ipSEC vpn dropped every day in peak hours

Unanswered Question
Jun 23rd, 2010

Hi, there,

our l2l vpn keeps dropping around 11am and 4pm, never happened during night and weekend.

the main errior is"Removing peer from correlator table failed, no match!"

the detail log is attached(from asa side)

pls help me with this

we are using asa5510 7.0 and pix 501 6.3

part of the log

"4|Jun 23 2010 10:31:00|713903: IP = x.x.x.138, Error: Unable to remove PeerTblEntry
3|Jun 23 2010 10:31:00|713902: IP = x.x.x.138, Removing peer from peer table failed, no match!
7|Jun 23 2010 10:31:00|713906: IP = x.x.x.138, sending delete/delete with reason message
7|Jun 23 2010 10:31:00|713906: IP = x.x.x.138, IKE SA MM:4d24e98b terminating:  flags 0x01000002, refcnt 0, tuncnt 0
7|Jun 23 2010 10:31:00|715065: IP = x.x.x.138, IKE MM Responder FSM error history (struct &0x1930e90)  <state>, <event>:  MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent
4|Jun 23 2010 10:30:54|713903: IP = x.x.x.138, Error: Unable to remove PeerTblEntry
3|Jun 23 2010 10:30:54|713902: IP = x.x.x.138, Removing peer from peer table failed, no match!
7|Jun 23 2010 10:30:54|713906: IP = x.x.x.138, sending delete/delete with reason message
7|Jun 23 2010 10:30:54|713906: IP = x.x.x.138, IKE SA MM:57d21f6d terminating:  flags 0x01000002, refcnt 0, tuncnt 0
7|Jun 23 2010 10:30:54|715065: IP = x.x.x.138, IKE MM Responder FSM error history (struct &0x398d228)  <state>, <event>:  MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent
7|Jun 23 2010 10:30:52|713236: IP = x.x.x.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108
7|Jun 23 2010 10:30:46|713236: IP = x.x.x.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108
7|Jun 23 2010 10:30:44|713236: IP = x.x.x.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108
6|Jun 23 2010 10:30:44|713905: IP = x.x.x.138, P1 Retransmit msg dispatched to MM FSM
5|Jun 23 2010 10:30:44|713201: IP = x.x.x.138, Duplicate Phase 1 packet detected.  Retransmitting last packet.
6|Jun 23 2010 10:30:43|713219: IP = x.x.x.138, Queuing KEY-ACQUIRE messages to be processed when P1 SA is complete.
7|Jun 23 2010 10:30:42|713236: IP = x.x.x.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108
7|Jun 23 2010 10:30:38|713236: IP = x.x.x.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108
7|Jun 23 2010 10:30:34|713236: IP = x.x.x.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108
7|Jun 23 2010 10:30:34|715046: IP = x.x.x.138, constructing Fragmentation VID + extended capabilities payload
7|Jun 23 2010 10:30:34|715046: IP = x.x.x.138, constructing ISAKMP SA payload
7|Jun 23 2010 10:30:34|715028: IP = x.x.x.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 5
7|Jun 23 2010 10:30:34|715047: IP = x.x.x.138, processing IKE SA payload
7|Jun 23 2010 10:30:34|715049: IP = x.x.x.138, Received DPD VID
7|Jun 23 2010 10:30:34|715047: IP = x.x.x.138, processing VID payload
7|Jun 23 2010 10:30:34|713906: IP = x.x.x.138, Oakley proposal is acceptable
7|Jun 23 2010 10:30:34|715047: IP = x.x.x.138, processing SA payload
7|Jun 23 2010 10:30:34|713236: IP = x.x.x.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 104
7|Jun 23 2010 10:30:30|713236: IP = x.x.x.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108
7|Jun 23 2010 10:30:22|713236: IP = x.x.x.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108
7|Jun 23 2010 10:30:22|715046: IP = x.x.x.138, constructing Fragmentation VID + extended capabilities payload
7|Jun 23 2010 10:30:22|715046: IP = x.x.x.138, constructing ISAKMP SA payload
7|Jun 23 2010 10:30:22|715028: IP = x.x.x.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 5
7|Jun 23 2010 10:30:22|715047: IP = x.x.x.138, processing IKE SA payload
7|Jun 23 2010 10:30:22|715049: IP = x.x.x.138, Received DPD VID
7|Jun 23 2010 10:30:22|715047: IP = x.x.x.138, processing VID payload
7|Jun 23 2010 10:30:22|713906: IP = x.x.x.138, Oakley proposal is acceptable
7|Jun 23 2010 10:30:22|715047: IP = x.x.x.138, processing SA payload
7|Jun 23 2010 10:30:22|713236: IP = x.x.x.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 104
4|Jun 23 2010 10:30:18|713903: IP = x.x.x.138, Error: Unable to remove PeerTblEntry
3|Jun 23 2010 10:30:18|713902: IP = x.x.x.138, Removing peer from peer table failed, no match!
7|Jun 23 2010 10:30:18|713906: IP = x.x.x.138, sending delete/delete with reason message

"

appreciated.

Alex

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Marcin Latosiewicz Wed, 06/23/2010 - 09:37

Alex,


Looks like the other side is not reciving IKE MM2 message.

ie. we recive a initiation MM1 and send back MM2 which never makes it to the other side and IKE negotiation times out on ASA.

Over and over.

Any chance there is packet loss on the wire or QoS that could throttle IKE messages?

Extending phase1 liftime MAY alleviate the issue, but problem is not well rounded up to conclude.

Marcin

DTSCanada Wed, 06/23/2010 - 09:57

Hi,Marcin:

Thanks a lot for the reply.

This happen only on peak hours a week ago and happened everyday( working days).

now the timeout for Ph1 is 86400(24 hours), is this long enough?

plus, want to confirm if this would  be some issue of setup(though the tunnel is up most of the time).

I realize IPSec tunnel is up but IKE is down, is this right?

thanks for your help.

Alex

Marcin Latosiewicz Wed, 06/23/2010 - 10:15

Alex,

24hours for phase 1 lifetime are default and OK.

Yes in L2L there is a chance IPsec is up while IKE is down.

"show crypto ipsec sa peer IP_ADDRESS_HERE" will tell you if SAs are up.

It all depends ...

Are the two sites on the internet and there is nothing to do QoS/rate-limiting anything to explain why the communication for IKE appear to be one way?

DTSCanada Thu, 06/24/2010 - 08:09

HI, Marcin,

do you have any idea for me to trouble shooting this error, it's so frustrating.

I called my isp they said our net utilization is 86% and normal, is that right?

we are using adsl .

I really need get this fixed ASAP.

Thank you very much.

Alex

DTSCanada Thu, 06/24/2010 - 08:23

Hi, Marcin,

I am now suffering for this VPN dropping problem,

Would you please take a look at this issue?

Best Regards,

Alex

Marcin Latosiewicz Thu, 06/24/2010 - 08:29

Alex,

If you need a complete action on Cisco's side I would honestly suggest to open a case with TAC.

If you can get.
----

deb cry isa 100

deb crypto ipsec 100

-----

on both sides we can tell you more.

Marcin

Marcin Latosiewicz Thu, 06/24/2010 - 08:34

Alex,

The logs you've shown initially show the device waiting for further messages from other side.

ASA 7.0 is quite old, would you consider a blind upgrade? 8.0.5 maybe?

Please note that the upgrade will not exaplin what we're seeing in the logs.

Marcin

DTSCanada Thu, 06/24/2010 - 09:25

7|Jun 24 2010 11:41:55|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:41:49|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 256

7|Jun 24 2010 11:41:49|713906: Group = DefaultRAGroup, IP = x.x.198.138, Generating keys for Responder...

7|Jun 24 2010 11:41:49|713906: IP = x.x.198.138, Connection landed on tunnel_group DefaultRAGroup

7|Jun 24 2010 11:41:49|715048: IP = x.x.198.138, Send Altiga/Cisco VPN3000/Cisco ASA GW VID

7|Jun 24 2010 11:41:49|715046: IP = x.x.198.138, constructing VID payload

7|Jun 24 2010 11:41:49|715038: IP = x.x.198.138, Constructing ASA spoofing IOS Vendor ID payload (version: 1.0.0, capabilities: 20000001)

7|Jun 24 2010 11:41:49|715048: IP = x.x.198.138, Send IOS VID

7|Jun 24 2010 11:41:49|715046: IP = x.x.198.138, constructing xauth V6 VID payload

7|Jun 24 2010 11:41:49|715046: IP = x.x.198.138, constructing Cisco Unity VID payload

7|Jun 24 2010 11:41:49|715046: IP = x.x.198.138, constructing nonce payload

7|Jun 24 2010 11:41:49|715046: IP = x.x.198.138, constructing ke payload

7|Jun 24 2010 11:41:49|715047: IP = x.x.198.138, processing nonce payload

7|Jun 24 2010 11:41:49|715047: IP = x.x.198.138, processing ISA_KE payload

7|Jun 24 2010 11:41:49|715047: IP = x.x.198.138, processing ke payload

7|Jun 24 2010 11:41:49|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + NONE (0) total length : 180

7|Jun 24 2010 11:41:48|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:41:48|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 11:41:48|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 11:41:48|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 11:41:48|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 11:41:48|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 11:41:48|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 11:41:48|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

7|Jun 24 2010 11:41:47|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:41:47|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 11:41:47|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 11:41:47|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 11:41:47|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 11:41:47|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 11:41:47|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 11:41:47|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

6|Jun 24 2010 11:41:44|302014: Teardown TCP connection 1078 for outside:x.x.198.138/16546 to NP Identity Ifc:66.92.228.251/443 duration 0:00:01 bytes 937 TCP FINs

6|Jun 24 2010 11:41:44|605005: Login permitted from x.x.198.138/16546 to outside:66.92.228.251/https for user "alex"

6|Jun 24 2010 11:41:43|302013: Built inbound TCP connection 1078 for outside:x.x.198.138/16546 (x.x.198.138/16546) to NP Identity Ifc:66.92.228.251/443 (66.92.228.251/443)

4|Jun 24 2010 11:41:42|713903: IP = x.x.198.138, Error: Unable to remove PeerTblEntry

3|Jun 24 2010 11:41:42|713902: IP = x.x.198.138, Removing peer from peer table failed, no match!

7|Jun 24 2010 11:41:42|713906: IP = x.x.198.138, sending delete/delete with reason message

7|Jun 24 2010 11:41:42|713906: IP = x.x.198.138, IKE SA MM:7f14d974 terminating:  flags 0x01000002, refcnt 0, tuncnt 0

7|Jun 24 2010 11:41:42|715065: IP = x.x.198.138, IKE MM Responder FSM error history (struct &0x3946b30)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent

6|Jun 24 2010 11:41:41|605005: Login permitted from x.x.198.138/16548 to outside:66.92.228.251/https for user "alex"

6|Jun 24 2010 11:41:41|302013: Built inbound TCP connection 1063 for outside:x.x.198.138/16548 (x.x.198.138/16548) to NP Identity Ifc:66.92.228.251/443 (66.92.228.251/443)

6|Jun 24 2010 11:41:40|302014: Teardown TCP connection 1062 for outside:x.x.198.138/16544 to NP Identity Ifc:66.92.228.251/443 duration 0:00:01 bytes 852 TCP FINs

6|Jun 24 2010 11:41:39|605005: Login permitted from x.x.198.138/16544 to outside:66.92.228.251/https for user "alex"

6|Jun 24 2010 11:41:39|302013: Built inbound TCP connection 1062 for outside:x.x.198.138/16544 (x.x.198.138/16544) to NP Identity Ifc:66.92.228.251/443 (66.92.228.251/443)

6|Jun 24 2010 11:41:37|302014: Teardown TCP connection 1061 for outside:x.x.198.138/16542 to NP Identity Ifc:66.92.228.251/443 duration 0:00:01 bytes 905 TCP FINs

6|Jun 24 2010 11:41:37|605005: Login permitted from x.x.198.138/16542 to outside:66.92.228.251/https for user "alex"

7|Jun 24 2010 11:41:36|710002: TCP access permitted from x.x.198.138/16542 to outside:66.92.228.251/https

6|Jun 24 2010 11:41:36|302013: Built inbound TCP connection 1061 for outside:x.x.198.138/16542 (x.x.198.138/16542) to NP Identity Ifc:66.92.228.251/443 (66.92.228.251/443)

7|Jun 24 2010 11:41:34|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

6|Jun 24 2010 11:41:30|302014: Teardown TCP connection 904 for outside:x.x.198.138/16538 to NP Identity Ifc:66.92.228.251/22 duration 0:01:42 bytes 23872 TCP FINs

6|Jun 24 2010 11:41:29|315011: SSH session from x.x.198.138 on interface outside for user "alex" terminated normally

7|Jun 24 2010 11:41:26|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

6|Jun 24 2010 11:41:26|713905: IP = x.x.198.138, P1 Retransmit msg dispatched to MM FSM

5|Jun 24 2010 11:41:26|713201: IP = x.x.198.138, Duplicate Phase 1 packet detected.  Retransmitting last packet.

