sonicos 5.9/6.0.5/6.2 log events reference...

| 1

SonicOS 5.9 / 6.0.5 / 6.2Log Events Reference Guide

with Enhanced Logging

Notes, Cautions, and Warnings

© 2014 Dell Inc.

Trademarks: Dell™, the DELL logo, SonicWALL™, SonicWALL GMS™, SonicWALL Analyzer™, Reassembly-Free Deep Packet Inspection™, Dynamic Security for the Global Network™, SonicWALL Clean VPN™, SonicWALL Clean Wireless™, SonicWALL Comprehensive Gateway Security Suite™, SonicWALL Mobile Connect™, and all other SonicWALL product and service names and slogans are trademarks of Dell Inc.

2014 – 09 P/N 232-002657-00 Rev. A

NOTE: A NOTE indicates important information that helps you make better use of your system.

CAUTION: A CAUTION indicates potential damage to hardware or loss of data if instructions are not followed.

WARNING: A WARNING indicates a potential for property damage, personal injury, or death.

OverviewThis reference guide lists and describes SonicOS log event messages for SonicOS 5.9, 6.0.5, and 6.2. Reference a log event message by using the alphabetical index from the Log Event Message Index table of this document.

This document contains the following sections:• Log > Monitor on page 1

• Log > Settings on page 1

• Index of Log Event Messages on page 2

• Log > Syslog on page 169

• Index of Syslog Tag Field Descriptions on page 170

• Table of Values on page 178

Log > MonitorThe Dell SonicWALL security appliance maintains an Event log for tracking potential security threats. This log can be viewed by navigating to the Dashboard > Log Monitor or Log > Log Monitor page, or it can be automatically sent to an email address for convenience and archiving. The log is displayed in a table and can be sorted by column.

For more information on configuring the Log Monitor page, refer to the SonicOS Administrator’s Guide.

Log > SettingsThe Log > Settings page allows you to categorize and customize the logging functions on your Dell SonicWALL security appliance for troubleshooting and diagnostics.

For more information on configuring and managing the Log > Settings page, refer to the SonicOS Administrator’s Guide.

SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide | 1

Index of Log Event MessagesThe following table is the Log Event Message Index, which is a list of log event messages for the SonicOS 5.9, 6.0.5, and 6.2 firmware.

Each log event message described in the following table provides the following log event details:

• Log Event Message ID Number—Displays the ID number of the log event message.

• Firmware Version—Displays the SonicOS firmware version the log event message appears on.

• Legacy Category—Displays the category event type. This is the same category as Table 1: Legacy Category on page 178.

• SonicOS Category—Displays the SonicOS category type. This is the same category as Table 2: Expanded Categories on page 179.

• Priority Level—Displays the level of urgency of the log event message. For additional information, you can also reference Table 3: Priority Level on page 182.

• SNMP Trap Type—Displays the SNMP Trap ID number of the log event message.

• Log Event Messages—Displays the name of the event message.

ID

Firmware

Version

Legacy

Category Category

Priority

Level

SNMP Trap

Type Message

4 5.9.0 Maintenance Firewall Event ALERT ‐‐‐

Network Security Appliance

activated



activated



activated

5 5.9.0 Maintenance Firewall Logging INFO ‐‐‐ Log Cleared



6 5.9.0 Maintenance Firewall Logging INFO ‐‐‐ Log successfully sent via E‐mail



10 5.9.0 System Error Security Services ERROR 602

Problem loading the URL List;

check Filter settings







12 5.9.0 System Error Firewall Logging WARNING 604

Problem sending log E‐mail;

