Cisco Systems VPN Client Version 5.0.02.0090 Copyright (C) 1998-2007 Cisco Systems, Inc. All Rights Reserved. Client Type(s): Windows, WinNT Running on: 6.0.6001 Service Pack 1 23 11:49:58.219 05/25/09 Sev=Warning/3 IKE/0xE3000081 Invalid remote certificate id: ID_IPV4_ADDR: ID = 0x3DD827C3, Certificate = 0x00000000 24 11:49:58.219 05/25/09 Sev=Warning/3 IKE/0xE3000059 The peer's certificate doesn't match Phase 1 ID 25 11:49:58.219 05/25/09 Sev=Warning/2 IKE/0xE30000A7 Unexpected SW error occurred while processing Identity Protection (Main Mode) negotiator:(Navigator:2238) ------------------------------------------------------------------------------------------------------------------ May 25 11:48:55 IP_ASA May 25 2009 11:46:30 ssl : %ASA-7-717029: Identified client certificate within certificate chain. serial number: 12C0AC7700000000001B, subject name: cn=mbaran,ou=ADMIN_ANY_TUNNEL,o=FIRMA. May 25 11:48:55 IP_ASA May 25 2009 11:46:30 ssl : %ASA-6-717022: Certificate was successfully validated. serial number: 12C0AC7700000000001B, subject name: cn=mbaran,ou=ADMIN_ANY_TUNNEL,o=FIRMA. May 25 11:51:14 IP_ASA.2 May 25 2009 11:48:50 ssl : %ASA-7-717029: Identified client certificate within certificate chain. serial number: 12C0AC7700000000001B, subject name: cn=mbaran,ou=ADMIN_ANY_TUNNEL,o=FIRMA. May 25 11:51:14 IP_ASA May 25 2009 11:48:50 ssl : %ASA-6-717022: Certificate was successfully validated. serial number: 12C0AC7700000000001B, subject name: cn=mbaran,ou=ADMIN_ANY_TUNNEL,o=FIRMA. May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-609001: Built local-host INET:ASA_EXTERNAL_IP May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-6-302015: Built inbound UDP connection 1866048 for INET:NAT_IP_EXT/57240 (NAT_IP_EXT/57240) to identity:XXX/500 (XXX/500) May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-713236: IP = NAT_IP_EXT, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 1144 May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715047: IP = NAT_IP_EXT, processing SA payload May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-713906: IP = NAT_IP_EXT, Oakley proposal is acceptable May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715047: IP = NAT_IP_EXT, processing VID payload May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715049: IP = NAT_IP_EXT, Received xauth V6 VID May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715047: IP = NAT_IP_EXT, processing VID payload May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715049: IP = NAT_IP_EXT, Received DPD VID May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715047: IP = NAT_IP_EXT, processing VID payload May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715049: IP = NAT_IP_EXT, Received Fragmentation VID May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715064: IP = NAT_IP_EXT, IKE Peer included IKE fragmentation capability flags: Main Mode: True Aggressive Mode: False May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715047: IP = NAT_IP_EXT, processing VID payload May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715049: IP = NAT_IP_EXT, Received NAT-Traversal ver 02 VID May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715047: IP = NAT_IP_EXT, processing VID payload May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715049: IP = NAT_IP_EXT, Received Cisco Unity client VID May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715047: IP = NAT_IP_EXT, processing IKE SA payload May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715028: IP = NAT_IP_EXT, IKE SA Proposal # 1, Transform # 9 acceptable Matches global IKE entry # 7 May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715046: IP = NAT_IP_EXT, constructing ISAKMP SA payload May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715046: IP = NAT_IP_EXT, constructing NAT-Traversal VID ver 02 payload May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715046: IP = NAT_IP_EXT, constructing Fragmentation VID + extended capabilities payload May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-713236: IP = NAT_IP_EXT, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 132 May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-713236: IP = NAT_IP_EXT, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + NAT-D (130) + NAT-D (130) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 336 May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715047: IP = NAT_IP_EXT, processing ke payload May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715047: IP = NAT_IP_EXT, processing ISA_KE payload May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715047: IP = NAT_IP_EXT, processing nonce payload May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715047: IP = NAT_IP_EXT, processing NAT-Discovery payload May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-713906: IP = NAT_IP_EXT, computing NAT Discovery hash May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715047: IP = NAT_IP_EXT, processing NAT-Discovery payload May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-713906: IP = NAT_IP_EXT, computing NAT Discovery hash May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715047: IP = NAT_IP_EXT, processing VID payload May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715038: IP = NAT_IP_EXT, Processing IOS/PIX Vendor ID payload (version: 1.0.0, capabilities: 00000408) May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715047: IP = NAT_IP_EXT, processing VID payload May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715049: IP = NAT_IP_EXT, Received Cisco Unity client VID May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715046: IP = NAT_IP_EXT, constructing ke payload