7|Jun 24 2010 11:41:24|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:41:16|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:41:16|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 11:41:16|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 11:41:16|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 11:41:16|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 11:41:16|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 11:41:16|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 11:41:16|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

7|Jun 24 2010 11:41:14|713906: Group = DefaultL2LGroup, IP = x.x.198.138, Responder resending last msg

6|Jun 24 2010 11:41:14|713905: Group = DefaultL2LGroup, IP = x.x.198.138, P1 Retransmit msg dispatched to MM FSM

5|Jun 24 2010 11:41:14|713201: Group = DefaultL2LGroup, IP = x.x.198.138, Duplicate Phase 1 packet detected.  Retransmitting last packet.

7|Jun 24 2010 11:41:08|713906: IP = x.x.198.138, sending delete/delete with reason message

7|Jun 24 2010 11:41:08|713906: IP = x.x.198.138, IKE SA MM:bf61672f terminating:  flags 0x01000002, refcnt 0, tuncnt 0

7|Jun 24 2010 11:41:08|715065: IP = x.x.198.138, IKE MM Responder FSM error history (struct &0x395c160)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent

7|Jun 24 2010 11:41:04|713906: Group = DefaultL2LGroup, IP = x.x.198.138, Starting phase 1 rekey timer: 64800000 (ms)

3|Jun 24 2010 11:41:04|713122: IP = x.x.198.138, Keep-alives configured on but peer does not support keep-alives (type = None)

7|Jun 24 2010 11:41:04|713121: IP = x.x.198.138, Keep-alive type for this connection: None

3|Jun 24 2010 11:41:04|713119: Group = DefaultL2LGroup, IP = x.x.198.138, PHASE 1 COMPLETED

7|Jun 24 2010 11:41:04|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) + VENDOR (13) + NONE (0) total length : 84

7|Jun 24 2010 11:41:04|715046: Group = DefaultL2LGroup, IP = x.x.198.138, constructing dpd vid payload

7|Jun 24 2010 11:41:04|715076: Group = DefaultL2LGroup, IP = x.x.198.138, Computing hash for ISAKMP

7|Jun 24 2010 11:41:04|715046: Group = DefaultL2LGroup, IP = x.x.198.138, constructing hash payload

7|Jun 24 2010 11:41:04|715046: Group = DefaultL2LGroup, IP = x.x.198.138, constructing ID payload

4|Jun 24 2010 11:41:04|713903: Group = DefaultL2LGroup, IP = x.x.198.138, Freeing previously allocated memory for authorization-dn-attributes

7|Jun 24 2010 11:41:04|713906: IP = x.x.198.138, Connection landed on tunnel_group DefaultL2LGroup

7|Jun 24 2010 11:41:04|715076: Group = DefaultL2LGroup, IP = x.x.198.138, Computing hash for ISAKMP

7|Jun 24 2010 11:41:04|715047: Group = DefaultL2LGroup, IP = x.x.198.138, processing hash payload

7|Jun 24 2010 11:41:04|714011: Group = DefaultL2LGroup, IP = x.x.198.138, ID_IPV4_ADDR ID received

7|Jun 24 2010 11:41:04|715047: Group = DefaultL2LGroup, IP = x.x.198.138, processing ID payload

7|Jun 24 2010 11:41:04|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) + NONE (0) total length : 64

7|Jun 24 2010 11:41:04|713906: Group = DefaultL2LGroup, IP = x.x.198.138, Generating keys for Responder...

6|Jun 24 2010 11:41:04|713905: Group = DefaultRAGroup, IP = x.x.198.138, WARNING, had problems decrypting packet, probably due to mismatched pre-shared key.  Switching user to tunnel-group: DefaultL2LGroup

5|Jun 24 2010 11:41:04|713904: Group = DefaultRAGroup, IP = x.x.198.138, Received encrypted Oakley Main Mode packet with invalid payloads, MessID = 0

6|Jun 24 2010 11:41:03|713905: Group = DefaultRAGroup, IP = x.x.198.138, P1 Retransmit msg dispatched to MM FSM

5|Jun 24 2010 11:41:03|713201: Group = DefaultRAGroup, IP = x.x.198.138, Duplicate Phase 1 packet detected.  Retransmitting last packet.

7|Jun 24 2010 11:41:00|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:40:53|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 256

7|Jun 24 2010 11:40:53|713906: Group = DefaultRAGroup, IP = x.x.198.138, Generating keys for Responder...

7|Jun 24 2010 11:40:53|713906: IP = x.x.198.138, Connection landed on tunnel_group DefaultRAGroup

7|Jun 24 2010 11:40:53|715048: IP = x.x.198.138, Send Altiga/Cisco VPN3000/Cisco ASA GW VID

7|Jun 24 2010 11:40:53|715046: IP = x.x.198.138, constructing VID payload

7|Jun 24 2010 11:40:53|715038: IP = x.x.198.138, Constructing ASA spoofing IOS Vendor ID payload (version: 1.0.0, capabilities: 20000001)

7|Jun 24 2010 11:40:53|715048: IP = x.x.198.138, Send IOS VID

7|Jun 24 2010 11:40:53|715046: IP = x.x.198.138, constructing xauth V6 VID payload

7|Jun 24 2010 11:40:53|715046: IP = x.x.198.138, constructing Cisco Unity VID payload

7|Jun 24 2010 11:40:53|715046: IP = x.x.198.138, constructing nonce payload

7|Jun 24 2010 11:40:53|715046: IP = x.x.198.138, constructing ke payload

7|Jun 24 2010 11:40:53|715047: IP = x.x.198.138, processing nonce payload

7|Jun 24 2010 11:40:53|715047: IP = x.x.198.138, processing ISA_KE payload

7|Jun 24 2010 11:40:53|715047: IP = x.x.198.138, processing ke payload

7|Jun 24 2010 11:40:53|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + NONE (0) total length : 180

7|Jun 24 2010 11:40:52|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

6|Jun 24 2010 11:40:52|713905: IP = x.x.198.138, P1 Retransmit msg dispatched to MM FSM

5|Jun 24 2010 11:40:52|713201: IP = x.x.198.138, Duplicate Phase 1 packet detected.  Retransmitting last packet.

7|Jun 24 2010 11:40:52|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:40:50|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:40:44|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:40:42|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:40:42|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 11:40:42|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 11:40:42|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 11:40:42|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 11:40:42|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 11:40:42|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 11:40:42|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

7|Jun 24 2010 11:40:36|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:40:36|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 11:40:36|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 11:40:36|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 11:40:36|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 11:40:36|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 11:40:36|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 11:40:36|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

4|Jun 24 2010 11:40:32|713903: IP = x.x.198.138, Error: Unable to remove PeerTblEntry

3|Jun 24 2010 11:40:32|713902: IP = x.x.198.138, Removing peer from peer table failed, no match!

7|Jun 24 2010 11:40:32|713906: IP = x.x.198.138, sending delete/delete with reason message

7|Jun 24 2010 11:40:32|713906: IP = x.x.198.138, IKE SA MM:52cdd2a3 terminating:  flags 0x01000002, refcnt 0, tuncnt 0

7|Jun 24 2010 11:40:32|715065: IP = x.x.198.138, IKE MM Responder FSM error history (struct &0x39665d0)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent

7|Jun 24 2010 11:40:24|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:40:18|710005: TCP request discarded from x.x.198.138/16538 to outside:66.92.228.251/22

7|Jun 24 2010 11:40:18|710005: TCP request discarded from x.x.198.138/16538 to outside:66.92.228.251/22

7|Jun 24 2010 11:40:18|710005: TCP request discarded from x.x.198.138/16538 to outside:66.92.228.251/22

7|Jun 24 2010 11:40:16|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

6|Jun 24 2010 11:40:16|713905: IP = x.x.198.138, P1 Retransmit msg dispatched to MM FSM

5|Jun 24 2010 11:40:16|713201: IP = x.x.198.138, Duplicate Phase 1 packet detected.  Retransmitting last packet.

7|Jun 24 2010 11:40:13|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:40:08|710005: TCP request discarded from x.x.198.138/16538 to outside:66.92.228.251/22

7|Jun 24 2010 11:40:05|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:40:05|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 11:40:05|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 11:40:05|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 11:40:05|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 11:40:05|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 11:40:05|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 11:40:05|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

4|Jun 24 2010 11:40:01|713903: Group = DefaultRAGroup, IP = x.x.198.138, Error: Unable to remove PeerTblEntry

3|Jun 24 2010 11:40:01|713902: Group = DefaultRAGroup, IP = x.x.198.138, Removing peer from peer table failed, no match!

7|Jun 24 2010 11:40:01|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=d8b6f0a6) with payloads : HDR + HASH (8) + DELETE (12) + NONE (0) total length : 80

7|Jun 24 2010 11:40:01|715046: Group = DefaultRAGroup, IP = x.x.198.138, constructing qm hash payload

7|Jun 24 2010 11:40:01|715046: Group = DefaultRAGroup, IP = x.x.198.138, constructing IKE delete payload

7|Jun 24 2010 11:40:01|715046: Group = DefaultRAGroup, IP = x.x.198.138, constructing blank hash payload

7|Jun 24 2010 11:40:01|713906: Group = DefaultRAGroup, IP = x.x.198.138, sending delete/delete with reason message

7|Jun 24 2010 11:40:01|713906: Group = DefaultRAGroup, IP = x.x.198.138, IKE SA MM:a3ae7411 terminating:  flags 0x01000002, refcnt 0, tuncnt 0

7|Jun 24 2010 11:40:01|715065: Group = DefaultRAGroup, IP = x.x.198.138, IKE MM Responder FSM error history (struct &0x39665d0)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG5, EV_PROB_AUTH_FAIL-->MM_WAIT_MSG5, EV_TIMEOUT-->MM_WAIT_MSG5, NullEvent-->MM_SND_MSG4, EV_CRYPTO_ACTIVE-->MM_SND_MSG4, EV_SND_MSG-->MM_SND_MSG4, EV_START_TMR-->MM_SND_MSG4, EV_RESEND_MSG

6|Jun 24 2010 11:39:56|605005: Login permitted from x.x.198.138/16538 to outside:66.92.228.251/ssh for user "alex"

6|Jun 24 2010 11:39:56|109005: Authentication succeeded for user 'alex' from x.x.198.138/16538 to 66.92.228.251/22 on interface outside

7|Jun 24 2010 11:39:47|710002: TCP access permitted from x.x.198.138/16538 to outside:66.92.228.251/ssh

6|Jun 24 2010 11:39:47|302013: Built inbound TCP connection 904 for outside:x.x.198.138/16538 (x.x.198.138/16538) to NP Identity Ifc:66.92.228.251/22 (66.92.228.251/22)

6|Jun 24 2010 11:39:45|713905: Group = DefaultRAGroup, IP = x.x.198.138, P1 Retransmit msg dispatched to MM FSM

5|Jun 24 2010 11:39:45|713201: Group = DefaultRAGroup, IP = x.x.198.138, Duplicate Phase 1 packet detected.  Retransmitting last packet.

4|Jun 24 2010 11:39:38|713903: Group = DefaultRAGroup, IP = x.x.198.138, Error: Unable to remove PeerTblEntry

3|Jun 24 2010 11:39:38|713902: Group = DefaultRAGroup, IP = x.x.198.138, Removing peer from peer table failed, no match!

7|Jun 24 2010 11:39:38|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=3207fb99) with payloads : HDR + HASH (8) + DELETE (12) + NONE (0) total length : 80

7|Jun 24 2010 11:39:38|715046: Group = DefaultRAGroup, IP = x.x.198.138, constructing qm hash payload

7|Jun 24 2010 11:39:38|715046: Group = DefaultRAGroup, IP = x.x.198.138, constructing IKE delete payload

7|Jun 24 2010 11:39:38|715046: Group = DefaultRAGroup, IP = x.x.198.138, constructing blank hash payload

7|Jun 24 2010 11:39:38|713906: Group = DefaultRAGroup, IP = x.x.198.138, sending delete/delete with reason message

7|Jun 24 2010 11:39:38|713906: Group = DefaultRAGroup, IP = x.x.198.138, IKE SA MM:25ae2f9b terminating:  flags 0x01000002, refcnt 0, tuncnt 0

7|Jun 24 2010 11:39:38|715065: Group = DefaultRAGroup, IP = x.x.198.138, IKE MM Responder FSM error history (struct &0x3966fd8)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG5, EV_PROB_AUTH_FAIL-->MM_WAIT_MSG5, EV_TIMEOUT-->MM_WAIT_MSG5, NullEvent-->MM_SND_MSG4, EV_CRYPTO_ACTIVE-->MM_SND_MSG4, EV_SND_MSG-->MM_SND_MSG4, EV_START_TMR-->MM_SND_MSG4, EV_RESEND_MSG

7|Jun 24 2010 11:39:35|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 256

7|Jun 24 2010 11:39:35|713906: Group = DefaultRAGroup, IP = x.x.198.138, Generating keys for Responder...