check log settings



check log settings

2 |



check log settings

14 5.9.0 Blocked Sites Network Access ERROR 701 Web site access denied



15 5.9.0 Blocked Sites Network Access NOTICE 702 Newsgroup access denied



16 5.9.0 Blocked Sites Network Access NOTICE 703 Web site access allowed



17 5.9.0 Blocked Sites Network Access NOTICE 704 Newsgroup access allowed



18 5.9.0 Blocked Code Network Access NOTICE ‐‐‐ ActiveX access denied



19 5.9.0 Blocked Code Network Access NOTICE ‐‐‐ Java access denied



20 5.9.0 Blocked Code Network Access NOTICE ‐‐‐

ActiveX or Java archive access

denied



denied



denied

21 5.9.0 Blocked Code Network Access NOTICE ‐‐‐ Cookie removed



22 5.9.0 Attack

Intrusion Detec‐

tion ALERT 501 Ping of death dropped

22 6.0.5 Attack

Intrusion Detec‐


22 6.2.0 Attack

Intrusion Detec‐


23 5.9.0 Attack

Intrusion Detec‐

tion ALERT 502 IP spoof dropped


23 6.0.5 Attack

Intrusion Detec‐


23 6.2.0 Attack

Intrusion Detec‐


24 5.9.0 User Activity

Authenticated

Access INFO ‐‐‐

User logged out ‐ user discon‐

nect detected


Authenticated



nect detected


Authenticated



nect detected

25 5.9.0 Attack

Intrusion Detec‐

tion WARNING 503

Possible SYN flood attack

detected

25 6.0.5 Attack

Intrusion Detec‐

tion WARNING 503


detected

25 6.2.0 Attack

Intrusion Detec‐

tion WARNING 503


detected

27 5.9.0 Attack

Intrusion Detec‐

tion ALERT 505 Land attack dropped

27 6.0.5 Attack

Intrusion Detec‐


27 6.2.0 Attack

Intrusion Detec‐


28 5.9.0

TCP | UDP |

ICMP Network NOTICE ‐‐‐ Fragmented packet dropped

28 6.0.5

TCP | UDP |


28 6.2.0

TCP | UDP |



Authenticated

Access INFO ‐‐‐ Administrator login allowed


Authenticated



Authenticated


30 5.9.0 Attack

Authenticated

Access ALERT 560

Administrator login denied due

to bad credentials

30 6.0.5 Attack

Authenticated

Access ALERT 560


to bad credentials

4 |

30 6.2.0 Attack

Authenticated

Access ALERT 560


to bad credentials


Authenticated


User login from an internal zone

allowed


Authenticated



allowed


Authenticated



allowed


Authenticated


User login denied due to bad

credentials


Authenticated



credentials


Authenticated



credentials


Authenticated



credentials


Authenticated



credentials


Authenticated



credentials


Authenticated

Access INFO ‐‐‐ Pending login timed out


Authenticated



Authenticated


35 5.9.0 Attack

Authenticated

Access ALERT ‐‐‐

Administrator login denied

from %s; logins disabled from

this interface

35 6.0.5 Attack

Authenticated

Access ALERT 506



this interface

35 6.2.0 Attack

Authenticated

Access ALERT 506



this interface

36 5.9.0 TCP Network Access NOTICE ‐‐‐ TCP connection dropped



37 5.9.0 UDP Network Access NOTICE ‐‐‐ UDP packet dropped




38 5.9.0 ICMP Network Access NOTICE ‐‐‐

ICMP packet dropped due to

Policy



Policy



Policy

41 5.9.0 Debug Network Access NOTICE ‐‐‐ Unknown protocol dropped



43 5.9.0 Debug Network Access DEBUG ‐‐‐ IPsec connection interrupt



45 5.9.0 Debug Network DEBUG ‐‐‐ ARP Timeout



46 5.9.0 Debug Network Access DEBUG ‐‐‐ Broadcast packet dropped



48 5.9.0 Debug Network Access DEBUG ‐‐‐

Out‐of‐order command packet

dropped



dropped



dropped

49 5.9.0 Debug Unused DEBUG ‐‐‐ Failure to add data channel



53 5.9.0 System Error Firewall Event ERROR 607

The cache is full; %u open con‐

nections; some will be dropped







6 |


License exceeded: Connection

dropped because too many IP

addresses are in use on your

LAN





LAN





LAN

60 5.9.0 Blocked Sites Network Access NOTICE 705 Access to proxy server denied



61 5.9.0 System Error VPN IPsec ERROR 609 Diagnostic Code E



63 5.9.0 Debug Network DEBUG ‐‐‐

Received fragmented packet or

fragmentation needed







65 5.9.0 User Activity VPN IPsec INFO ‐‐‐ Illegal IPsec SPI



67 5.9.0 Attack VPN IPsec ERROR 508 IPsec Authentication Failed



68 5.9.0 Attack VPN IPsec ERROR 509 IPsec Decryption Failed



69 5.9.0 User Activity VPN IPsec INFO ‐‐‐

Incompatible IPsec Security

Association



Association



Association


70 5.9.0 Attack VPN IPsec ERROR 510

IPsec packet from or to an ille‐

gal host



gal host



gal host

81 5.9.0 Attack

Intrusion Detec‐

tion ALERT 520

Smurf Amplification attack

dropped

81 6.0.5 Attack

Intrusion Detec‐

tion ALERT 520


dropped

81 6.2.0 Attack

Intrusion Detec‐

tion ALERT 520


dropped

82 5.9.0 Attack

Intrusion Detec‐

tion ALERT 521 Possible port scan detected

82 6.0.5 Attack

Intrusion Detec‐


82 6.2.0 Attack

Intrusion Detec‐


83 5.9.0 Attack

Intrusion Detec‐

tion ALERT 522 Probable port scan detected

83 6.0.5 Attack

Intrusion Detec‐


83 6.2.0 Attack

Intrusion Detec‐


84 5.9.0 Maintenance Network INFO ‐‐‐ Failed to resolve name



87 5.9.0 User Activity VPN IKE INFO ‐‐‐

IKE Responder: Accepting IPsec

proposal (Phase 2)



proposal (Phase 2)



proposal (Phase 2)

88 5.9.0 User Activity VPN IKE WARNING 523

IKE Responder: IPsec proposal

does not match (Phase 2)







8 |


IKE negotiation complete. Add‐

ing IPsec SA. (Phase 2)







93 5.9.0 System Error Firewall Hardware ERROR 611 Diagnostic Code A



94 5.9.0 System Error Firewall Hardware ERROR 612 Diagnostic Code B



95 5.9.0 System Error Firewall Hardware ERROR 613 Diagnostic Code C



96 5.9.0 Maintenance GMS INFO ‐‐‐ Status



97 5.9.0

Connection

Traffic Network Traffic INFO ‐‐‐ Web site hit

97 6.0.5

Connection


97 6.2.0

Connection


98 5.9.0 Connection Network Traffic INFO ‐‐‐ Connection Opened



99 5.9.0 Maintenance DHCP Client INFO ‐‐‐

Retransmitting DHCP DIS‐

COVER.



COVER.



COVER.


Retransmitting DHCP Request

(Requesting).



(Requesting).




(Requesting).



(Renewing).



(Renewing).



(Renewing).



(Rebinding).



(Rebinding).



(Rebinding).



(Rebooting).



(Rebooting).



(Rebooting).



(Verifying).



(Verifying).



(Verifying).

105 5.9.0 Maintenance DHCP Client INFO ‐‐‐ Sending DHCP DISCOVER.




DHCP Server not available. Did

not get any DHCP OFFER.







107 5.9.0 Maintenance DHCP Client INFO ‐‐‐ Got DHCP OFFER. Selecting.



108 5.9.0 Maintenance DHCP Client INFO ‐‐‐ Sending DHCP Request.

10 |




DHCP Client did not get DHCP

ACK.



ACK.



ACK.

110 5.9.0 Maintenance DHCP Client INFO ‐‐‐ DHCP Client got NACK.




DHCP Client got ACK from

server.



server.



server.


DHCP Client is declining address

offered by the server.








DHCP Client sending Request

and going to REBIND state.









and going to RENEW state.








Sending DHCP Request (Renew‐

ing).



ing).




ing).


Sending DHCP Request (Rebind‐

ing).



ing).



ing).


Sending DHCP Request (Reboot‐

ing).



ing).



ing).


Sending DHCP Request (Verify‐

ing).



ing).



ing).


DHCP Client failed to verify and

lease has expired. Go to INIT

state.




state.




state.


DHCP Client got a new IP

address lease.



address lease.



address lease.

122 5.9.0 Maintenance DHCP Client INFO ‐‐‐ Sending DHCP RELEASE.



12 |

123 5.9.0 Maintenance Security Services INFO ‐‐‐

Access attempt from host with‐

out Anti‐Virus agent installed








Anti‐Virus agent out‐of‐date on

host



host



host

125 5.9.0 Maintenance Security Services WARNING 524 Received AV Alert: %s



127 5.9.0 Maintenance PPPoE INFO ‐‐‐ Starting PPPoE discovery



128 5.9.0 Maintenance PPPoE INFO ‐‐‐ PPPoE LCP Link Up



129 5.9.0 Maintenance PPPoE INFO ‐‐‐ PPPoE LCP Link Down



130 5.9.0 Maintenance PPPoE INFO ‐‐‐ PPPoE terminated



131 5.9.0 Maintenance PPPoE INFO ‐‐‐ PPPoE Network Connected



132 5.9.0 Maintenance PPPoE INFO ‐‐‐ PPPoE Network Disconnected



133 5.9.0 Maintenance PPPoE INFO ‐‐‐

PPPoE discovery process com‐

plete



plete




plete


PPPoE starting CHAP Authenti‐

cation



cation



cation

138 5.9.0 System Error Firewall Event WARNING 636 Wan IP Changed



139 5.9.0 User Activity VPN Client INFO ‐‐‐

XAUTH Succeeded with VPN cli‐

ent



ent



ent

140 5.9.0 User Activity VPN Client ERROR ‐‐‐

XAUTH Failed with VPN client,

Authentication failure









Cannot Contact RADIUS Server







142 5.9.0 Debug Firewall Event ERROR ‐‐‐ Log Debug



143 5.9.0 Attack Firewall Event ERROR 525 Add an attack message



144 5.9.0 Maintenance High Availability ALERT 6201

Primary firewall has transi‐

tioned to Active

144 6.0.5 Maintenance High Availability ALERT ‐‐‐


tioned to Active

14 |



tioned to Active


Secondary firewall has transi‐

tioned to Active

145 6.0.5 Maintenance High Availability ALERT ‐‐‐


tioned to Active



tioned to Active

146 5.9.0 System Error High Availability ALERT 6203


tioned to Standby



tioned to Standby



tioned to Standby



tioned to Standby



tioned to Standby



tioned to Standby

148 5.9.0 System Error High Availability ERROR 615

Primary missed heartbeats

from Secondary



from Secondary



from Secondary


Secondary missed heartbeats

from Primary



from Primary



from Primary


Primary received error signal

from Secondary



from Secondary



from Secondary



Secondary received error signal

from Primary



from Primary



from Primary


Primary firewall preempting

Secondary



Secondary



Secondary

157 5.9.0 Maintenance High Availability INFO ‐‐‐ HA Peer Firewall Synchronized




Error synchronizing HA peer

firewall (%s)



firewall (%s)



firewall (%s)

159 5.9.0 Maintenance Security Services WARNING 526

Received AV Alert: Your Net‐

work Anti‐Virus subscRIPtion

has expired. %s




has expired. %s




has expired. %s

162 5.9.0 Maintenance High Availability INFO ‐‐‐ HA packet processing error



164 5.9.0 System Error Firewall Hardware ERROR 621 Diagnostic Code F



165 5.9.0 Attack

Intrusion Detec‐

tion ALERT 527

Forbidden E‐Mail attachment

disabled

16 |

165 6.0.5 Attack

Intrusion Detec‐

tion ALERT 527


disabled

165 6.2.0 Attack

Intrusion Detec‐

tion ALERT 527


disabled


Disconnecting PPPoE due to

traffic Timeout



traffic Timeout



traffic Timeout


No response from ISP Discon‐

necting PPPoE.



necting PPPoE.



necting PPPoE.


