context_new_out_of_memory (ID: 03700405) ......................350
2.33.38. user_req_new_out_of_memory (ID: 03700406) ........................... 350
2.33.39. failed_admin_bind (ID: 03700407) ............................................350
2.33.40. invalid_username_or_password (ID: 03700408) ...........................351
2.33.41. failed_retrieve_password (ID: 03700409) ....................................351
2.33.42. no_shared_ciphers (ID: 03700500) ............................................351
2.33.43. disallow_clientkeyexchange (ID: 03700501) ................................352
2.33.44. bad_packet_order (ID: 03700502) .............................................352
2.33.45. bad_clienthello_msg (ID: 03700503) ..........................................352
2.33.46. bad_changecipher_msg (ID: 03700504) ......................................353
Log Reference Guide
18

2.33.47. bad_clientkeyexchange_msg (ID: 03700505) ...............................353
2.33.48. bad_clientfinished_msg (ID: 03700506) ..................................... 353
2.33.49. bad_alert_msg (ID: 03700507) ..................................................354
2.33.50. unknown_ssl_error (ID: 03700508) ............................................354
2.33.51. negotiated_cipher_does_not_permit_the_chosen_certificate_size (ID:
03700509) ........................................................................................354
2.33.52. received_sslalert (ID: 03700510) ...............................................354
2.33.53. sent_sslalert (ID: 03700511) .....................................................355
Log Reference Guide
19

List of Tables
1. Abbreviations ..................................................................................................23
20