7|Jun 24 2010 11:39:35|713906: IP = x.x.198.138, Connection landed on tunnel_group DefaultRAGroup

7|Jun 24 2010 11:39:35|715048: IP = x.x.198.138, Send Altiga/Cisco VPN3000/Cisco ASA GW VID

7|Jun 24 2010 11:39:35|715046: IP = x.x.198.138, constructing VID payload

7|Jun 24 2010 11:39:35|715038: IP = x.x.198.138, Constructing ASA spoofing IOS Vendor ID payload (version: 1.0.0, capabilities: 20000001)

7|Jun 24 2010 11:39:35|715048: IP = x.x.198.138, Send IOS VID

7|Jun 24 2010 11:39:35|715046: IP = x.x.198.138, constructing xauth V6 VID payload

7|Jun 24 2010 11:39:35|715046: IP = x.x.198.138, constructing Cisco Unity VID payload

7|Jun 24 2010 11:39:35|715046: IP = x.x.198.138, constructing nonce payload

7|Jun 24 2010 11:39:35|715046: IP = x.x.198.138, constructing ke payload

7|Jun 24 2010 11:39:35|715047: IP = x.x.198.138, processing nonce payload

7|Jun 24 2010 11:39:35|715047: IP = x.x.198.138, processing ISA_KE payload

7|Jun 24 2010 11:39:35|715047: IP = x.x.198.138, processing ke payload

7|Jun 24 2010 11:39:35|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + NONE (0) total length : 180

7|Jun 24 2010 11:39:34|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:39:34|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 11:39:34|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 11:39:34|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 11:39:34|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 11:39:34|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 11:39:34|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 11:39:34|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

4|Jun 24 2010 11:39:29|713903: IP = x.x.198.138, Error: Unable to remove PeerTblEntry

3|Jun 24 2010 11:39:29|713902: IP = x.x.198.138, Removing peer from peer table failed, no match!

7|Jun 24 2010 11:39:29|713906: IP = x.x.198.138, sending delete/delete with reason message

7|Jun 24 2010 11:39:29|713906: IP = x.x.198.138, IKE SA MM:93ebdc10 terminating:  flags 0x01000002, refcnt 0, tuncnt 0

7|Jun 24 2010 11:39:29|715065: IP = x.x.198.138, IKE MM Responder FSM error history (struct &0x3924540)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent

6|Jun 24 2010 11:39:22|713905: Group = DefaultRAGroup, IP = x.x.198.138, P1 Retransmit msg dispatched to MM FSM

5|Jun 24 2010 11:39:22|713201: Group = DefaultRAGroup, IP = x.x.198.138, Duplicate Phase 1 packet detected.  Retransmitting last packet.

7|Jun 24 2010 11:39:21|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:39:13|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:39:12|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 256

7|Jun 24 2010 11:39:12|713906: Group = DefaultRAGroup, IP = x.x.198.138, Generating keys for Responder...

7|Jun 24 2010 11:39:12|713906: IP = x.x.198.138, Connection landed on tunnel_group DefaultRAGroup

7|Jun 24 2010 11:39:12|715048: IP = x.x.198.138, Send Altiga/Cisco VPN3000/Cisco ASA GW VID

7|Jun 24 2010 11:39:12|715046: IP = x.x.198.138, constructing VID payload

7|Jun 24 2010 11:39:12|715038: IP = x.x.198.138, Constructing ASA spoofing IOS Vendor ID payload (version: 1.0.0, capabilities: 20000001)

7|Jun 24 2010 11:39:12|715048: IP = x.x.198.138, Send IOS VID

7|Jun 24 2010 11:39:12|715046: IP = x.x.198.138, constructing xauth V6 VID payload

7|Jun 24 2010 11:39:12|715046: IP = x.x.198.138, constructing Cisco Unity VID payload

7|Jun 24 2010 11:39:12|715046: IP = x.x.198.138, constructing nonce payload

7|Jun 24 2010 11:39:12|715046: IP = x.x.198.138, constructing ke payload

7|Jun 24 2010 11:39:12|715047: IP = x.x.198.138, processing nonce payload

7|Jun 24 2010 11:39:12|715047: IP = x.x.198.138, processing ISA_KE payload

7|Jun 24 2010 11:39:12|715047: IP = x.x.198.138, processing ke payload

7|Jun 24 2010 11:39:12|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + NONE (0) total length : 180

7|Jun 24 2010 11:39:11|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:39:05|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:39:03|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:39:03|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 11:39:03|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 11:39:03|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 11:39:03|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 11:39:03|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 11:39:03|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 11:39:03|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

7|Jun 24 2010 11:38:57|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:38:57|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 11:38:57|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 11:38:57|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 11:38:57|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 11:38:57|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 11:38:57|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 11:38:57|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

4|Jun 24 2010 11:38:53|713903: IP = x.x.198.138, Error: Unable to remove PeerTblEntry

3|Jun 24 2010 11:38:53|713902: IP = x.x.198.138, Removing peer from peer table failed, no match!

7|Jun 24 2010 11:38:53|713906: IP = x.x.198.138, sending delete/delete with reason message

7|Jun 24 2010 11:38:53|713906: IP = x.x.198.138, IKE SA MM:53b90578 terminating:  flags 0x01000002, refcnt 0, tuncnt 0

7|Jun 24 2010 11:38:53|715065: IP = x.x.198.138, IKE MM Responder FSM error history (struct &0x39213e8)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent

4|Jun 24 2010 11:38:50|713903: IP = x.x.198.138, Error: Unable to remove PeerTblEntry

3|Jun 24 2010 11:38:50|713902: IP = x.x.198.138, Removing peer from peer table failed, no match!

7|Jun 24 2010 11:38:50|713906: IP = x.x.198.138, sending delete/delete with reason message

7|Jun 24 2010 11:38:50|713906: IP = x.x.198.138, IKE SA MM:646ffb22 terminating:  flags 0x01000002, refcnt 0, tuncnt 0

7|Jun 24 2010 11:38:50|715065: IP = x.x.198.138, IKE MM Responder FSM error history (struct &0x395f388)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent

7|Jun 24 2010 11:38:45|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:38:42|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:38:37|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

6|Jun 24 2010 11:38:37|713905: IP = x.x.198.138, P1 Retransmit msg dispatched to MM FSM

5|Jun 24 2010 11:38:37|713201: IP = x.x.198.138, Duplicate Phase 1 packet detected.  Retransmitting last packet.

7|Jun 24 2010 11:38:35|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:38:34|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

6|Jun 24 2010 11:38:30|606003: ASDM logging session number 0 from x.x.198.138 started

6|Jun 24 2010 11:38:30|605005: Login permitted from x.x.198.138/16530 to outside:66.92.228.251/https for user "alex"

6|Jun 24 2010 11:38:29|302013: Built inbound TCP connection 783 for outside:x.x.198.138/16530 (x.x.198.138/16530) to NP Identity Ifc:66.92.228.251/443 (66.92.228.251/443)

7|Jun 24 2010 11:38:27|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:38:27|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 11:38:27|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 11:38:27|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 11:38:27|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 11:38:27|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 11:38:27|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 11:38:27|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

7|Jun 24 2010 11:38:26|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

6|Jun 24 2010 11:38:22|302014: Teardown TCP connection 782 for outside:x.x.198.138/16527 to NP Identity Ifc:66.92.228.251/443 duration 0:00:01 bytes 1449 TCP FINs

6|Jun 24 2010 11:38:21|605005: Login permitted from x.x.198.138/16527 to outside:66.92.228.251/https for user "alex"

7|Jun 24 2010 11:38:21|710002: TCP access permitted from x.x.198.138/16527 to outside:66.92.228.251/https

6|Jun 24 2010 11:38:21|302013: Built inbound TCP connection 782 for outside:x.x.198.138/16527 (x.x.198.138/16527) to NP Identity Ifc:66.92.228.251/443 (66.92.228.251/443)

7|Jun 24 2010 11:38:18|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:38:18|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 11:38:18|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 11:38:18|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 11:38:18|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 11:38:18|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 11:38:18|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 11:38:18|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

7|Jun 24 2010 11:36:47|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:36:45|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:36:39|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:36:39|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 11:36:39|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 11:36:39|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 11:36:39|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 11:36:39|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 11:36:39|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 11:36:39|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

7|Jun 24 2010 11:36:37|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:36:37|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 11:36:37|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 11:36:37|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 11:36:37|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 11:36:37|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 11:36:37|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 11:36:37|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

4|Jun 24 2010 11:36:33|713903: IP = x.x.198.138, Error: Unable to remove PeerTblEntry

3|Jun 24 2010 11:36:33|713902: IP = x.x.198.138, Removing peer from peer table failed, no match!

7|Jun 24 2010 11:36:33|713906: IP = x.x.198.138, sending delete/delete with reason message

7|Jun 24 2010 11:36:33|713906: IP = x.x.198.138, IKE SA MM:019e0e53 terminating:  flags 0x01000002, refcnt 0, tuncnt 0

7|Jun 24 2010 11:36:33|715065: IP = x.x.198.138, IKE MM Responder FSM error history (struct &0x3938f50)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent

4|Jun 24 2010 11:36:31|713903: IP = x.x.198.138, Error: Unable to remove PeerTblEntry

3|Jun 24 2010 11:36:31|713902: IP = x.x.198.138, Removing peer from peer table failed, no match!

7|Jun 24 2010 11:36:31|713906: IP = x.x.198.138, sending delete/delete with reason message

7|Jun 24 2010 11:36:31|713906: IP = x.x.198.138, IKE SA MM:635d12a3 terminating:  flags 0x01000002, refcnt 0, tuncnt 0

7|Jun 24 2010 11:36:31|715065: IP = x.x.198.138, IKE MM Responder FSM error history (struct &0x3951bd8)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent

7|Jun 24 2010 11:36:25|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:36:23|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:36:17|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

6|Jun 24 2010 11:36:17|713905: IP = x.x.198.138, P1 Retransmit msg dispatched to MM FSM

5|Jun 24 2010 11:36:17|713201: IP = x.x.198.138, Duplicate Phase 1 packet detected.  Retransmitting last packet.

7|Jun 24 2010 11:36:15|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:36:15|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:36:07|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:36:07|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:36:07|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 11:36:07|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 11:36:07|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 11:36:07|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 11:36:07|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 11:36:07|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 11:36:07|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

4|Jun 24 2010 11:36:00|713903: IP = x.x.198.138, Error: Unable to remove PeerTblEntry

3|Jun 24 2010 11:36:00|713902: IP = x.x.198.138, Removing peer from peer table failed, no match!

7|Jun 24 2010 11:36:00|713906: IP = x.x.198.138, sending delete/delete with reason message

7|Jun 24 2010 11:36:00|713906: IP = x.x.198.138, IKE SA MM:829b8b51 terminating:  flags 0x01000002, refcnt 0, tuncnt 0

7|Jun 24 2010 11:36:00|715065: IP = x.x.198.138, IKE MM Responder FSM error history (struct &0x3951160)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent

7|Jun 24 2010 11:35:59|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:35:59|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 11:35:59|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 11:35:59|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 11:35:59|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 11:35:59|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 11:35:59|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 11:35:59|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

4|Jun 24 2010 11:35:55|713903: IP = x.x.198.138, Error: Unable to remove PeerTblEntry

3|Jun 24 2010 11:35:55|713902: IP = x.x.198.138, Removing peer from peer table failed, no match!

7|Jun 24 2010 11:35:55|713906: IP = x.x.198.138, sending delete/delete with reason message

7|Jun 24 2010 11:35:55|713906: IP = x.x.198.138, IKE SA MM:af21e9c3 terminating:  flags 0x01000002, refcnt 0, tuncnt 0

7|Jun 24 2010 11:35:55|715065: IP = x.x.198.138, IKE MM Responder FSM error history (struct &0x39197a0)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent

7|Jun 24 2010 11:35:52|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:35:47|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:35:44|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:35:39|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

6|Jun 24 2010 11:35:39|713905: IP = x.x.198.138, P1 Retransmit msg dispatched to MM FSM

5|Jun 24 2010 11:35:39|713201: IP = x.x.198.138, Duplicate Phase 1 packet detected.  Retransmitting last packet.

7|Jun 24 2010 11:35:37|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:35:36|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:35:29|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:35:29|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 11:35:29|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 11:35:29|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 11:35:29|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 11:35:29|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 11:35:29|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 11:35:29|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

7|Jun 24 2010 11:35:28|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:35:28|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 11:35:28|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 11:35:28|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 11:35:28|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 11:35:28|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 11:35:28|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 11:35:28|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

4|Jun 24 2010 11:35:24|713903: IP = x.x.198.138, Error: Unable to remove PeerTblEntry

3|Jun 24 2010 11:35:24|713902: IP = x.x.198.138, Removing peer from peer table failed, no match!

7|Jun 24 2010 11:35:24|713906: IP = x.x.198.138, sending delete/delete with reason message

7|Jun 24 2010 11:35:24|713906: IP = x.x.198.138, IKE SA MM:b89f79e9 terminating:  flags 0x01000002, refcnt 0, tuncnt 0

7|Jun 24 2010 11:35:24|715065: IP = x.x.198.138, IKE MM Responder FSM error history (struct &0x3950798)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent

7|Jun 24 2010 11:35:16|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:35:08|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

6|Jun 24 2010 11:35:08|713905: IP = x.x.198.138, P1 Retransmit msg dispatched to MM FSM

5|Jun 24 2010 11:35:08|713201: IP = x.x.198.138, Duplicate Phase 1 packet detected.  Retransmitting last packet.