Secondary going Active in pre‐

empt mode after reboot







171 5.9.0 User Activity VPN IKE DEBUG ‐‐‐ %s



173 5.9.0 LAN TCP Network Access NOTICE ‐‐‐

TCP connection from LAN

denied



denied



denied

174 5.9.0

LAN UDP | LAN

TCP Network Access NOTICE ‐‐‐ UDP packet from LAN dropped

174 6.0.5

LAN UDP | LAN


174 6.2.0

LAN UDP | LAN


175 5.9.0

LAN ICMP | LAN

TCP Network Access NOTICE ‐‐‐ ICMP packet from LAN dropped


175 6.0.5

LAN ICMP | LAN


175 6.2.0

LAN ICMP | LAN


177 5.9.0 Attack

Intrusion Detec‐

tion ALERT 528 Probable TCP FIN scan detected

177 6.0.5 Attack

Intrusion Detec‐


177 6.2.0 Attack

Intrusion Detec‐


178 5.9.0 Attack

Intrusion Detec‐

tion ALERT 529

Probable TCP XMAS scan

detected

178 6.0.5 Attack

Intrusion Detec‐

tion ALERT 529


detected

178 6.2.0 Attack

Intrusion Detec‐

tion ALERT 529


detected

179 5.9.0 Attack

Intrusion Detec‐

tion ALERT 530

Probable TCP NULL scan

detected

179 6.0.5 Attack

Intrusion Detec‐

tion ALERT 530


detected

179 6.2.0 Attack

Intrusion Detec‐

tion ALERT 530


detected

180 5.9.0 Attack VPN IPsec ALERT 531 IPsec Replay Detected



181 5.9.0 Debug Network DEBUG ‐‐‐ TCP FIN packet dropped



182 5.9.0 User Activity Network INFO ‐‐‐

Received a path MTU ICMP

message from router/gateway









Appliance not registered.




18 |














The loaded content URL List has

expired.



expired.



expired.


