VPN3015 Error message

tkpsimon · ‎09-11-2002

Dear Everybody,

I been setting up this VPN concentrator for remote access client, but i'm keep getting this kind of error message from the event log. I don't have any problem with the connection, but just want to know what does it mean by that, and are there anyway i can get rid of them?

Look forward for any suggestoin, thanks in advance.

Simon

Sep 10 10:41:21 209.227.86.29 6275 09/10/2002 10:41:43.260 SEV=4 HTTP/13

RPT=1133 209.227.180.199 HTTP 400 Bad Request: Form Error

Sep 10 10:41:22 209.227.86.29 6276 09/10/2002 10:41:43.430 SEV=4 HTTP/50

RPT=1138 209.227.180.199 HTTP 404 Not Found (/scripts/..ƒ`

\234../winnt/system32/cmd.exe)

Sep 10 10:41:22 209.227.86.29 6277 09/10/2002 10:41:43.430 SEV=3 HTTP/10

RPT=1151 209.227.180.199 HTTP 401 Unauthorized: Authorization Not Present

Sep 10 10:41:22 209.227.86.29 6278 09/10/2002 10:41:43.430 SEV=4 HTTP/13

RPT=1134 209.227.180.199 HTTP 400 Bad Request: Form Error

Sep 10 10:41:22 209.227.86.29 6279 09/10/2002 10:41:43.620 SEV=4 HTTP/50

RPT=1139 209.227.180.199 HTTP 404 Not Found (/scripts/..E

c../winnt/system32/cmd.exe)

Sep 10 10:41:22 209.227.86.29 6280 09/10/2002 10:41:43.620 SEV=3 HTTP/10

RPT=1152 209.227.180.199 HTTP 401 Unauthorized: Authorization Not Present

Sep 10 10:41:22 209.227.86.29 6281 09/10/2002 10:41:43.620 SEV=4 HTTP/13

RPT=1135 209.227.180.199 HTTP 400 Bad Request: Form Error

Sep 10 10:41:22 209.227.86.29 6282 09/10/2002 10:41:43.800 SEV=4 HTTP/50

RPT=1140 209.227.180.199 HTTP 404 Not Found (/scripts/..E

c../winnt/system32/cmd.exe)

Sep 10 10:41:22 209.227.86.29 6283 09/10/2002 10:41:43.800 SEV=3 HTTP/10

RPT=1153 209.227.180.199 HTTP 401 Unauthorized: Authorization Not Present

Sep 10 10:41:22 209.227.86.29 6284 09/10/2002 10:41:43.800 SEV=4 HTTP/13

RPT=1136 209.227.180.199 HTTP 400 Bad Request: Form Error

Sep 10 10:41:22 209.227.86.29 6285 09/10/2002 10:41:43.980 SEV=4 HTTP/50

RPT=1141 209.227.180.199 HTTP 404 Not Found

(/scripts/..%5c../winnt/system32/cmd.exe)

Sep 10 10:41:22 209.227.86.29 6286 09/10/2002 10:41:43.980 SEV=3 HTTP/10

RPT=1154 209.227.180.199 HTTP 401 Unauthorized: Authorization Not Present

Sep 10 10:41:22 209.227.86.29 6287 09/10/2002 10:41:43.980 SEV=4 HTTP/13

RPT=1137 209.227.180.199 HTTP 400 Bad Request: Form Error

Sep 10 10:41:22 209.227.86.29 6288 09/10/2002 10:41:44.150 SEV=4 HTTP/50

RPT=1142 209.227.180.199 HTTP 404 Not Found

(/scripts/..%2f../winnt/system32/cmd.exe)

Sep 10 10:41:22 209.227.86.29 6289 09/10/2002 10:41:44.150 SEV=3 HTTP/10

RPT=1155 209.227.180.199 HTTP 401 Unauthorized: Authorization Not Present

Sep 10 10:41:22 209.227.86.29 6290 09/10/2002 10:41:44.150 SEV=4 HTTP/13

RPT=1138 209.227.180.199 HTTP 400 Bad Request: Form Error

Sep 10 10:44:23 172.16.4.9 21246: Sep 10 10:44:40: %SEC-6-IPACCESSLOGP: list

120 permitted udp 209.227.86.29(514) -> 64.32.177.23(514), 96 packets

murabi · ‎09-18-2002

I only doubt your AAA configs. Check them out as it seems to be complaining about an Authorization problem.

noc · ‎09-24-2002

Looks like NIMDA virus from around is scanning and hitting your public

interface. I would lock your public interface down from HTTP/https and

of course, everything.

Nimda is treating the vpn's webserver like IIS on a microsoft box, and trying

to crack its way into directories and get rights to do damage.

I doubt it can hurt the vpn, by why risk problems, crashes and the cpu overhead

bhesk · ‎09-24-2002

Another good reason why you should put your 3000 behind a firewall :-)

Barry