4|Jun 24 2010 11:35:07|713903: Group = DefaultRAGroup, IP = x.x.198.138, Error: Unable to remove PeerTblEntry

3|Jun 24 2010 11:35:07|713902: Group = DefaultRAGroup, IP = x.x.198.138, Removing peer from peer table failed, no match!

7|Jun 24 2010 11:35:07|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=1daa1d52) with payloads : HDR + HASH (8) + DELETE (12) + NONE (0) total length : 80

7|Jun 24 2010 11:35:07|715046: Group = DefaultRAGroup, IP = x.x.198.138, constructing qm hash payload

7|Jun 24 2010 11:35:07|715046: Group = DefaultRAGroup, IP = x.x.198.138, constructing IKE delete payload

7|Jun 24 2010 11:35:07|715046: Group = DefaultRAGroup, IP = x.x.198.138, constructing blank hash payload

7|Jun 24 2010 11:35:07|713906: Group = DefaultRAGroup, IP = x.x.198.138, sending delete/delete with reason message

7|Jun 24 2010 11:35:07|713906: Group = DefaultRAGroup, IP = x.x.198.138, IKE SA MM:77cfc698 terminating:  flags 0x01000002, refcnt 0, tuncnt 0

7|Jun 24 2010 11:35:07|715065: Group = DefaultRAGroup, IP = x.x.198.138, IKE MM Responder FSM error history (struct &0x3919758)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG5, EV_PROB_AUTH_FAIL-->MM_WAIT_MSG5, EV_TIMEOUT-->MM_WAIT_MSG5, NullEvent-->MM_SND_MSG4, EV_CRYPTO_ACTIVE-->MM_SND_MSG4, EV_SND_MSG-->MM_SND_MSG4, EV_START_TMR-->MM_SND_MSG4, EV_RESEND_MSG

7|Jun 24 2010 11:35:06|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:34:58|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:34:58|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 11:34:58|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 11:34:58|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 11:34:58|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 11:34:58|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 11:34:58|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 11:34:58|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

4|Jun 24 2010 11:34:48|713903: IP = x.x.198.138, Error: Unable to remove PeerTblEntry

3|Jun 24 2010 11:34:48|713902: IP = x.x.198.138, Removing peer from peer table failed, no match!

7|Jun 24 2010 11:34:48|713906: IP = x.x.198.138, sending delete/delete with reason message

7|Jun 24 2010 11:34:48|713906: IP = x.x.198.138, IKE SA MM:834a5b7d terminating:  flags 0x01000002, refcnt 0, tuncnt 0

7|Jun 24 2010 11:34:48|715065: IP = x.x.198.138, IKE MM Responder FSM error history (struct &0x391b8d8)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent

7|Jun 24 2010 11:34:40|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:34:35|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 256

7|Jun 24 2010 11:34:35|713906: Group = DefaultRAGroup, IP = x.x.198.138, Generating keys for Responder...

7|Jun 24 2010 11:34:35|713906: IP = x.x.198.138, Connection landed on tunnel_group DefaultRAGroup

7|Jun 24 2010 11:34:35|715048: IP = x.x.198.138, Send Altiga/Cisco VPN3000/Cisco ASA GW VID

7|Jun 24 2010 11:34:35|715046: IP = x.x.198.138, constructing VID payload

7|Jun 24 2010 11:34:35|715038: IP = x.x.198.138, Constructing ASA spoofing IOS Vendor ID payload (version: 1.0.0, capabilities: 20000001)

7|Jun 24 2010 11:34:35|715048: IP = x.x.198.138, Send IOS VID

7|Jun 24 2010 11:34:35|715046: IP = x.x.198.138, constructing xauth V6 VID payload

7|Jun 24 2010 11:34:35|715046: IP = x.x.198.138, constructing Cisco Unity VID payload

7|Jun 24 2010 11:34:35|715046: IP = x.x.198.138, constructing nonce payload

7|Jun 24 2010 11:34:35|715046: IP = x.x.198.138, constructing ke payload

7|Jun 24 2010 11:34:35|715047: IP = x.x.198.138, processing nonce payload

7|Jun 24 2010 11:34:35|715047: IP = x.x.198.138, processing ISA_KE payload

7|Jun 24 2010 11:34:35|715047: IP = x.x.198.138, processing ke payload

7|Jun 24 2010 11:34:35|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + NONE (0) total length : 180

7|Jun 24 2010 11:34:34|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

6|Jun 24 2010 11:34:34|713905: IP = x.x.198.138, P1 Retransmit msg dispatched to MM FSM

5|Jun 24 2010 11:34:34|713201: IP = x.x.198.138, Duplicate Phase 1 packet detected.  Retransmitting last packet.

7|Jun 24 2010 11:34:32|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:34:31|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

6|Jun 24 2010 11:34:24|606003: ASDM logging session number 0 from x.x.198.138 started

6|Jun 24 2010 11:34:24|605005: Login permitted from x.x.198.138/16490 to outside:66.92.228.251/https for user "alex"

7|Jun 24 2010 11:34:24|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:34:24|710002: TCP access permitted from x.x.198.138/16490 to outside:66.92.228.251/https

6|Jun 24 2010 11:34:24|302013: Built inbound TCP connection 151 for outside:x.x.198.138/16490 (x.x.198.138/16490) to NP Identity Ifc:66.92.228.251/443 (66.92.228.251/443)

7|Jun 24 2010 11:34:23|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:34:23|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 11:34:23|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 11:34:23|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 11:34:23|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 11:34:23|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 11:34:23|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 11:34:23|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

7|Jun 24 2010 11:34:20|710005: TCP request discarded from x.x.198.138/16373 to outside:66.92.228.251/443

6|Jun 24 2010 11:34:20|106015: Deny TCP (no connection) from x.x.198.138/16373 to 66.92.228.251/443 flags FIN PSH ACK  on interface outside

4|Jun 24 2010 11:34:17|713903: IP = x.x.198.138, Error: Unable to remove PeerTblEntry

3|Jun 24 2010 11:34:17|713902: IP = x.x.198.138, Removing peer from peer table failed, no match!

7|Jun 24 2010 11:34:17|713906: IP = x.x.198.138, sending delete/delete with reason message

7|Jun 24 2010 11:34:17|713906: IP = x.x.198.138, IKE SA MM:948e665a terminating:  flags 0x01000002, refcnt 0, tuncnt 0

7|Jun 24 2010 11:34:17|715065: IP = x.x.198.138, IKE MM Responder FSM error history (struct &0x3919758)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent

7|Jun 24 2010 11:34:16|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:34:16|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 11:34:16|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 11:34:16|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 11:34:16|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 11:34:16|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 11:34:16|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 11:34:16|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

7|Jun 24 2010 11:34:09|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:31:45|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:31:45|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 11:31:45|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 11:31:45|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 11:31:45|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 11:31:45|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 11:31:45|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 11:31:45|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

4|Jun 24 2010 11:31:41|713903: IP = x.x.198.138, Error: Unable to remove PeerTblEntry

3|Jun 24 2010 11:31:41|713902: IP = x.x.198.138, Removing peer from peer table failed, no match!

7|Jun 24 2010 11:31:41|713906: IP = x.x.198.138, sending delete/delete with reason message

7|Jun 24 2010 11:31:41|713906: IP = x.x.198.138, IKE SA MM:0d6d4e0d terminating:  flags 0x01000002, refcnt 0, tuncnt 0

7|Jun 24 2010 11:31:41|715065: IP = x.x.198.138, IKE MM Responder FSM error history (struct &0x3940150)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent

4|Jun 24 2010 11:31:41|713903: IP = x.x.198.138, Error: Unable to remove PeerTblEntry

3|Jun 24 2010 11:31:41|713902: IP = x.x.198.138, Removing peer from peer table failed, no match!

7|Jun 24 2010 11:31:41|713906: IP = x.x.198.138, sending delete/delete with reason message

7|Jun 24 2010 11:31:41|713906: IP = x.x.198.138, IKE SA MM:b60acf34 terminating:  flags 0x01000002, refcnt 0, tuncnt 0

7|Jun 24 2010 11:31:41|715065: IP = x.x.198.138, IKE MM Responder FSM error history (struct &0x39d54a0)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent

7|Jun 24 2010 11:31:33|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:31:33|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:31:25|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:31:25|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

6|Jun 24 2010 11:31:25|713905: IP = x.x.198.138, P1 Retransmit msg dispatched to MM FSM

5|Jun 24 2010 11:31:25|713201: IP = x.x.198.138, Duplicate Phase 1 packet detected.  Retransmitting last packet.

7|Jun 24 2010 11:31:23|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:31:17|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:31:15|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:31:15|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 11:31:15|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 11:31:15|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 11:31:15|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 11:31:15|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 11:31:15|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 11:31:15|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

7|Jun 24 2010 11:31:09|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:31:09|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 11:31:09|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 11:31:09|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 11:31:09|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 11:31:09|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 11:31:09|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 11:31:09|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

4|Jun 24 2010 11:31:07|713903: IP = x.x.198.138, Error: Unable to remove PeerTblEntry

3|Jun 24 2010 11:31:07|713902: IP = x.x.198.138, Removing peer from peer table failed, no match!

7|Jun 24 2010 11:31:07|713906: IP = x.x.198.138, sending delete/delete with reason message

7|Jun 24 2010 11:31:07|713906: IP = x.x.198.138, IKE SA MM:164fb835 terminating:  flags 0x01000002, refcnt 0, tuncnt 0

7|Jun 24 2010 11:31:07|715065: IP = x.x.198.138, IKE MM Responder FSM error history (struct &0x3940150)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent

4|Jun 24 2010 11:31:05|713903: IP = x.x.198.138, Error: Unable to remove PeerTblEntry

3|Jun 24 2010 11:31:05|713902: IP = x.x.198.138, Removing peer from peer table failed, no match!

7|Jun 24 2010 11:31:05|713906: IP = x.x.198.138, sending delete/delete with reason message

7|Jun 24 2010 11:31:05|713906: IP = x.x.198.138, IKE SA MM:5905f9ea terminating:  flags 0x01000002, refcnt 0, tuncnt 0

7|Jun 24 2010 11:31:05|715065: IP = x.x.198.138, IKE MM Responder FSM error history (struct &0x395fff0)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent

7|Jun 24 2010 11:30:59|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:30:57|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:30:51|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:30:49|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

6|Jun 24 2010 11:30:49|713905: IP = x.x.198.138, P1 Retransmit msg dispatched to MM FSM

5|Jun 24 2010 11:30:49|713201: IP = x.x.198.138, Duplicate Phase 1 packet detected.  Retransmitting last packet.

7|Jun 24 2010 11:30:47|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:30:43|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:30:39|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:30:39|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 11:30:39|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 11:30:39|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 11:30:39|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 11:30:39|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 11:30:39|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 11:30:39|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

6|Jun 24 2010 11:30:38|302014: Teardown TCP connection 71452 for outside:x.x.198.138/16454 to NP Identity Ifc:66.92.228.251/443 duration 0:00:01 bytes 1871 TCP FINs

6|Jun 24 2010 11:30:38|605005: Login permitted from x.x.198.138/16454 to outside:66.92.228.251/https for user "alex"

7|Jun 24 2010 11:30:37|710002: TCP access permitted from x.x.198.138/16454 to outside:66.92.228.251/https

6|Jun 24 2010 11:30:37|302013: Built inbound TCP connection 71452 for outside:x.x.198.138/16454 (x.x.198.138/16454) to NP Identity Ifc:66.92.228.251/443 (66.92.228.251/443)

4|Jun 24 2010 11:30:35|713903: IP = x.x.198.138, Error: Unable to remove PeerTblEntry

3|Jun 24 2010 11:30:35|713902: IP = x.x.198.138, Removing peer from peer table failed, no match!

7|Jun 24 2010 11:30:35|713906: IP = x.x.198.138, sending delete/delete with reason message

7|Jun 24 2010 11:30:35|713906: IP = x.x.198.138, IKE SA MM:bd46d1d2 terminating:  flags 0x01000002, refcnt 0, tuncnt 0

7|Jun 24 2010 11:30:35|715065: IP = x.x.198.138, IKE MM Responder FSM error history (struct &0x3938030)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent

7|Jun 24 2010 11:30:35|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:30:35|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 11:30:35|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 11:30:35|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 11:30:35|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 11:30:35|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 11:30:35|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 11:30:35|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

4|Jun 24 2010 11:30:31|713903: IP = x.x.198.138, Error: Unable to remove PeerTblEntry

3|Jun 24 2010 11:30:31|713902: IP = x.x.198.138, Removing peer from peer table failed, no match!

7|Jun 24 2010 11:30:31|713906: IP = x.x.198.138, sending delete/delete with reason message

7|Jun 24 2010 11:30:31|713906: IP = x.x.198.138, IKE SA MM:918a5474 terminating:  flags 0x01000002, refcnt 0, tuncnt 0

7|Jun 24 2010 11:30:31|715065: IP = x.x.198.138, IKE MM Responder FSM error history (struct &0x3940150)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent

7|Jun 24 2010 11:30:27|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:30:23|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:30:19|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:30:15|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

6|Jun 24 2010 11:30:15|713905: IP = x.x.198.138, P1 Retransmit msg dispatched to MM FSM

5|Jun 24 2010 11:30:15|713201: IP = x.x.198.138, Duplicate Phase 1 packet detected.  Retransmitting last packet.