Error setting the IP address of

the Secondary, please manually

set to Secondary LAN IP










Authenticated

Access INFO ‐‐‐ CLI administrator login allowed


Authenticated



Authenticated



Authenticated

Access WARNING ‐‐‐

CLI administrator login denied

due to bad credentials


Authenticated





Authenticated




201 5.9.0 Maintenance L2TP Client INFO ‐‐‐

L2TP Tunnel Negotiation

Started



Started




Started


L2TP Session Negotiation

Started



Started



Started

204 5.9.0 Maintenance L2TP Client INFO ‐‐‐ L2TP Tunnel Established




L2TP Tunnel Disconnect from

Remote



Remote



Remote

206 5.9.0 Maintenance L2TP Client INFO ‐‐‐ L2TP Session Established




L2TP Session Disconnect from

Remote



Remote



Remote

208 5.9.0 Maintenance L2TP Client INFO ‐‐‐ L2TP PPP Negotiation Started



210 5.9.0 Maintenance L2TP Client INFO ‐‐‐ L2TP PPP Session Up



211 5.9.0 Maintenance L2TP Client INFO ‐‐‐ L2TP PPP Down



212 5.9.0 Maintenance L2TP Client INFO ‐‐‐ L2TP PPP Authentication Failed



20 |


Disconnecting L2TP Tunnel due

to traffic Timeout



to traffic Timeout



to traffic Timeout

217 5.9.0 Maintenance L2TP Client INFO ‐‐‐ L2TP PPP link down



222 5.9.0 Maintenance DHCP Relay INFO ‐‐‐

DHCP RELEASE relayed to Cen‐

tral Gateway



tral Gateway



tral Gateway


DHCP lease relayed to local

device



device



device

224 5.9.0 Debug DHCP Relay INFO ‐‐‐

DHCP RELEASE received from

remote device



remote device



remote device


DHCP lease relayed to remote

device



device



device


DHCP lease to LAN device con‐

flicts with remote device, delet‐

ing remote IP entry




ing remote IP entry





ing remote IP entry


WARNING: DHCP lease relayed

from Central Gateway conflicts

with IP in Static Devices list









228 5.9.0 Maintenance DHCP Relay WARNING ‐‐‐

DHCP lease dropped. Lease


with Relay IP




with Relay IP




with Relay IP

229 5.9.0 Attack DHCP Relay ERROR 533

IP spoof detected on packet to

Central Gateway, packet

dropped




dropped




dropped


Request for Relay IP Table from

Central Gateway



Central Gateway



Central Gateway


Requesting Relay IP Table from

Remote Gateway



Remote Gateway

22 |



Remote Gateway


Sent Relay IP Table to Central

Gateway



Gateway



Gateway


Obtained Relay IP Table from

Remote Gateway



Remote Gateway



Remote Gateway

234 5.9.0 System Error DHCP Relay WARNING 632

Failed to synchronize Relay IP

Table



Table



Table


Authenticated


VPN zone administrator login

allowed


Authenticated



allowed


Authenticated



allowed


Authenticated


WAN zone administrator login

allowed


Authenticated



allowed


Authenticated



allowed


Authenticated


VPN zone remote user login

allowed


Authenticated



allowed


Authenticated



allowed



Authenticated


WAN zone remote user login

allowed


Authenticated



allowed


Authenticated



allowed


NAT Discovery : Peer IPsec

Security Gateway behind a

NAT/NAPT Device




NAT/NAPT Device




NAT/NAPT Device


NAT Discovery : Local IPsec


NAT/NAPT Device




NAT/NAPT Device




NAT/NAPT Device


NAT Discovery : No NAT/NAPT

device detected between IPsec

Security gateways




Security gateways




Security gateways



Security Gateway doesn't sup‐

port VPN NAT Traversal





24 |





243 5.9.0 User Activity RADIUS INFO ‐‐‐

User login denied ‐ RADIUS

authentication failure







244 5.9.0 User Activity RADIUS WARNING ‐‐‐


server Timeout



server Timeout



server Timeout


User login denied ‐ RADIUS con‐

figuration error



figuration error



figuration error


Authenticated


User login denied ‐ User has no

privileges for login from that

location


Authenticated




location


Authenticated




location

247 5.9.0 Maintenance VPN IPsec INFO ‐‐‐ IPsec packet from an illegal host



248 5.9.0 Attack

Intrusion Detec‐

tion ERROR 534


deleted

248 6.0.5 Attack

Intrusion Detec‐

tion ERROR 534


deleted

248 6.2.0 Attack

Intrusion Detec‐

tion ERROR 534


deleted



IKE Responder: Mode %s ‐ not

tunnel mode


IKE Responder: Mode %d ‐ not

tunnel mode


IKE Responder: Mode %s ‐ not

tunnel mode


IKE Responder: No matching

Phase 1 ID found for proposed

remote network




remote network




remote network


IKE Responder: Proposed

remote network is 0.0.0.0 but

not DHCP relay nor default

route





route





route


IKE Responder: No match for

proposed remote network

address




address




address


IKE Responder: Default LAN

gateway is set but peer is not

proposing to use this SA as a

default route

26 |





default route





default route


IKE Responder: Tunnel termi‐

nates outside firewall but pro‐

posed local network is not NAT

public address





public address





public address



nates inside firewall but pro‐

posed local network is not

inside firewall





inside firewall





inside firewall



nates on DMZ but proposed

local network is on LAN












nates on LAN but proposed

local network is on DMZ










IKE Responder: AH Perfect For‐

ward Secrecy mismatch








IKE Responder: ESP Perfect For‐









IKE Responder: Algorithms and/

or keys do not match








Authenticated

Access INFO ‐‐‐ Administrator logged out


Authenticated



Authenticated



Authenticated


Administrator logged out ‐ inac‐

tivity timer expired


Authenticated





Authenticated




28 |


Authenticated

Access INFO ‐‐‐ User logged out ‐ %s


Authenticated

Access INFO ‐‐‐ User logged out


Authenticated

Access INFO ‐‐‐ User logged out ‐ %s


Authenticated


User logged out ‐ max session

time exceeded


Authenticated



time exceeded


Authenticated



time exceeded


Authenticated


User logged out ‐ inactivity

timer expired


Authenticated



timer expired


Authenticated



timer expired

266 5.9.0 Maintenance VPN IPsec INFO ‐‐‐

NAT device may not support

IPsec AH pass‐through







267 5.9.0 Attack

Intrusion Detec‐

tion ALERT 547 TCP Xmas Tree dropped

267 6.0.5 Attack

Intrusion Detec‐


267 6.2.0 Attack

Intrusion Detec‐


269 5.9.0 User Activity VPN PKI INFO ‐‐‐ Requesting CRL from



270 5.9.0 User Activity VPN PKI INFO ‐‐‐ CRL loaded from



271 5.9.0 User Activity VPN PKI ALERT ‐‐‐ Failed to get CRL from




272 5.9.0 User Activity VPN PKI WARNING ‐‐‐

Not enough memory to hold

the CRL



the CRL



the CRL

273 5.9.0 User Activity VPN PKI ALERT ‐‐‐ Connection timed out



274 5.9.0 User Activity VPN PKI ALERT ‐‐‐

Cannot connect to the CRL

server



server



server

275 5.9.0 User Activity VPN PKI ERROR ‐‐‐ Unknown reason



276 5.9.0 User Activity VPN PKI ALERT ‐‐‐ Failed to Process CRL from



277 5.9.0 User Activity VPN PKI ALERT ‐‐‐ Bad CRL format



278 5.9.0 User Activity VPN PKI ALERT ‐‐‐ Issuer match failed



279 5.9.0 User Activity VPN PKI ALERT ‐‐‐ Certificate on Revoked list(CRL)



280 5.9.0 User Activity VPN PKI ALERT ‐‐‐ No Certificate for



281 5.9.0 User Activity PPP Dial‐Up INFO ‐‐‐ PPP Dial‐Up: Dialing: %s



30 |

282 5.9.0 User Activity PPP Dial‐Up INFO ‐‐‐

PPP Dial‐Up: No dial tone

detected ‐ check phone‐line

connection




connection




connection


PPP Dial‐Up: No link carrier

detected ‐ check phone number








PPP Dial‐Up: Dialed number is

busy



busy



busy


PPP Dial‐Up: Dialed number did

not answer



not answer



not answer


PPP Dial‐Up: Connected at %s

bps ‐ starting PPP








PPP Dial‐Up: Unknown dialing

failure



failure



failure

288 5.9.0 User Activity PPP Dial‐Up INFO ‐‐‐ PPP Dial‐Up: Link carrier lost




289 5.9.0 ‐‐‐ PPP INFO ‐‐‐ PPP: Authentication successful



290 5.9.0 ‐‐‐ PPP INFO ‐‐‐

PPP: PAP Authentication failed ‐

check username / password

290 6.0.5 ‐‐‐ PPP INFO ‐‐‐



290 6.2.0 ‐‐‐ PPP INFO ‐‐‐



291 5.9.0 ‐‐‐ PPP INFO ‐‐‐

PPP: CHAP authentication failed

‐ check username / password

291 6.0.5 ‐‐‐ PPP INFO ‐‐‐



291 6.2.0 ‐‐‐ PPP INFO ‐‐‐



292 5.9.0 ‐‐‐ PPP INFO ‐‐‐

PPP: MS‐CHAP authentication

failed ‐ check username / pass‐

word

292 6.0.5 ‐‐‐ PPP INFO ‐‐‐



word

292 6.2.0 ‐‐‐ PPP INFO ‐‐‐



word

293 5.9.0 ‐‐‐ PPP INFO ‐‐‐

PPP: Starting MS‐CHAP authen‐

tication

293 6.0.5 ‐‐‐ PPP INFO ‐‐‐


tication

293 6.2.0 ‐‐‐ PPP INFO ‐‐‐


tication

294 5.9.0 ‐‐‐ PPP INFO ‐‐‐

PPP: Starting CHAP authentica‐

tion

294 6.0.5 ‐‐‐ PPP INFO ‐‐‐


tion

294 6.2.0 ‐‐‐ PPP INFO ‐‐‐


tion

32 |

295 5.9.0 ‐‐‐ PPP INFO ‐‐‐

PPP: Starting PAP authentica‐

tion

295 6.0.5 ‐‐‐ PPP INFO ‐‐‐


tion

295 6.2.0 ‐‐‐ PPP INFO ‐‐‐


tion


PPP Dial‐Up: Idle time limit

exceeded ‐ disconnecting








PPP Dial‐Up: Received new IP

address



address



address


PPP Dial‐Up: PPP link estab‐

lished



lished



lished

301 5.9.0 User Activity PPP Dial‐Up INFO ‐‐‐ PPP Dial‐Up: PPP link down



302 5.9.0 User Activity PPP Dial‐Up INFO ‐‐‐ PPP Dial‐Up: Shutting down link



303 5.9.0 User Activity PPP Dial‐Up INFO ‐‐‐ PPP Dial‐Up: Initialization : %s




PPP Dial‐Up: Connect request

canceled



canceled



canceled


307 5.9.0 System Error WAN Failover WARNING 639

The network connection in use

is %s



is %s



is %s

308 5.9.0 Maintenance L2TP Server INFO ‐‐‐

L2TP Server : L2TP Tunnel

Established.



Established.



Established.


L2TP Server : L2TP Session

Established.



Established.



Established.


L2TP Server: RADIUS/LDAP

reports Authentication Failure








L2TP Server: Local Authentica‐

tion Failure



tion Failure



tion Failure



tion Success.



tion Success.



tion Success.