May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715046: IP = NAT_IP_EXT, constructing nonce payload May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715046: IP = NAT_IP_EXT, constructing certreq payload May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715046: IP = NAT_IP_EXT, constructing Cisco Unity VID payload May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715046: IP = NAT_IP_EXT, constructing xauth V6 VID payload May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715048: IP = NAT_IP_EXT, Send IOS VID May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715038: IP = NAT_IP_EXT, Constructing ASA spoofing IOS Vendor ID payload (version: 1.0.0, capabilities: 20000001) May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715046: IP = NAT_IP_EXT, constructing VID payload May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715048: IP = NAT_IP_EXT, Send Altiga/Cisco VPN3000/Cisco ASA GW VID May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715046: IP = NAT_IP_EXT, constructing NAT-Discovery payload May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-713906: IP = NAT_IP_EXT, computing NAT Discovery hash May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715046: IP = NAT_IP_EXT, constructing NAT-Discovery payload May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-713906: IP = NAT_IP_EXT, computing NAT Discovery hash May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-713906: IP = NAT_IP_EXT, Generating keys for Responder... May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-713236: IP = NAT_IP_EXT, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + CERT_REQ (7) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NAT-D (130) + NAT-D (130) + NONE (0) total length : 439 May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-6-302015: Built inbound UDP connection 1866049 for INET:NAT_IP_EXT/57242 (NAT_IP_EXT/57242) to identity:NAT_IP_EXT/4500 (NAT_IP_EXT/4500) May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715061: IP = NAT_IP_EXT, Rcv'd fragment from a new fragmentation set. Deleting any old fragments. May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715063: IP = NAT_IP_EXT, Successfully assembled an encrypted pkt from rcv'd fragments! May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-713236: IP = NAT_IP_EXT, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + ID (5) + CERT (6) + CERT_REQ (7) + SIG (9) + NOTIFY (11) + NONE (0) total length : 1383 May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715047: IP = NAT_IP_EXT, processing ID payload May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-713906: IP = NAT_IP_EXT, DER_ASN1_DN ID received, len 62 May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715047: IP = NAT_IP_EXT, processing cert payload May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715047: IP = NAT_IP_EXT, processing cert request payload May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715001: IP = NAT_IP_EXT, processing RSA signature May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715076: IP = NAT_IP_EXT, Computing hash for ISAKMP May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-6-713172: IP = NAT_IP_EXT, Automatic NAT Detection Status: Remote end IS behind a NAT device This end is NOT behind a NAT device May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-713906: IP = NAT_IP_EXT, Trying to find group via OU... May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-713906: IP = NAT_IP_EXT, Connection landed on tunnel_group ADMIN_ANY_TUNNEL May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-713906: Group = ADMIN_ANY_TUNNEL, IP = NAT_IP_EXT, peer ID type 9 received (DER_ASN1_DN) May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715046: Group = ADMIN_ANY_TUNNEL, IP = NAT_IP_EXT, constructing ID payload May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715046: Group = ADMIN_ANY_TUNNEL, IP = NAT_IP_EXT, constructing cert payload May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715001: Group = ADMIN_ANY_TUNNEL, IP = NAT_IP_EXT, constructing RSA signature May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715076: Group = ADMIN_ANY_TUNNEL, IP = NAT_IP_EXT, Computing hash for ISAKMP May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715046: Group = ADMIN_ANY_TUNNEL, IP = NAT_IP_EXT, constructing dpd vid payload May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-713236: IP = NAT_IP_EXT, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + ID (5) + CERT (6) + SIG (9) + VENDOR (13) + NONE (0) total length : 1329 May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-713236: IP = NAT_IP_EXT, IKE_DECODE RECEIVED Message (msgid=225ec571) with payloads : HDR + HASH (8) + DELETE (12) + NONE (0) total length : 80 May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-715047: Group = ADMIN_ANY_TUNNEL, IP = NAT_IP_EXT, processing hash payload May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-713906: Group = ADMIN_ANY_TUNNEL, IP = NAT_IP_EXT, processing delete May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-5-713050: Group = ADMIN_ANY_TUNNEL, IP = NAT_IP_EXT, Connection terminated for peer . Reason: Peer Terminate Remote Proxy N/A, Local Proxy N/A May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-7-713906: Group = ADMIN_ANY_TUNNEL, IP = NAT_IP_EXT, IKE SA MM:feaca091 terminating: flags 0x0105c802, refcnt 0, tuncnt 0 May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-3-713902: Group = ADMIN_ANY_TUNNEL, IP = NAT_IP_EXT, Removing peer from peer table failed, no match! May 25 12:17:46 IP_ASA May 25 2009 12:15:22 ssl : %ASA-4-713903: Group = ADMIN_ANY_TUNNEL, IP = NAT_IP_EXT, Error: Unable to remove PeerTblEntry