7|Jun 24 2010 11:30:13|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:30:11|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:30:05|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:30:05|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 11:30:05|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 11:30:05|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 11:30:05|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 11:30:05|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 11:30:05|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 11:30:05|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

4|Jun 24 2010 11:30:04|713903: IP = x.x.198.138, Error: Unable to remove PeerTblEntry

3|Jun 24 2010 11:30:04|713902: IP = x.x.198.138, Removing peer from peer table failed, no match!

7|Jun 24 2010 11:30:04|713906: IP = x.x.198.138, sending delete/delete with reason message

7|Jun 24 2010 11:30:04|713906: IP = x.x.198.138, IKE SA MM:916092c2 terminating:  flags 0x01000002, refcnt 0, tuncnt 0

7|Jun 24 2010 11:30:04|715065: IP = x.x.198.138, IKE MM Responder FSM error history (struct &0x3940150)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent

7|Jun 24 2010 11:30:03|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:30:03|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 11:30:03|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 11:30:03|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 11:30:03|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 11:30:03|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 11:30:03|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 11:30:03|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

4|Jun 24 2010 11:30:00|713903: IP = x.x.198.138, Error: Unable to remove PeerTblEntry

3|Jun 24 2010 11:30:00|713902: IP = x.x.198.138, Removing peer from peer table failed, no match!

7|Jun 24 2010 11:30:00|713906: IP = x.x.198.138, sending delete/delete with reason message

7|Jun 24 2010 11:30:00|713906: IP = x.x.198.138, IKE SA MM:5a85677b terminating:  flags 0x01000002, refcnt 0, tuncnt 0

7|Jun 24 2010 11:30:00|715065: IP = x.x.198.138, IKE MM Responder FSM error history (struct &0x3938030)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent

7|Jun 24 2010 11:29:56|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:29:52|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:29:48|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:29:44|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

6|Jun 24 2010 11:29:44|713905: IP = x.x.198.138, P1 Retransmit msg dispatched to MM FSM

5|Jun 24 2010 11:29:44|713201: IP = x.x.198.138, Duplicate Phase 1 packet detected.  Retransmitting last packet.

7|Jun 24 2010 11:29:42|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:29:40|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:29:34|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:29:34|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 11:29:34|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 11:29:34|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 11:29:34|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 11:29:34|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 11:29:34|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 11:29:34|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

7|Jun 24 2010 11:29:32|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:29:32|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 11:29:32|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 11:29:32|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 11:29:32|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 11:29:32|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 11:29:32|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 11:29:32|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

4|Jun 24 2010 11:29:31|713903: IP = x.x.198.138, Error: Unable to remove PeerTblEntry

3|Jun 24 2010 11:29:31|713902: IP = x.x.198.138, Removing peer from peer table failed, no match!

7|Jun 24 2010 11:29:31|713906: IP = x.x.198.138, sending delete/delete with reason message

7|Jun 24 2010 11:29:31|713906: IP = x.x.198.138, IKE SA MM:6677c614 terminating:  flags 0x01000002, refcnt 0, tuncnt 0

7|Jun 24 2010 11:29:31|715065: IP = x.x.198.138, IKE MM Responder FSM error history (struct &0x397c0f0)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent

4|Jun 24 2010 11:29:28|713903: IP = x.x.198.138, Error: Unable to remove PeerTblEntry

3|Jun 24 2010 11:29:28|713902: IP = x.x.198.138, Removing peer from peer table failed, no match!

7|Jun 24 2010 11:29:28|713906: IP = x.x.198.138, sending delete/delete with reason message

7|Jun 24 2010 11:29:28|713906: IP = x.x.198.138, IKE SA MM:6140aa50 terminating:  flags 0x01000002, refcnt 0, tuncnt 0

7|Jun 24 2010 11:29:28|715065: IP = x.x.198.138, IKE MM Responder FSM error history (struct &0x3940150)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent

7|Jun 24 2010 11:29:23|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:29:20|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:29:15|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:29:12|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

6|Jun 24 2010 11:29:12|713905: IP = x.x.198.138, P1 Retransmit msg dispatched to MM FSM

5|Jun 24 2010 11:29:12|713201: IP = x.x.198.138, Duplicate Phase 1 packet detected.  Retransmitting last packet.

7|Jun 24 2010 11:29:10|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:29:07|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:29:02|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:29:02|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 11:29:02|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 11:29:02|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 11:29:02|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 11:29:02|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 11:29:02|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 11:29:02|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

4|Jun 24 2010 11:29:00|713903: IP = x.x.198.138, Error: Unable to remove PeerTblEntry

3|Jun 24 2010 11:29:00|713902: IP = x.x.198.138, Removing peer from peer table failed, no match!

7|Jun 24 2010 11:29:00|713906: IP = x.x.198.138, sending delete/delete with reason message

7|Jun 24 2010 11:29:00|713906: IP = x.x.198.138, IKE SA MM:756ea3f3 terminating:  flags 0x01000002, refcnt 0, tuncnt 0

7|Jun 24 2010 11:29:00|715065: IP = x.x.198.138, IKE MM Responder FSM error history (struct &0x3940150)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent

7|Jun 24 2010 11:28:59|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:28:59|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 11:28:59|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 11:28:59|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 11:28:59|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 11:28:59|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 11:28:59|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 11:28:59|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

4|Jun 24 2010 11:28:55|713903: IP = x.x.198.138, Error: Unable to remove PeerTblEntry

3|Jun 24 2010 11:28:55|713902: IP = x.x.198.138, Removing peer from peer table failed, no match!

7|Jun 24 2010 11:28:55|713906: IP = x.x.198.138, sending delete/delete with reason message

7|Jun 24 2010 11:28:55|713906: IP = x.x.198.138, IKE SA MM:2101ab2c terminating:  flags 0x01000002, refcnt 0, tuncnt 0

7|Jun 24 2010 11:28:55|715065: IP = x.x.198.138, IKE MM Responder FSM error history (struct &0x3938030)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent

7|Jun 24 2010 11:28:52|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:28:47|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:28:44|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:28:39|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

6|Jun 24 2010 11:28:39|713905: IP = x.x.198.138, P1 Retransmit msg dispatched to MM FSM

5|Jun 24 2010 11:28:39|713201: IP = x.x.198.138, Duplicate Phase 1 packet detected.  Retransmitting last packet.

7|Jun 24 2010 11:28:37|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:28:36|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

6|Jun 24 2010 11:28:35|302014: Teardown TCP connection 71391 for outside:x.x.198.138/16407 to NP Identity Ifc:66.92.228.251/443 duration 0:00:01 bytes 1473 TCP FINs

6|Jun 24 2010 11:28:34|605005: Login permitted from x.x.198.138/16407 to outside:66.92.228.251/https for user "alex"

6|Jun 24 2010 11:28:34|302013: Built inbound TCP connection 71391 for outside:x.x.198.138/16407 (x.x.198.138/16407) to NP Identity Ifc:66.92.228.251/443 (66.92.228.251/443)

6|Jun 24 2010 11:28:31|302014: Teardown TCP connection 71387 for outside:x.x.198.138/16405 to NP Identity Ifc:66.92.228.251/443 duration 0:00:01 bytes 1353 TCP FINs

6|Jun 24 2010 11:28:31|605005: Login permitted from x.x.198.138/16405 to outside:66.92.228.251/https for user "alex"

6|Jun 24 2010 11:28:30|302013: Built inbound TCP connection 71387 for outside:x.x.198.138/16405 (x.x.198.138/16405) to NP Identity Ifc:66.92.228.251/443 (66.92.228.251/443)

6|Jun 24 2010 11:28:29|302014: Teardown TCP connection 71385 for outside:x.x.198.138/16403 to NP Identity Ifc:66.92.228.251/443 duration 0:00:01 bytes 1241 TCP FINs

6|Jun 24 2010 11:28:29|605005: Login permitted from x.x.198.138/16403 to outside:66.92.228.251/https for user "alex"

7|Jun 24 2010 11:28:29|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:28:29|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 11:28:29|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 11:28:29|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 11:28:29|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 11:28:29|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 11:28:29|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 11:28:29|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

6|Jun 24 2010 11:28:28|302013: Built inbound TCP connection 71385 for outside:x.x.198.138/16403 (x.x.198.138/16403) to NP Identity Ifc:66.92.228.251/443 (66.92.228.251/443)

6|Jun 24 2010 11:28:28|302014: Teardown TCP connection 71384 for outside:x.x.198.138/16401 to NP Identity Ifc:66.92.228.251/443 duration 0:00:00 bytes 1369 TCP FINs

7|Jun 24 2010 11:28:28|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:28:28|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 11:28:28|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 11:28:28|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 11:28:28|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 11:28:28|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 11:28:28|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 11:28:28|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

6|Jun 24 2010 11:28:28|605005: Login permitted from x.x.198.138/16401 to outside:66.92.228.251/https for user "alex"

7|Jun 24 2010 11:28:27|710002: TCP access permitted from x.x.198.138/16401 to outside:66.92.228.251/https

6|Jun 24 2010 11:28:27|302013: Built inbound TCP connection 71384 for outside:x.x.198.138/16401 (x.x.198.138/16401) to NP Identity Ifc:66.92.228.251/443 (66.92.228.251/443)

4|Jun 24 2010 11:28:25|713903: IP = x.x.198.138, Error: Unable to remove PeerTblEntry

3|Jun 24 2010 11:28:25|713902: IP = x.x.198.138, Removing peer from peer table failed, no match!

7|Jun 24 2010 11:28:25|713906: IP = x.x.198.138, sending delete/delete with reason message

7|Jun 24 2010 11:28:25|713906: IP = x.x.198.138, IKE SA MM:f5a75933 terminating:  flags 0x01000002, refcnt 0, tuncnt 0

7|Jun 24 2010 11:28:25|715065: IP = x.x.198.138, IKE MM Responder FSM error history (struct &0x3940150)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent

4|Jun 24 2010 11:28:24|713903: IP = x.x.198.138, Error: Unable to remove PeerTblEntry

3|Jun 24 2010 11:28:24|713902: IP = x.x.198.138, Removing peer from peer table failed, no match!

7|Jun 24 2010 11:28:24|713906: IP = x.x.198.138, sending delete/delete with reason message

7|Jun 24 2010 11:28:24|713906: IP = x.x.198.138, IKE SA MM:7c5744d2 terminating:  flags 0x01000002, refcnt 0, tuncnt 0

7|Jun 24 2010 11:28:24|715065: IP = x.x.198.138, IKE MM Responder FSM error history (struct &0x3938030)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent

7|Jun 24 2010 11:28:17|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:28:16|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:28:09|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:28:08|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

6|Jun 24 2010 11:28:08|713905: IP = x.x.198.138, P1 Retransmit msg dispatched to MM FSM

5|Jun 24 2010 11:28:08|713201: IP = x.x.198.138, Duplicate Phase 1 packet detected.  Retransmitting last packet.

7|Jun 24 2010 11:28:06|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:28:01|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:27:58|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:27:58|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 11:27:58|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 11:27:58|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 11:27:58|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 11:27:58|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 11:27:58|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 11:27:58|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

7|Jun 24 2010 11:27:53|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:27:53|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 11:27:53|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 11:27:53|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 11:27:53|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 11:27:53|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 11:27:53|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 11:27:53|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

4|Jun 24 2010 11:27:49|713903: IP = x.x.198.138, Error: Unable to remove PeerTblEntry

3|Jun 24 2010 11:27:49|713902: IP = x.x.198.138, Removing peer from peer table failed, no match!

7|Jun 24 2010 11:27:49|713906: IP = x.x.198.138, sending delete/delete with reason message

7|Jun 24 2010 11:27:49|713906: IP = x.x.198.138, IKE SA MM:50779a40 terminating:  flags 0x01000002, refcnt 0, tuncnt 0

7|Jun 24 2010 11:27:49|715065: IP = x.x.198.138, IKE MM Responder FSM error history (struct &0x3940150)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent

7|Jun 24 2010 11:27:41|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:27:33|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

6|Jun 24 2010 11:27:33|713905: IP = x.x.198.138, P1 Retransmit msg dispatched to MM FSM

5|Jun 24 2010 11:27:33|713201: IP = x.x.198.138, Duplicate Phase 1 packet detected.  Retransmitting last packet.

7|Jun 24 2010 11:27:31|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:27:23|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:27:23|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 11:27:23|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 11:27:23|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 11:27:23|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 11:27:23|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 11:27:23|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 11:27:23|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

4|Jun 24 2010 11:27:14|713903: Group = DefaultRAGroup, IP = x.x.198.138, Error: Unable to remove PeerTblEntry

3|Jun 24 2010 11:27:14|713902: Group = DefaultRAGroup, IP = x.x.198.138, Removing peer from peer table failed, no match!