Authentication Success

34 |








PPP Dial‐Up: Manual interven‐

tion needed. Check Primary

Profile or Profile details










PPP Dial‐Up: Trying to failover

but Primary Profile is manual







326 5.9.0 System Error WAN Failover ALERT 637 Probing failure on %s




PPP Dial‐Up: Maximum connec‐

tion time exceeded ‐ discon‐

necting




necting




necting

328 5.9.0 Maintenance

Authenticated

Access INFO ‐‐‐ Administrator name changed


Authenticated



Authenticated


329 5.9.0 Attack

Authenticated

Access ERROR 561

User login failure rate exceeded

‐ logins from user IP address

denied


329 6.0.5 Attack

Authenticated

Access ERROR 561



denied

329 6.2.0 Attack

Authenticated

Access ERROR 561



denied

330 5.9.0 Maintenance PPP Dial‐Up INFO ‐‐‐

PPP Dial‐Up: The profile in use

disabled VPN networking.








PPP Dial‐Up: VPN networking

restored.



restored.



restored.


L2TP Server: Tunnel Disconnect

from Remote.



from Remote.



from Remote.


L2TP Server : Deleting the Tun‐

nel



nel



nel


L2TP Server : Deleting the L2TP

active Session



active Session



active Session


L2TP Server : Retransmission

Timeout, Deleting the Tunnel




36 |





NAT translated packet exceeds

size limit, packet dropped







340 5.9.0 Maintenance Firewall Event INFO ‐‐‐

HTTP management port has

changed



changed



changed


HTTPS management port has

changed



changed



changed


L2TP Server : User Name

authentication Failure locally.








IKE Initiator: Start Quick Mode

(Phase 2).



(Phase 2).



(Phase 2).

347 5.9.0

TCP | UDP |

ICMP Network Access WARNING ‐‐‐

Port configured to receive IPsec

protocol ONLY; drop packet

received in the clear

347 6.0.5

TCP | UDP |






347 6.2.0

TCP | UDP |





348 5.9.0 Maintenance Firewall Event WARNING ‐‐‐

Imported VPN SA is invalid ‐ dis‐

abled



abled



abled

350 5.9.0 User Activity VPN IKE INFO ‐‐‐ IKE SA lifetime expired.




IKE Initiator: Start Main Mode

negotiation (Phase 1)








IKE Responder: Received Quick

Mode Request (Phase 2)








IKE Initiator: Main Mode com‐

plete (Phase 1)



plete (Phase 1)



plete (Phase 1)


IKE Initiator: Aggressive Mode

complete (Phase 1).



complete (Phase 1).



complete (Phase 1).


IKE Responder: Received Main


38 |








IKE Responder: Received

Aggressive Mode Request

(Phase 1)




(Phase 1)




(Phase 1)


IKE Responder: Main Mode

complete (Phase 1)



complete (Phase 1)



complete (Phase 1)


IKE Initiator: Start Aggressive

Mode negotiation (Phase 1)







360 5.9.0 Maintenance Crypto Test ERROR ‐‐‐ Crypto DES test failed



361 5.9.0 Maintenance Crypto Test ERROR ‐‐‐ Crypto DH test failed



362 5.9.0 Maintenance Crypto Test ERROR ‐‐‐ Crypto Hmac‐MD5 test failed



363 5.9.0 Maintenance Crypto Test ERROR ‐‐‐ Crypto Hmac‐Sha1 test failed



364 5.9.0 Maintenance Crypto Test ERROR ‐‐‐ Crypto RSA test failed




365 5.9.0 Maintenance Crypto Test ERROR ‐‐‐ Crypto Sha1 test failed



366 5.9.0 Maintenance Crypto Test ERROR ‐‐‐ Crypto hardware DES test failed



367 5.9.0 Maintenance Crypto Test ERROR ‐‐‐

Crypto hardware 3DES test

failed



failed



failed


Crypto hardware DES with SHA

test failed



test failed



test failed


Crypto Hardware 3DES with

SHA test failed



SHA test failed



SHA test failed

371 5.9.0 User Activity VPN Client INFO ‐‐‐ VPN Client Policy Provisioning




IKE Initiator: Accepting IPsec

proposal (Phase 2)



proposal (Phase 2)



proposal (Phase 2)


IKE Responder: Aggressive

Mode complete (Phase 1)




40 |




375 5.9.0 Maintenance PPTP INFO ‐‐‐

PPTP Control Connection Nego‐

tiation Started



tiation Started



tiation Started


PPTP Session Negotiation

Started



Started



Started


PPTP Control Connection Estab‐

lished



lished



lished


PPTP Tunnel Disconnect from

Remote



Remote



Remote

380 5.9.0 Maintenance PPTP INFO ‐‐‐ PPTP Session Established




PPTP Session Disconnect from

Remote



Remote



Remote

382 5.9.0 Maintenance PPTP INFO ‐‐‐ PPTP PPP Negotiation Started



384 5.9.0 Maintenance PPTP INFO ‐‐‐ PPTP PPP Session Up




385 5.9.0 Maintenance PPTP INFO ‐‐‐ PPTP PPP Down




PPTP Disconnect Initiated by

the User



the User



the User


Disconnecting PPTP Tunnel due

to traffic Timeout



to traffic Timeout



to traffic Timeout


PPTP Connect Initiated by the

User



User



User


PPTP starting CHAP Authentica‐

tion



tion



tion


PPTP starting PAP Authentica‐

tion



tion



tion


PPTP PAP Authentication suc‐

cess.



cess.

42 |



cess.

398 5.9.0 Maintenance PPTP INFO ‐‐‐ PPTP PPP Link Up



399 5.9.0 Maintenance PPTP INFO ‐‐‐ PPTP PPP Link down



400 5.9.0 Maintenance PPTP INFO ‐‐‐ PPTP PPP Link Finished



401 5.9.0 User Activity VPN IKE WARNING ‐‐‐

Received notify.

NO_PROPOSAL_CHOSEN


Received notify.

NO_PROPOSAL_CHOSEN


Received notify.

NO_PROPOSAL_CHOSEN


IKE Responder: IKE proposal









IKE negotiation aborted due to

Timeout



Timeout



Timeout


Failed payload verification after

decryption; possible preshared

key mismatch




key mismatch




key mismatch

405 5.9.0 User Activity VPN IKE WARNING ‐‐‐ Failed payload validation





Received packet retransmis‐

sion. Drop duplicate packet







408 5.9.0 Maintenance Security Services INFO ‐‐‐ Anti‐Virus Licenses Exceeded




Received notify:

ISAKMP_AUTH_FAILED


Received notify:

ISAKMP_AUTH_FAILED


Received notify:

ISAKMP_AUTH_FAILED


Computed hash does not match

hash received from peer; pre‐

shared key mismatch




shared key mismatch




shared key mismatch


Received notify:

PAYLOAD_MALFORMED


Received notify:

PAYLOAD_MALFORMED


Received notify:

PAYLOAD_MALFORMED


Received IPsec SA delete

request



request



request

413 5.9.0 User Activity VPN IKE INFO ‐‐‐ Received IKE SA delete request

44 |




Received notify:

INVALID_COOKIES


Received notify:

INVALID_COOKIES


Received notify:

INVALID_COOKIES


Received notify:

RESPONDER_LIFETIME


Received notify:

RESPONDER_LIFETIME


Received notify:

RESPONDER_LIFETIME

416 5.9.0 User Activity VPN IKE INFO ‐‐‐ Received notify: INVALID_SPI



419 5.9.0 Maintenance RIP INFO 8401 RIP disabled on interface %s



420 5.9.0 Maintenance RIP INFO 8402 RIPv1 enabled on interface %s






422 5.9.0 Maintenance RIP INFO 8404

RIPv2 compatibility (broadcast)

mode enabled on interface %s







423 5.9.0 Maintenance RIP INFO 8405 RIP disabled on DMZ interface



424 5.9.0 Maintenance RIP INFO 8406 RIPv1 enabled on DMZ interface









mode enabled on DMZ inter‐

face




face




face

427 5.9.0

VPN Tunnel Sta‐

tus VPN INFO 801 IPsec Tunnel status changed

427 6.0.5

VPN Tunnel Sta‐


427 6.2.0

VPN Tunnel Sta‐


428 5.9.0 Debug

Intrusion Detec‐

tion WARNING ‐‐‐

Source routed IP packet

dropped

428 6.0.5 Debug

Intrusion Detec‐



dropped

428 6.2.0 Debug

Intrusion Detec‐



dropped


No response from server to

Echo Requests, disconnecting

PPTP Tunnel




PPTP Tunnel




PPTP Tunnel


No response from PPTP server

to control connection requests







46 |



to call requests



to call requests



to call requests


PPTP server rejected control

connection



connection



connection


PPTP server rejected the call

request



request



request

434 5.9.0 User Activity WAN Failover INFO ‐‐‐


but Alternate Profile is manual







435 5.9.0 System Error WAN Failover ALERT 652 WLB Failback initiated by %s



436 5.9.0 System Error WAN Failover ALERT 638 Probing succeeded on %s



437 5.9.0 Attack

Intrusion Detec‐

tion ERROR 550 E‐Mail fragment dropped

437 6.0.5 Attack

Intrusion Detec‐


437 6.2.0 Attack

Intrusion Detec‐



Authenticated


Locked‐out user logins allowed ‐

lockout period expired



Authenticated





Authenticated





Authenticated


Locked‐out user logins allowed

by %s


Authenticated



by administrator


Authenticated



by %s

440 5.9.0 User Activity Firewall Rule INFO ‐‐‐ Access rule added



441 5.9.0 User Activity Firewall Rule INFO ‐‐‐ Access rule modified



442 5.9.0 User Activity Firewall Rule INFO ‐‐‐ Access rule deleted



443 5.9.0 User Activity Firewall Rule INFO ‐‐‐

Access rules restored to

defaults



defaults



defaults


PPTP Server is not responding,

check if the server is UP and

running.




running.




running.


IKE Initiator: Accepting peer

lifetime. (Phase 1)



lifetime. (Phase 1)

48 |



lifetime. (Phase 1)

446 5.9.0 Attack

Intrusion Detec‐

tion ERROR 551

FTP: PASV response spoof

attack dropped

446 6.0.5 Attack

Intrusion Detec‐

tion ERROR 551


attack dropped

446 6.2.0 Attack

Intrusion Detec‐

tion ERROR 551


attack dropped

448 5.9.0 Maintenance VPN PKI ERROR ‐‐‐

PKI Failure: Output buffer too

small



small



small


PKI Failure: Cannot alloc mem‐

ory



ory



ory


PKI Failure: Reached the limit

for local certs, cant load any

more




more




more

451 5.9.0 Maintenance VPN PKI ERROR ‐‐‐ PKI Failure: Import failed




PKI Failure: Incorrect admin

password



password



password



PKI Failure: CA certificates store

exceeded. Cannot verify this

Local Certificate




Local Certificate




Local Certificate


PKI Failure: Improper file for‐

mat. Please select PKCS#12

(*.p12) file




(*.p12) file




(*.p12) file


PKI Failure: Certificate's ID does

not match this Network Secu‐

rity Appliance




rity Appliance




rity Appliance


PKI Failure: public‐private key

mismatch



mismatch



mismatch


PKI Failure: Duplicate local cer‐

tificate name



tificate name



tificate name

50 |



tificate



tificate



tificate


PKI Failure: No CA certificates

yet loaded



yet loaded



yet loaded

460 5.9.0 Maintenance VPN PKI ERROR ‐‐‐ PKI Failure: Internal error




PKI Failure: Temporary mem‐

ory shortage, try again








PKI Failure: The certificate chain

is circular



is circular



is circular



is incomplete



is incomplete



is incomplete



has no root



has no root



has no root



PKI Failure: The certificate or a

certificate in the chain has

expired




expired




expired



certificate in the chain has a

validity period in the future











certificate in the chain is cor‐

rupt




rupt




rupt




bad signature




bad signature




bad signature


PKI Failure: Loaded but could

not verify certificate




52 |





PKI Failure: Loaded the certifi‐

cate but could not verify its

chain




chain




chain


DHCP REQUEST received from

remote device



remote device



remote device


DHCP DISCOVER received from

remote device



remote device



remote device


DHCP OFFER received from

server



server



server


DHCP NACK received from

server



server



server


PPP Dial‐Up: No peer IP address

from Dial‐Up ISP, local and

remote IPs will be the same













will expire in 7 days. %s









483 5.9.0 User Activity VPN IPsec WARNING ‐‐‐

Received notify:

INVALID_ID_INFO


Received notify:

INVALID_ID_INFO


Received notify:

INVALID_ID_INFO




with Remote Management IP










Authenticated



privileges for guest service


Authenticated





Authenticated




488 5.9.0

TCP | UDP |

ICMP Network Access WARNING ‐‐‐ Packet dropped by guest check

488 6.0.5

TCP | UDP |


54 |

488 6.2.0

TCP | UDP |



Received CFS Alert: Your Con‐

tent Filtering subscRIPtion will

expire in 7 days.




expire in 7 days.




expire in 7 days.



tent Filtering subscRIPtion has

expired.




expired.




expired.


Received E‐Mail Filter Alert:

Your E‐Mail Filtering subscRIP‐

tion will expire in 7 days.












tion has expired.




tion has expired.




tion has expired.


ISDN Driver Firmware success‐

fully updated




fully updated



fully updated

494 5.9.0 System Error VPN Client INFO 658

Global VPN Client License

Exceeded: Connection denied.







496 5.9.0 Maintenance Security Services WARNING ‐‐‐

Registration Update Needed,

Please restore your existing

security service subscRIPtions.









502 5.9.0 Maintenance Firewall Event INFO ‐‐‐ WAN not ready



505 5.9.0 System Error VPN Client ERROR 660

Blocked Quick Mode for Client

using Default KeyId



using Default KeyId



using Default KeyId


Authenticated

Access INFO ‐‐‐ VPN disabled by administrator


Authenticated



Authenticated



Authenticated

Access INFO ‐‐‐ VPN enabled by administrator


Authenticated


56 |


Authenticated



Authenticated


WLAN disabled by administra‐

tor


Authenticated



tor


Authenticated



tor


Authenticated

Access INFO ‐‐‐ WLAN enabled by administrator


Authenticated



Authenticated


518 5.9.0

802.11b Man‐

agement Wireless INFO ‐‐‐ 802.11 Management

518 6.0.5

802.11b Man‐


518 6.2.0

802.11b Man‐



Authenticated

Access INFO ‐‐‐ CLI administrator logged out


Authenticated



Authenticated



Network Security Appliance ini‐

tializing



tializing



tializing

522 5.9.0 Debug Network Access ALERT 554

Malformed or unhandled IP

packet dropped



packet dropped



packet dropped

523 5.9.0 ICMP Network Access NOTICE ‐‐‐ ICMP packet dropped no match




524 5.9.0 TCP Network Access NOTICE ‐‐‐ Web access Request dropped



526 5.9.0 User Activity Network Access NOTICE ‐‐‐

Web management request

allowed



allowed



allowed

527 5.9.0 Attack

Intrusion Detec‐

tion ALERT 555

FTP: PORT bounce attack

dropped.