7|Jun 24 2010 11:27:14|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=b0581855) with payloads : HDR + HASH (8) + DELETE (12) + NONE (0) total length : 80

7|Jun 24 2010 11:27:14|715046: Group = DefaultRAGroup, IP = x.x.198.138, constructing qm hash payload

7|Jun 24 2010 11:27:14|715046: Group = DefaultRAGroup, IP = x.x.198.138, constructing IKE delete payload

7|Jun 24 2010 11:27:14|715046: Group = DefaultRAGroup, IP = x.x.198.138, constructing blank hash payload

7|Jun 24 2010 11:27:14|713906: Group = DefaultRAGroup, IP = x.x.198.138, sending delete/delete with reason message

7|Jun 24 2010 11:27:14|713906: Group = DefaultRAGroup, IP = x.x.198.138, IKE SA MM:4fcda7ce terminating:  flags 0x01000002, refcnt 0, tuncnt 0

7|Jun 24 2010 11:27:14|715065: Group = DefaultRAGroup, IP = x.x.198.138, IKE MM Responder FSM error history (struct &0x3940150)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG5, EV_PROB_AUTH_FAIL-->MM_WAIT_MSG5, EV_TIMEOUT-->MM_WAIT_MSG5, NullEvent-->MM_SND_MSG4, EV_CRYPTO_ACTIVE-->MM_SND_MSG4, EV_SND_MSG-->MM_SND_MSG4, EV_START_TMR-->MM_SND_MSG4, EV_RESEND_MSG

4|Jun 24 2010 11:27:14|713903: Group = DefaultL2LGroup, IP = x.x.198.138, Error: Unable to remove PeerTblEntry

3|Jun 24 2010 11:27:14|713902: Group = DefaultL2LGroup, IP = x.x.198.138, Removing peer from peer table failed, no match!

7|Jun 24 2010 11:27:14|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=4b8bb483) with payloads : HDR + HASH (8) + DELETE (12) + NONE (0) total length : 80

7|Jun 24 2010 11:27:14|715046: Group = DefaultL2LGroup, IP = x.x.198.138, constructing qm hash payload

7|Jun 24 2010 11:27:14|715046: Group = DefaultL2LGroup, IP = x.x.198.138, constructing IKE delete payload

7|Jun 24 2010 11:27:14|715046: Group = DefaultL2LGroup, IP = x.x.198.138, constructing blank hash payload

7|Jun 24 2010 11:27:14|713906: Group = DefaultL2LGroup, IP = x.x.198.138, sending delete/delete with reason message

7|Jun 24 2010 11:27:14|713906: Group = DefaultL2LGroup, IP = x.x.198.138, IKE SA MM:c5e0ed71 terminating:  flags 0x01000002, refcnt 0, tuncnt 0

7|Jun 24 2010 11:27:14|715065: Group = DefaultL2LGroup, IP = x.x.198.138, IKE MM Responder FSM error history (struct &0x3917d08)  , :  MM_DONE, EV_ERROR-->MM_SND_MSG6_H, EV_SND_MSG_OK-->MM_SND_MSG6_H, EV_SND_MSG-->MM_SND_MSG6, EV_SND_MSG-->MM_BLD_MSG6, EV_ENCRYPT_OK-->MM_BLD_MSG6, NullEvent-->MM_BLD_MSG6, EV_ENCRYPT_MSG-->MM_BLD_MSG6, EV_CHK_PROPOSAL

5|Jun 24 2010 11:27:14|713092: Group = DefaultL2LGroup, IP = x.x.198.138, Failure during phase 1 rekeying attempt due to collision

7|Jun 24 2010 11:27:14|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) + VENDOR (13) + NONE (0) total length : 84

7|Jun 24 2010 11:27:14|715046: Group = DefaultL2LGroup, IP = x.x.198.138, constructing dpd vid payload

7|Jun 24 2010 11:27:14|715076: Group = DefaultL2LGroup, IP = x.x.198.138, Computing hash for ISAKMP

7|Jun 24 2010 11:27:14|715046: Group = DefaultL2LGroup, IP = x.x.198.138, constructing hash payload

7|Jun 24 2010 11:27:14|715046: Group = DefaultL2LGroup, IP = x.x.198.138, constructing ID payload

4|Jun 24 2010 11:27:14|713903: Group = DefaultL2LGroup, IP = x.x.198.138, Freeing previously allocated memory for authorization-dn-attributes

7|Jun 24 2010 11:27:14|713906: IP = x.x.198.138, Connection landed on tunnel_group DefaultL2LGroup

7|Jun 24 2010 11:27:14|715076: Group = DefaultL2LGroup, IP = x.x.198.138, Computing hash for ISAKMP

7|Jun 24 2010 11:27:14|715047: Group = DefaultL2LGroup, IP = x.x.198.138, processing hash payload

7|Jun 24 2010 11:27:14|714011: Group = DefaultL2LGroup, IP = x.x.198.138, ID_IPV4_ADDR ID received

7|Jun 24 2010 11:27:14|715047: Group = DefaultL2LGroup, IP = x.x.198.138, processing ID payload

7|Jun 24 2010 11:27:14|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) + NONE (0) total length : 64

7|Jun 24 2010 11:27:14|713906: Group = DefaultL2LGroup, IP = x.x.198.138, Generating keys for Responder...

6|Jun 24 2010 11:27:14|713905: Group = DefaultRAGroup, IP = x.x.198.138, WARNING, had problems decrypting packet, probably due to mismatched pre-shared key.  Switching user to tunnel-group: DefaultL2LGroup

5|Jun 24 2010 11:27:14|713904: Group = DefaultRAGroup, IP = x.x.198.138, Received encrypted Oakley Main Mode packet with invalid payloads, MessID = 0

6|Jun 24 2010 11:27:12|713905: Group = DefaultRAGroup, IP = x.x.198.138, P1 Retransmit msg dispatched to MM FSM

5|Jun 24 2010 11:27:12|713201: Group = DefaultRAGroup, IP = x.x.198.138, Duplicate Phase 1 packet detected.  Retransmitting last packet.

7|Jun 24 2010 11:27:02|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 256

7|Jun 24 2010 11:27:02|713906: Group = DefaultRAGroup, IP = x.x.198.138, Generating keys for Responder...

7|Jun 24 2010 11:27:02|713906: IP = x.x.198.138, Connection landed on tunnel_group DefaultRAGroup

7|Jun 24 2010 11:27:02|715048: IP = x.x.198.138, Send Altiga/Cisco VPN3000/Cisco ASA GW VID

7|Jun 24 2010 11:27:02|715046: IP = x.x.198.138, constructing VID payload

7|Jun 24 2010 11:27:02|715038: IP = x.x.198.138, Constructing ASA spoofing IOS Vendor ID payload (version: 1.0.0, capabilities: 20000001)

7|Jun 24 2010 11:27:02|715048: IP = x.x.198.138, Send IOS VID

7|Jun 24 2010 11:27:02|715046: IP = x.x.198.138, constructing xauth V6 VID payload

7|Jun 24 2010 11:27:02|715046: IP = x.x.198.138, constructing Cisco Unity VID payload

7|Jun 24 2010 11:27:02|715046: IP = x.x.198.138, constructing nonce payload

7|Jun 24 2010 11:27:02|715046: IP = x.x.198.138, constructing ke payload

7|Jun 24 2010 11:27:02|715047: IP = x.x.198.138, processing nonce payload

7|Jun 24 2010 11:27:02|715047: IP = x.x.198.138, processing ISA_KE payload

7|Jun 24 2010 11:27:02|715047: IP = x.x.198.138, processing ke payload

7|Jun 24 2010 11:27:02|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + NONE (0) total length : 180

7|Jun 24 2010 11:27:01|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:27:01|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 11:27:01|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 11:27:01|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 11:27:01|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 11:27:01|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 11:27:01|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 11:27:01|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

7|Jun 24 2010 11:26:42|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 256

7|Jun 24 2010 11:26:42|713906: Group = DefaultRAGroup, IP = x.x.198.138, Generating keys for Responder...

7|Jun 24 2010 11:26:42|713906: IP = x.x.198.138, Connection landed on tunnel_group DefaultRAGroup

7|Jun 24 2010 11:26:42|715048: IP = x.x.198.138, Send Altiga/Cisco VPN3000/Cisco ASA GW VID

7|Jun 24 2010 11:26:42|715046: IP = x.x.198.138, constructing VID payload

7|Jun 24 2010 11:26:42|715038: IP = x.x.198.138, Constructing ASA spoofing IOS Vendor ID payload (version: 1.0.0, capabilities: 20000001)

7|Jun 24 2010 11:26:42|715048: IP = x.x.198.138, Send IOS VID

7|Jun 24 2010 11:26:42|715046: IP = x.x.198.138, constructing xauth V6 VID payload

7|Jun 24 2010 11:26:42|715046: IP = x.x.198.138, constructing Cisco Unity VID payload

7|Jun 24 2010 11:26:42|715046: IP = x.x.198.138, constructing nonce payload

7|Jun 24 2010 11:26:42|715046: IP = x.x.198.138, constructing ke payload

7|Jun 24 2010 11:26:42|715047: IP = x.x.198.138, processing nonce payload

7|Jun 24 2010 11:26:42|715047: IP = x.x.198.138, processing ISA_KE payload

7|Jun 24 2010 11:26:42|715047: IP = x.x.198.138, processing ke payload

7|Jun 24 2010 11:26:42|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + NONE (0) total length : 180

7|Jun 24 2010 11:26:41|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:26:41|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 11:26:41|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 11:26:41|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 11:26:41|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 11:26:41|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 11:26:41|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 11:26:41|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

4|Jun 24 2010 11:26:39|713903: IP = x.x.198.138, Error: Unable to remove PeerTblEntry

3|Jun 24 2010 11:26:39|713902: IP = x.x.198.138, Removing peer from peer table failed, no match!

7|Jun 24 2010 11:26:39|713906: IP = x.x.198.138, sending delete/delete with reason message

7|Jun 24 2010 11:26:39|713906: IP = x.x.198.138, IKE SA MM:d311559c terminating:  flags 0x01000002, refcnt 0, tuncnt 0

7|Jun 24 2010 11:26:39|715065: IP = x.x.198.138, IKE MM Responder FSM error history (struct &0x3940150)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent

4|Jun 24 2010 11:26:36|713903: IP = x.x.198.138, Error: Unable to remove PeerTblEntry

3|Jun 24 2010 11:26:36|713902: IP = x.x.198.138, Removing peer from peer table failed, no match!

7|Jun 24 2010 11:26:36|713906: IP = x.x.198.138, sending delete/delete with reason message

7|Jun 24 2010 11:26:36|713906: IP = x.x.198.138, IKE SA MM:a93f0bbe terminating:  flags 0x01000002, refcnt 0, tuncnt 0

7|Jun 24 2010 11:26:36|715065: IP = x.x.198.138, IKE MM Responder FSM error history (struct &0x39ae9a8)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent

7|Jun 24 2010 11:26:31|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:26:28|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:26:23|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

6|Jun 24 2010 11:26:23|302014: Teardown TCP connection 71328 for outside:x.x.198.138/16381 to NP Identity Ifc:66.92.228.251/443 duration 0:00:00 bytes 1241 TCP FINs

6|Jun 24 2010 11:26:22|605005: Login permitted from x.x.198.138/16381 to outside:66.92.228.251/https for user "alex"

6|Jun 24 2010 11:26:22|302013: Built inbound TCP connection 71328 for outside:x.x.198.138/16381 (x.x.198.138/16381) to NP Identity Ifc:66.92.228.251/443 (66.92.228.251/443)

6|Jun 24 2010 11:26:22|302014: Teardown TCP connection 71302 for outside:x.x.198.138/16379 to NP Identity Ifc:66.92.228.251/443 duration 0:00:02 bytes 1960 TCP FINs

7|Jun 24 2010 11:26:20|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

6|Jun 24 2010 11:26:20|713905: IP = x.x.198.138, P1 Retransmit msg dispatched to MM FSM

5|Jun 24 2010 11:26:20|713201: IP = x.x.198.138, Duplicate Phase 1 packet detected.  Retransmitting last packet.

6|Jun 24 2010 11:26:20|605005: Login permitted from x.x.198.138/16379 to outside:66.92.228.251/https for user "alex"

7|Jun 24 2010 11:26:20|710002: TCP access permitted from x.x.198.138/16379 to outside:66.92.228.251/https

6|Jun 24 2010 11:26:20|302013: Built inbound TCP connection 71302 for outside:x.x.198.138/16379 (x.x.198.138/16379) to NP Identity Ifc:66.92.228.251/443 (66.92.228.251/443)

7|Jun 24 2010 11:26:18|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:26:15|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:26:10|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:26:10|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 11:26:10|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 11:26:10|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 11:26:10|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 11:26:10|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 11:26:10|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 11:26:10|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

7|Jun 24 2010 11:26:07|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:26:07|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 11:26:07|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 11:26:07|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 11:26:07|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 11:26:07|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 11:26:07|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 11:26:07|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

4|Jun 24 2010 11:26:03|713903: IP = x.x.198.138, Error: Unable to remove PeerTblEntry

3|Jun 24 2010 11:26:03|713902: IP = x.x.198.138, Removing peer from peer table failed, no match!

7|Jun 24 2010 11:26:03|713906: IP = x.x.198.138, sending delete/delete with reason message

7|Jun 24 2010 11:26:03|713906: IP = x.x.198.138, IKE SA MM:98521954 terminating:  flags 0x01000002, refcnt 0, tuncnt 0

7|Jun 24 2010 11:26:03|715065: IP = x.x.198.138, IKE MM Responder FSM error history (struct &0x3940150)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent

6|Jun 24 2010 11:26:02|302014: Teardown TCP connection 71292 for outside:x.x.198.138/16377 to NP Identity Ifc:66.92.228.251/443 duration 0:00:00 bytes 1241 TCP FINs

6|Jun 24 2010 11:26:01|605005: Login permitted from x.x.198.138/16377 to outside:66.92.228.251/https for user "alex"

6|Jun 24 2010 11:26:01|302013: Built inbound TCP connection 71292 for outside:x.x.198.138/16377 (x.x.198.138/16377) to NP Identity Ifc:66.92.228.251/443 (66.92.228.251/443)

6|Jun 24 2010 11:26:01|302014: Teardown TCP connection 71291 for outside:x.x.198.138/16375 to NP Identity Ifc:66.92.228.251/443 duration 0:00:00 bytes 1369 TCP FINs

6|Jun 24 2010 11:26:00|605005: Login permitted from x.x.198.138/16375 to outside:66.92.228.251/https for user "alex"

7|Jun 24 2010 11:26:00|710002: TCP access permitted from x.x.198.138/16375 to outside:66.92.228.251/https

6|Jun 24 2010 11:26:00|302013: Built inbound TCP connection 71291 for outside:x.x.198.138/16375 (x.x.198.138/16375) to NP Identity Ifc:66.92.228.251/443 (66.92.228.251/443)

7|Jun 24 2010 11:25:55|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:25:47|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

6|Jun 24 2010 11:25:47|713905: IP = x.x.198.138, P1 Retransmit msg dispatched to MM FSM

5|Jun 24 2010 11:25:47|713201: IP = x.x.198.138, Duplicate Phase 1 packet detected.  Retransmitting last packet.

7|Jun 24 2010 11:25:45|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

6|Jun 24 2010 11:25:38|606003: ASDM logging session number 0 from x.x.198.138 started

6|Jun 24 2010 11:25:38|605005: Login permitted from x.x.198.138/16373 to outside:66.92.228.251/https for user "alex"

7|Jun 24 2010 11:25:37|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 11:25:37|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 11:25:37|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 11:25:37|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 11:25:37|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 11:25:37|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 11:25:37|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 11:25:37|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

6|Jun 24 2010 11:25:37|302013: Built inbound TCP connection 71200 for outside:x.x.198.138/16373 (x.x.198.138/16373) to NP Identity Ifc:66.92.228.251/443 (66.92.228.251/443)

6|Jun 24 2010 11:25:31|302014: Teardown TCP connection 71197 for outside:x.x.198.138/16370 to NP Identity Ifc:66.92.228.251/443 duration 0:00:00 bytes 1241 TCP FINs

6|Jun 24 2010 11:25:31|605005: Login permitted from x.x.198.138/16370 to outside:66.92.228.251/https for user "alex"

6|Jun 24 2010 11:25:31|302013: Built inbound TCP connection 71197 for outside:x.x.198.138/16370 (x.x.198.138/16370) to NP Identity Ifc:66.92.228.251/443 (66.92.228.251/443)

6|Jun 24 2010 11:25:31|302014: Teardown TCP connection 71196 for outside:x.x.198.138/16368 to NP Identity Ifc:66.92.228.251/443 duration 0:00:00 bytes 1369 TCP FINs

6|Jun 24 2010 11:25:30|605005: Login permitted from x.x.198.138/16368 to outside:66.92.228.251/https for user "alex"

7|Jun 24 2010 11:25:30|710002: TCP access permitted from x.x.198.138/16368 to outside:66.92.228.251/https

6|Jun 24 2010 11:25:30|302013: Built inbound TCP connection 71196 for outside:x.x.198.138/16368 (x.x.198.138/16368) to NP Identity Ifc:66.92.228.251/443 (66.92.228.251/443)

5|Jun 24 2010 11:25:23|713904: IP = x.x.198.138, Received encrypted packet with no matching SA, dropping

4|Jun 24 2010 10:51:40|713903: IP = x.x.198.138, Error: Unable to remove PeerTblEntry

3|Jun 24 2010 10:51:40|713902: IP = x.x.198.138, Removing peer from peer table failed, no match!

7|Jun 24 2010 10:51:40|713906: IP = x.x.198.138, sending delete/delete with reason message

7|Jun 24 2010 10:51:40|713906: IP = x.x.198.138, IKE SA MM:ee1c532f terminating:  flags 0x01000002, refcnt 0, tuncnt 0

7|Jun 24 2010 10:51:40|715065: IP = x.x.198.138, IKE MM Responder FSM error history (struct &0x39f6fe8)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent

7|Jun 24 2010 10:51:37|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 10:51:32|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 10:51:29|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 10:51:24|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

6|Jun 24 2010 10:51:24|713905: IP = x.x.198.138, P1 Retransmit msg dispatched to MM FSM

5|Jun 24 2010 10:51:24|713201: IP = x.x.198.138, Duplicate Phase 1 packet detected.  Retransmitting last packet.

7|Jun 24 2010 10:51:22|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 10:51:21|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

6|Jun 24 2010 10:51:15|302014: Teardown TCP connection 68481 for outside:x.x.198.138/16243 to NP Identity Ifc:66.92.228.251/443 duration 0:00:10 bytes 1001 TCP FINs

7|Jun 24 2010 10:51:14|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 10:51:14|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 10:51:14|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 10:51:14|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 10:51:14|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 10:51:14|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 10:51:14|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 10:51:14|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

4|Jun 24 2010 10:51:13|713903: IP = x.x.198.138, Error: Unable to remove PeerTblEntry

3|Jun 24 2010 10:51:13|713902: IP = x.x.198.138, Removing peer from peer table failed, no match!

7|Jun 24 2010 10:51:13|713906: IP = x.x.198.138, sending delete/delete with reason message

7|Jun 24 2010 10:51:13|713906: IP = x.x.198.138, IKE SA MM:d19cac55 terminating:  flags 0x01000002, refcnt 0, tuncnt 0

7|Jun 24 2010 10:51:13|715065: IP = x.x.198.138, IKE MM Responder FSM error history (struct &0x39f6fe8)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent

7|Jun 24 2010 10:51:13|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 10:51:13|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 10:51:13|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 10:51:13|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 10:51:13|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 10:51:13|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 10:51:13|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 10:51:13|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

4|Jun 24 2010 10:51:08|713903: IP = x.x.198.138, Error: Unable to remove PeerTblEntry

3|Jun 24 2010 10:51:08|713902: IP = x.x.198.138, Removing peer from peer table failed, no match!

7|Jun 24 2010 10:51:08|713906: IP = x.x.198.138, sending delete/delete with reason message

7|Jun 24 2010 10:51:08|713906: IP = x.x.198.138, IKE SA MM:5b528d9f terminating:  flags 0x01000002, refcnt 0, tuncnt 0

7|Jun 24 2010 10:51:08|715065: IP = x.x.198.138, IKE MM Responder FSM error history (struct &0x3920f28)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent

7|Jun 24 2010 10:51:05|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

6|Jun 24 2010 10:51:05|605005: Login permitted from x.x.198.138/16243 to outside:66.92.228.251/https for user "alex"

7|Jun 24 2010 10:51:04|710002: TCP access permitted from x.x.198.138/16243 to outside:66.92.228.251/https

6|Jun 24 2010 10:51:04|302013: Built inbound TCP connection 68481 for outside:x.x.198.138/16243 (x.x.198.138/16243) to NP Identity Ifc:66.92.228.251/443 (66.92.228.251/443)

6|Jun 24 2010 10:51:01|713219: IP = x.x.198.138, Queuing KEY-ACQUIRE messages to be processed when P1 SA is complete.

6|Jun 24 2010 10:51:01|302014: Teardown TCP connection 68425 for outside:x.x.198.138/16241 to NP Identity Ifc:66.92.228.251/443 duration 0:00:11 bytes 1583 TCP FINs

7|Jun 24 2010 10:51:00|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 10:50:57|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

6|Jun 24 2010 10:50:55|302014: Teardown TCP connection 68421 for outside:x.x.198.138/16239 to NP Identity Ifc:66.92.228.251/443 duration 0:00:10 bytes 993 TCP FINs

7|Jun 24 2010 10:50:52|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

6|Jun 24 2010 10:50:52|713905: IP = x.x.198.138, P1 Retransmit msg dispatched to MM FSM

5|Jun 24 2010 10:50:52|713201: IP = x.x.198.138, Duplicate Phase 1 packet detected.  Retransmitting last packet.

6|Jun 24 2010 10:50:50|605005: Login permitted from x.x.198.138/16241 to outside:66.92.228.251/https for user "alex"

7|Jun 24 2010 10:50:50|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

6|Jun 24 2010 10:50:50|302013: Built inbound TCP connection 68425 for outside:x.x.198.138/16241 (x.x.198.138/16241) to NP Identity Ifc:66.92.228.251/443 (66.92.228.251/443)

7|Jun 24 2010 10:50:49|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

6|Jun 24 2010 10:50:44|605005: Login permitted from x.x.198.138/16239 to outside:66.92.228.251/https for user "alex"

7|Jun 24 2010 10:50:44|710002: TCP access permitted from x.x.198.138/16239 to outside:66.92.228.251/https

6|Jun 24 2010 10:50:44|302013: Built inbound TCP connection 68421 for outside:x.x.198.138/16239 (x.x.198.138/16239) to NP Identity Ifc:66.92.228.251/443 (66.92.228.251/443)

7|Jun 24 2010 10:50:42|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 10:50:42|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 10:50:42|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 10:50:42|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 10:50:42|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 10:50:42|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 10:50:42|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 10:50:42|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

7|Jun 24 2010 10:50:41|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 10:50:41|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 10:50:41|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 10:50:41|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 10:50:41|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 10:50:41|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 10:50:41|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 10:50:41|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

4|Jun 24 2010 10:50:39|713903: IP = x.x.198.138, Error: Unable to remove PeerTblEntry

3|Jun 24 2010 10:50:39|713902: IP = x.x.198.138, Removing peer from peer table failed, no match!

7|Jun 24 2010 10:50:39|713906: IP = x.x.198.138, sending delete/delete with reason message

7|Jun 24 2010 10:50:39|713906: IP = x.x.198.138, IKE SA MM:1720f77f terminating:  flags 0x01000002, refcnt 0, tuncnt 0

7|Jun 24 2010 10:50:39|715065: IP = x.x.198.138, IKE MM Responder FSM error history (struct &0x3920f28)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent

4|Jun 24 2010 10:50:37|713903: IP = x.x.198.138, Error: Unable to remove PeerTblEntry

3|Jun 24 2010 10:50:37|713902: IP = x.x.198.138, Removing peer from peer table failed, no match!

7|Jun 24 2010 10:50:37|713906: IP = x.x.198.138, sending delete/delete with reason message

7|Jun 24 2010 10:50:37|713906: IP = x.x.198.138, IKE SA MM:f66abebb terminating:  flags 0x01000002, refcnt 0, tuncnt 0

7|Jun 24 2010 10:50:37|715065: IP = x.x.198.138, IKE MM Responder FSM error history (struct &0x39f6fe8)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent-->MM_SND_MSG2, EV_SND_MSG-->MM_SND_MSG2, EV_START_TMR-->MM_SND_MSG2, EV_RESEND_MSG-->MM_WAIT_MSG3, EV_TIMEOUT-->MM_WAIT_MSG3, NullEvent

7|Jun 24 2010 10:50:31|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 10:50:29|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

6|Jun 24 2010 10:50:28|302014: Teardown TCP connection 68379 for outside:x.x.198.138/16237 to NP Identity Ifc:66.92.228.251/443 duration 0:00:00 bytes 1241 TCP FINs

6|Jun 24 2010 10:50:28|605005: Login permitted from x.x.198.138/16237 to outside:66.92.228.251/https for user "alex"

6|Jun 24 2010 10:50:28|302013: Built inbound TCP connection 68379 for outside:x.x.198.138/16237 (x.x.198.138/16237) to NP Identity Ifc:66.92.228.251/443 (66.92.228.251/443)

6|Jun 24 2010 10:50:27|605005: Login permitted from x.x.198.138/16235 to outside:66.92.228.251/https for user "alex"

7|Jun 24 2010 10:50:27|710002: TCP access permitted from x.x.198.138/16235 to outside:66.92.228.251/https

6|Jun 24 2010 10:50:27|302013: Built inbound TCP connection 68369 for outside:x.x.198.138/16235 (x.x.198.138/16235) to NP Identity Ifc:66.92.228.251/443 (66.92.228.251/443)

7|Jun 24 2010 10:50:23|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 10:50:21|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

6|Jun 24 2010 10:50:21|713905: IP = x.x.198.138, P1 Retransmit msg dispatched to MM FSM

5|Jun 24 2010 10:50:21|713201: IP = x.x.198.138, Duplicate Phase 1 packet detected.  Retransmitting last packet.