527 6.0.5 Attack

Intrusion Detec‐

tion ALERT 555


dropped.

527 6.2.0 Attack

Intrusion Detec‐

tion ALERT 555


dropped.

528 5.9.0 Attack

Intrusion Detec‐

tion ALERT 556

FTP: PASV response bounce

attack dropped.

528 6.0.5 Attack

Intrusion Detec‐

tion ALERT 556


attack dropped.

528 6.2.0 Attack

Intrusion Detec‐

tion ALERT 556


attack dropped.


Global VPN Client connection is

not allowed. Appliance is not

registered.




registered.




registered.

533 5.9.0

TCP | UDP |

ICMP VPN IPsec NOTICE ‐‐‐ IPsec (ESP) packet dropped

533 6.0.5

TCP | UDP |


533 6.2.0

TCP | UDP |


58 |

534 5.9.0

TCP | UDP |

ICMP VPN IPsec NOTICE ‐‐‐ IPsec (AH) packet dropped

534 6.0.5

TCP | UDP |


534 6.2.0

TCP | UDP |


535 5.9.0 Debug VPN IPsec DEBUG ‐‐‐

IPsec (ESP) packet dropped;

waiting for pending IPsec con‐

nection




nection




nection

537 5.9.0

Connection

Traffic Network Traffic INFO ‐‐‐ Connection Closed

537 6.0.5

Connection


537 6.2.0

Connection


538 5.9.0 Attack Network Access ALERT 557

FTP: Data connection from non

default port dropped








PPP Dial‐Up: Previous session

was connected for %s








IKE Initiator: Using secondary

gateway to negotiate









IKE Initiator drop: VPN tunnel

end point does not match con‐

figured VPN Policy Bound to

scope





scope





scope


IKE Responder drop: VPN tun‐

nel end point does not match

configured VPN Policy Bound to

scope





scope





scope

546 5.9.0 WLAN IDS WLAN IDS ALERT 901 Found Rogue Access Point



548 5.9.0 WLAN IDS WLAN IDS ALERT 903

Association Flood from WLAN

station



station



station


Authenticated


User login failed ‐ Guest service

limit reached


Authenticated



limit reached


Authenticated



limit reached

60 |


Authenticated

Access INFO ‐‐‐ Guest Session Timeout


Authenticated



Authenticated



Authenticated

Access INFO ‐‐‐ Guest Account Timeout


Authenticated



Authenticated



Authenticated


Guest login denied. Guest '%s' is

already logged in. Please try

again later.


Authenticated




again later.


Authenticated




again later.


Authenticated

Access INFO ‐‐‐ Guest account '%s' created


Authenticated



Authenticated



Authenticated

Access INFO ‐‐‐ Guest account '%s' deleted


Authenticated



Authenticated



Authenticated

Access INFO ‐‐‐ Guest account '%s' disabled


Authenticated



Authenticated




Authenticated

Access INFO ‐‐‐ Guest account '%s' re‐enabled


Authenticated



Authenticated



Authenticated

Access INFO ‐‐‐ Guest account '%s' pruned


Authenticated



Authenticated



Authenticated


Guest account '%s' re‐gener‐

ated


Authenticated



ated


Authenticated



ated


Authenticated

Access INFO ‐‐‐ Guest Idle Timeout


Authenticated



Authenticated


565 5.9.0 System Error Firewall Event ALERT 646 Interface %s Link Is Up



566 5.9.0 System Error Firewall Event ALERT 647 Interface %s Link Is Down




Interface IP Assignment

changed: Shutting down %s








Interface IP Assignment : Bind‐

ing and initializing %s

62 |








Network for interface %s over‐

laps with another interface.








Please connect interface %s to

another network to function

properly




properly




properly

573 5.9.0 System Error Firewall Event WARNING 649

The preferences file is too large

to be saved in available flash

memory




memory




memory


All preference values have been

set to factory default values







575 5.9.0

System Envi‐

ronment Firewall Hardware ERROR 101 Voltages Out of Tolerance

575 6.0.5

System Envi‐


575 6.2.0

System Envi‐



576 5.9.0

System Envi‐

ronment Firewall Hardware ALERT 102 Fan Failure

576 6.0.5

System Envi‐


576 6.2.0

System Envi‐


577 5.9.0

System Envi‐

ronment Firewall Hardware ALERT 103 Thermal Yellow

577 6.0.5

System Envi‐


577 6.2.0

System Envi‐


578 5.9.0

System Envi‐

ronment Firewall Hardware ALERT 104 Thermal Red

578 6.0.5

System Envi‐


578 6.2.0

System Envi‐


579 5.9.0

System Envi‐

ronment Firewall Hardware ALERT 105 Thermal Red Timer Exceeded

579 6.0.5

System Envi‐


579 6.2.0

System Envi‐


580 5.9.0 Attack Network Access ALERT 558 TCP SYN/FIN packet dropped



581 5.9.0 Maintenance WAN Failover WARNING ‐‐‐

WLB Spill‐over started, config‐

ured threshold exceeded







582 5.9.0 Maintenance WAN Failover WARNING ‐‐‐ WLB Spill‐over stopped



583 5.9.0 Attack

Authenticated

Access ERROR 559 User login disabled from %s

64 |

583 6.0.5 Attack

Authenticated


583 6.2.0 Attack

Authenticated


584 5.9.0 System Error WAN Failover ALERT 651 WLB Failover in progress



585 5.9.0 System Error WAN Failover ALERT 653 WLB Resource is now available



586 5.9.0 System Error WAN Failover ALERT 654 WLB Resource failed



587 5.9.0 User Activity VPN IKE WARNING ‐‐‐ Header verification failed




Received DHCP offer packet has

errors



errors



errors


Received response packet for

DHCP request has errors







590 5.9.0

LAN UDP | LAN

TCP Network Access NOTICE ‐‐‐ IP type %s packet dropped

590 6.0.5

LAN UDP | LAN


590 6.2.0

LAN UDP | LAN


591 5.9.0 Attack PPP Dial‐Up ERROR 566

Maximum sequential failed dial

attempts (10) to a single dial‐up

number: %s





number: %s




number: %s


Regulatory requirements pro‐

hibit %s from being re‐dialed

for 30 minutes




for 30 minutes




for 30 minutes


Received PPPoE Active Discov‐

ery Offer



ery Offer



ery Offer



ery Session_confirmation








Sending PPPoE Active Discov‐

ery Request



ery Request



ery Request

596 5.9.0 Debug PPTP DEBUG ‐‐‐ PPTP decode failure



597 5.9.0 Debug Network Access INFO ‐‐‐ ICMP packet allowed



66 |

598 5.9.0 Debug Network Access INFO ‐‐‐ ICMP packet from LAN allowed



599 5.9.0 System Error Firewall Hardware ERROR 655 Diagnostic Code G



600 5.9.0 System Error Firewall Hardware ERROR 656 Diagnostic Code H



601 5.9.0 System Error Firewall Hardware ERROR 657 Diagnostic Code I



602 5.9.0 Debug Network Access INFO ‐‐‐ DNS packet allowed



603 5.9.0 System Error L2TP Server ERROR 661

Adding L2TP IP pool Address

object Failed.



object Failed.



object Failed.