7|Jun 24 2010 10:50:19|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 10:50:15|713236: IP = x.x.198.138, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 10:50:11|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 10:50:11|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 10:50:11|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 10:50:11|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

7|Jun 24 2010 10:50:11|715047: IP = x.x.198.138, processing IKE SA payload

7|Jun 24 2010 10:50:11|713906: IP = x.x.198.138, Oakley proposal is acceptable

7|Jun 24 2010 10:50:11|715047: IP = x.x.198.138, processing SA payload

7|Jun 24 2010 10:50:11|713236: IP = x.x.198.138, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + NONE (0) total length : 84

7|Jun 24 2010 10:50:07|713236: IP = x.x.198.138, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

7|Jun 24 2010 10:50:07|715046: IP = x.x.198.138, constructing Fragmentation VID + extended capabilities payload

7|Jun 24 2010 10:50:07|715046: IP = x.x.198.138, constructing ISAKMP SA payload

7|Jun 24 2010 10:50:07|715028: IP = x.x.198.138, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4

Marcin Latosiewicz Thu, 06/24/2010 - 09:48

Alex,

Quick questio based on this message:

WARNING, had problems decrypting packet, probably due to mismatched  pre-shared key.  Switching user to tunnel-group: DefaultL2LGroup

Is this a typical lan to lan tunnel (and not remote access) ie, configured statically on both sides and with pre-shared key?

Nromally on ASA you should have an entry like:

tunnel-group IP_ADDRESS_HERE type ipsec-l2l

tunnel-group IP_ADDRESS_HERE ipsec

pre-shared-key ....

Where IP address is IP of the device on the other side.

In your case the connection always lands on the default groups (both RA and L2L).

Marcin

DTSCanada Thu, 06/24/2010 - 14:59

Marcin,

thanks for the replying,

we have both l2l and RA policy.

and most of the time site-2-site will work until the peak hours then it start giving those msg and after a while site 2 site is up.

even I re setup a new site2site VPN doesn't help.

something else is wrong.

alex

Marcin Latosiewicz Thu, 06/24/2010 - 15:42

Alex,

I think it's high time you either start working with TAC or provide us with at least configs from both sides of the tunnel.

Support forums cannot gurantee you an SLA or answer at appropriate time for you.

Marcin

DTSCanada Fri, 06/25/2010 - 06:55

Hi, Marcin,

this is the config of ASA side ,other side is using a linksys RV042 which has no file, but a web interface, I think it's asa side ,cause I changed from pix to linksys the problem remains.

thanks a lot.

smtp# show running-config
: Saved
:
ASA Version 7.0(5)
!
hostname smtp
domain-name xxx.com
enable password 0tXNa6IPkas1Ycdw encrypted
names
dns-guard
!
interface Ethernet0/0
nameif outside
security-level 0
ip address xx.xx.228.251 255.255.255.248
!
interface Ethernet0/1
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
!
interface Ethernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
shutdown
nameif management
security-level 100
ip address 192.168.3.1 255.255.255.0
management-only
!
passwd 9jNfZuG3TC5tCVH0 encrypted
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
access-list outside_acl extended permit tcp any interface outside eq smtp
access-list outside_acl extended permit icmp any any
access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 172.16.1.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list outside_cryptomap_20 extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list dynamicpa_splitTunnelAcl standard permit 192.168.1.0 255.255.255.0
access-list DynamicASA_splitTunnelAcl standard permit host 192.168.1.1
access-list outside_cryptomap_40 extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list outside_in extended permit tcp any host xx.xx.228.251 eq smtp
access-list outside_in extended permit tcp any host xx.xx.228.251 eq 82
access-list outside_in extended permit tcp any host xx.xx.228.251 eq 8082
access-list outside_in extended permit tcp any host xx.xx.228.251 eq pop3
access-list outside_in extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list outside_in extended permit icmp any any
access-list capture extended permit ip host 192.168.1.227 host 192.168.2.129
access-list capture extended permit ip host 192.168.2.129 host 192.168.1.227
access-list outside_cryptomap_60_1 extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list outside_cryptomap_80 extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
pager lines 24
logging enable
logging buffered debugging
logging trap informational
logging asdm debugging
logging class vpn mail emergencies
logging class vpnc mail emergencies
mtu outside 1500
mtu inside 1500
mtu management 1500
ip local pool dynamicdhcppool 172.16.1.60-172.16.1.80 mask 255.255.255.0
icmp permit host xx.xx.198.138 outside
icmp permit xxx.xxx.0.0 255.255.0.0 outside
icmp permit any inside
asdm image disk0:/asdm505.bin
asdm history enable
arp timeout 14400
global (outside) 10 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 10 0.0.0.0 0.0.0.0
static (inside,outside) tcp xx.xx.228.251 82 192.168.1.2 82 netmask 255.255.255.255
static (inside,outside) tcp xx.xx.228.251 smtp 192.168.1.2 smtp netmask 255.255.255.255
static (inside,outside) tcp xx.xx.228.251 pop3 192.168.1.2 pop3 netmask 255.255.255.255
static (inside,outside) tcp xx.xx.228.251 8082 192.168.1.2 8082 netmask 255.255.255.255
access-group outside_in in interface outside
route outside 0.0.0.0 0.0.0.0 xx.xx.228.249 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
group-policy DfltGrpPolicy attributes
banner none
wins-server none
dns-server none
dhcp-network-scope none
vpn-access-hours none
vpn-simultaneous-logins 3
vpn-idle-timeout none
vpn-session-timeout none
vpn-filter none
vpn-tunnel-protocol IPSec
password-storage disable
ip-comp disable
re-xauth disable
group-lock none
pfs disable
ipsec-udp disable
ipsec-udp-port 10000
split-tunnel-policy tunnelall
split-tunnel-network-list none
default-domain none
split-dns none
secure-unit-authentication disable
user-authentication disable
user-authentication-idle-timeout 30
ip-phone-bypass disable
leap-bypass disable
nem disable
backup-servers keep-client-config
client-firewall none
client-access-rule none
webvpn
  functions url-entry
  port-forward-name value Application Access
group-policy dynamicpa internal
group-policy dynamicpa attributes
dns-server value 64.80.203.201 64.80.203.194
vpn-idle-timeout none
split-tunnel-policy tunnelspecified
split-tunnel-network-list value dynamicpa_splitTunnelAcl
default-domain value xxx.com
webvpn
group-policy dynamicasa internal
group-policy dynamicasa attributes
dns-server value 64.80.203.201 64.80.203.194
vpn-idle-timeout none
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value dynamicpa_splitTunnelAcl
default-domain value xxx.com
client-access-rule none
webvpn
aaa authentication ssh console LOCAL
.
.
.
http server enable
http xx.xx.228.250 255.255.255.255 outside
http xx.xx.198.138 255.255.255.255 outside
http 173.206.0.0 255.255.0.0 outside
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set TUNNEL_ESP_DES_None esp-des esp-none
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 40 set transform-set ESP-3DES-MD5
crypto map outside_map 20 match address outside_cryptomap_20
crypto map outside_map 20 set peer xx.xx.198.138
crypto map outside_map 20 set transform-set ESP-3DES-SHA
crypto map outside_map 20 set security-association lifetime seconds 86400
crypto map outside_map 60 match address outside_cryptomap_60_1
crypto map outside_map 60 set peer xx.xx.198.138
crypto map outside_map 60 set transform-set ESP-DES-SHA
crypto map outside_map 80 match address outside_cryptomap_80
crypto map outside_map 80 set peer xx.xx.198.138
crypto map outside_map 80 set transform-set ESP-3DES-SHA
crypto map outside_map 60000 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
isakmp identity address
isakmp enable outside
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash sha
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
isakmp policy 30 authentication pre-share
isakmp policy 30 encryption des
isakmp policy 30 hash md5
isakmp policy 30 group 1
isakmp policy 30 lifetime 86400
isakmp policy 50 authentication pre-share
isakmp policy 50 encryption 3des
isakmp policy 50 hash md5
isakmp policy 50 group 2
isakmp policy 50 lifetime 86400
isakmp nat-traversal  20
tunnel-group DefaultL2LGroup ipsec-attributes
pre-shared-key *
tunnel-group DefaultRAGroup general-attributes
address-pool dynamicdhcppool
tunnel-group DefaultRAGroup ipsec-attributes
pre-shared-key *
peer-id-validate nocheck
tunnel-group dynamicasa type ipsec-ra
tunnel-group dynamicasa general-attributes
address-pool dynamicdhcppool
default-group-policy dynamicasa
tunnel-group dynamicasa ipsec-attributes
pre-shared-key *
tunnel-group xx.xx.198.138 type ipsec-l2l
tunnel-group xx.xx.198.138 ipsec-attributes
pre-shared-key *
no tunnel-group-map enable ou
no vpn-addr-assign aaa
no vpn-addr-assign dhcp
telnet timeout 5
ssh 171.68.225.212 255.255.255.255 outside
ssh xx.xx.198.138 255.255.255.255 outside
ssh 173.206.0.0 255.255.0.0 outside
ssh 192.168.1.0 255.255.255.0 inside
ssh timeout 60
console timeout 0
management-access inside
dhcpd address 192.168.1.60-192.168.1.80 inside
dhcpd dns 64.80.203.201 64.80.203.194
dhcpd lease 3600
dhcpd ping_timeout 50
dhcpd domain dynamicteamsports.com
dhcpd enable inside
tftp-server inside 192.168.1.1 disk0/config
webvpn
authorization-server-group LOCAL
smtp-server xxx.xxx.148.139
client-update enable
Cryptochecksum:fa165fc1f3e76f43f2575c48bdf07eda
: end
smtp#

Marcin Latosiewicz Fri, 06/25/2010 - 07:20

Alex,

I would seriously consider removing the overlapp.

-----------

crypto map outside_map 20 match address outside_cryptomap_20
crypto  map outside_map 20 set peer xx.xx.198.138
crypto map outside_map 20  set transform-set ESP-3DES-SHA
crypto map outside_map 20 set  security-association lifetime seconds 86400
crypto map outside_map 60  match address outside_cryptomap_60_1
crypto map outside_map 60 set  peer xx.xx.198.138
crypto map outside_map 60 set transform-set  ESP-DES-SHA
crypto map outside_map 80 match address  outside_cryptomap_80
crypto map outside_map 80 set peer xx.xx.198.138
crypto  map outside_map 80 set transform-set ESP-3DES-SHA

------------

You con't need all of them!  All the entries look the same!.

I would DEFINETLY add a tunnel-group

----------

tunnel-group xx.xx.198.138 ipsec-l2l

tunnel-group xx.xx.198.138 ipsec

pre-shared-key....

--------

As soon as possible upgrade the ASA to a newer release then 7.0.5. It's ancient and 7.0 is no longer continued.

DTSCanada Fri, 06/25/2010 - 09:13

Thanks Marcin,

I will remove those entries and those were added when I started having these

problems and I tried to add a new l2l a tunnel for fixing problem.

I already have a L2L tunnel setup, do I still need add following?

"tunnel-group xx.xx.198.138 ipsec-l2l

tunnel-group xx.xx.198.138 ipsec

pre-shared-key....

"

by the way,

I once tried to remote access asa behind the l2l vpn and was trying to setup a RA VPN-Cisco vpn client ( from the same IP) to connect ASA, then the gateway already has a site2site vpn to other end and then another remote client vpn is setting up a nother vpn tunnel from the same IP, will this be the cause for the drop.  FYI, 2 VPN can connect at the same time when ok and when VPN dropped, they both dropped.

any thought on this?

Best Regards,

Alex

Marcin Latosiewicz Fri, 06/25/2010 - 11:10

Alex,

Yes please setup a separate proper tunnel-group not to let the tunnel land on default one like it does now.

Can you plase re-phrase this?

"I once tried to remote access asa behind the l2l vpn and was trying to  setup a RA VPN-Cisco vpn client ( from the same IP) to connect ASA, then  the gateway already has a site2site vpn to other end and then another  remote client vpn is setting up a nother vpn tunnel from the same IP,  will this be the cause for the drop.  FYI, 2 VPN can connect at the same  time when ok and when VPN dropped, they both dropped."

I'm getting a headache reading

Marcin

DTSCanada Fri, 06/25/2010 - 14:10

Sorry for the confusion.

I mean: I setup a site2site between 2 gateways and behind the gateway, I

also installed cisco vpn client and created a remote ipsec vpn tunnel to

other gateway, which is the same ip address to the other end(using nat). 2

vpn work together and down together.

will this give me the problem?

hope this will help.

Best Regards,

Alex

Marcin Latosiewicz Sat, 06/26/2010 - 03:27

Alex,

Gotcha now.

Well from debugs it looks like it's nothing  related to ASA itself. Some IKE messages are never received by ASA, be it rate limiting or some dynamic filtering.

During the problem what is a result of extended ping  from one public IP to the other (say 10000 echo requests with timeout of 1)? (Provided that it works OK during normal operation)

There's still quite a few questions mark here, but  unless we can explain where and why the packets are being dropped there's not much we can do.

ASA and PIX both have capture machenism build in.

You can capture for IKE (udp/500) packets during the issue to see if ASA is truly sending the IKE packets and not receiving anything back. But this is just to confirm our observation.

Marcin

agrigoldindia9999 Fri, 10/07/2011 - 22:35

Hi All,

Any update on this issue ?

because iam also faceing same issue from last few days......

iam also haveing the same setup and devicess useing ASA5520, RV082 for site to site.

on every day peak hours my remote vpn users are faceing 412 remote gateway not respoinding .

Regards,

Prasad

Actions

This Discussion

Related Content