Received unencrypted packet in

crypto active state



crypto active state



crypto active state

606 5.9.0 Attack

Intrusion Detec‐

tion ALERT 568

Spank attack multicast packet

dropped

606 6.0.5 Attack

Intrusion Detec‐

tion ALERT 568


dropped

606 6.2.0 Attack

Intrusion Detec‐

tion ALERT 568


dropped

607 5.9.0 Debug | UDP VPN IKE INFO ‐‐‐

Received ISAKMP packet des‐

tined to port %s



tined to port %s




tined to port %s

608 5.9.0 Attack

Intrusion Detec‐

tion ALERT 569 IPS Detection Alert: %s

608 6.0.5 Attack

Intrusion Detec‐


608 6.2.0 Attack

Intrusion Detec‐


609 5.9.0 Attack

Intrusion Detec‐

tion ALERT 570 IPS Prevention Alert: %s

609 6.0.5 Attack

Intrusion Detec‐


609 6.2.0 Attack

Intrusion Detec‐


610 5.9.0 Maintenance Crypto Test ERROR ‐‐‐ Crypto Hardware AES test failed




Received IPS Alert: Your Intru‐

sion Prevention (IDP) subscRIP‐

tion has expired.




tion has expired.




tion has expired.

615 5.9.0 WLAN IDS WLAN IDS WARNING 904 WLAN client null probing



616 5.9.0 Debug VPN IKE ERROR ‐‐‐ Payload processing failed



617 5.9.0 Maintenance Wireless INFO ‐‐‐

WLAN not in AP mode, DHCP

server will not provide lease to

clients on WLAN




clients on WLAN

68 |




clients on WLAN

618 5.9.0 Debug Bootp DEBUG ‐‐‐

BOOTP server response relayed

to remote device



to remote device



to remote device

619 5.9.0 Maintenance Bootp INFO ‐‐‐

BOOTP Client IP address on LAN

conflicts with remote device IP,

deleting IP address from

remote table





remote table





remote table


BOOTP reply relayed to local

device



device



device

622 5.9.0 VoIP VoIP INFO ‐‐‐ VoIP Call Connected



623 5.9.0 VoIP VoIP INFO ‐‐‐ VoIP Call Disconnected



624 5.9.0 VoIP VoIP DEBUG ‐‐‐ H.323/RAS Admission Reject



625 5.9.0 VoIP VoIP DEBUG ‐‐‐ H.323/RAS Admission Confirm




626 5.9.0 VoIP VoIP DEBUG ‐‐‐ H.323/RAS Admission Request



627 5.9.0 VoIP VoIP DEBUG ‐‐‐ H.323/RAS Bandwidth Reject



628 5.9.0 VoIP VoIP DEBUG ‐‐‐ H.323/RAS Disengage Confirm



629 5.9.0 VoIP VoIP DEBUG ‐‐‐ H.323/RAS Gatekeeper Reject



630 5.9.0 VoIP VoIP DEBUG ‐‐‐ H.323/RAS Location Confirm



631 5.9.0 VoIP VoIP DEBUG ‐‐‐ H.323/RAS Location Reject



632 5.9.0 VoIP VoIP DEBUG ‐‐‐ H.323/RAS Registration Reject



633 5.9.0 VoIP VoIP DEBUG ‐‐‐ H.323/H.225 Setup



634 5.9.0 VoIP VoIP DEBUG ‐‐‐ H.323/H.225 Connect



635 5.9.0 VoIP VoIP DEBUG ‐‐‐ H.323/H.245 Address



636 5.9.0 VoIP VoIP DEBUG ‐‐‐ H.323/H.245 End Session



637 5.9.0 VoIP VoIP DEBUG ‐‐‐ VoIP %s Endpoint added



638 5.9.0 VoIP VoIP DEBUG ‐‐‐ VoIP %s Endpoint removed

70 |



639 5.9.0 VoIP VoIP WARNING ‐‐‐

VoIP %s Endpoint not added ‐

configured 'public' endpoint

limit reached




limit reached




limit reached

640 5.9.0 VoIP VoIP DEBUG ‐‐‐

H.323/RAS Unknown Message

Response



Response



Response

641 5.9.0 VoIP VoIP DEBUG ‐‐‐ H.323/RAS Disengage Reject




H.323/RAS Unregistration

Reject



Reject



Reject

643 5.9.0 VoIP VoIP DEBUG ‐‐‐ SIP Request



644 5.9.0 VoIP VoIP DEBUG ‐‐‐ SIP Response




SIP Register expiration exceeds

configured Signaling inactivity

time out




time out





time out

646 5.9.0 System Error Firewall Event ALERT 5238

Packet dropped; connection

limit for this source IP address

has been reached




has been reached




has been reached



limit for this destination IP

address has been reached










Packet destination not in VPN

Access list



Access list



Access list

651 5.9.0 Debug IPComp DEBUG ‐‐‐ IPComp connection interrupt



652 5.9.0

TCP | UDP |

ICMP IPComp NOTICE ‐‐‐ IPComp packet dropped

652 6.0.5

TCP | UDP |


652 6.2.0

TCP | UDP |


653 5.9.0 Debug IPComp DEBUG ‐‐‐

IPComp packet dropped; wait‐

ing for pending IPComp connec‐

tion

72 |




tion




tion

654 5.9.0 System Error Firewall Logging CRITICAL ‐‐‐

Maximum events per second

threshold exceeded



threshold exceeded



threshold exceeded


Maximum syslog data per sec‐

ond threshold exceeded







656 5.9.0 System Error Firewall Logging WARNING ‐‐‐

SMTP POP‐Before‐SMTP

authentication failed







657 5.9.0 Maintenance Network INFO ‐‐‐

Syslog Server cannot be

reached



reached



reached

658 5.9.0 System Error VPN IKE WARNING ‐‐‐

IKE Responder: Proposed IKE ID

mismatch



mismatch



mismatch

659 5.9.0 System Error VPN Client ERROR ‐‐‐

IKE Responder: IP Address

already exists in the DHCP relay

table. Client traffic not allowed.











IKE Responder: %s Policy does

not allow static IP for Virtual

Adapter.




Adapter.




Adapter.

661 5.9.0 User Activity VPN IKE ERROR ‐‐‐

Received notify:

INVALID_PAYLOAD


Received notify:

INVALID_PAYLOAD


Received notify:

INVALID_PAYLOAD

662 5.9.0 Attack

Intrusion Detec‐

tion ERROR 6434

Drop WLAN traffic from non‐

SonicPoint devices

662 6.0.5 Attack

Intrusion Detec‐

tion ERROR 6434


SonicPoint devices

662 6.2.0 Attack

Intrusion Detec‐

tion ERROR 6434


SonicPoint devices

665 5.9.0 0 PPP Dial‐Up INFO ‐‐‐

PPP Dial‐Up: Dialing not

allowed by schedule. %s








PPP Dial‐Up: Connection dis‐

connected as scheduled.







667 5.9.0 SonicPoint SonicPoint INFO ‐‐‐ SonicPoint Status

74 |



668 5.9.0 Maintenance High Availability INFO ‐‐‐ HA Peer Firewall Rebooted




Error Rebooting HA Peer Fire‐

wall



wall



wall


License of HA pair doesn't

match: %s



match: %s



match: %s


Primary received reboot signal

from Secondary



from Secondary



from Secondary


Secondary received reboot sig‐

nal from Primary



nal from Primary



nal from Primary

674 5.9.0 System Error High Availability INFO ‐‐‐

Success to reach Interface %s

probe



probe



probe


Failure to reach Interface %s

probe



probe




probe

676 5.9.0 ‐‐‐ Multicast INFO ‐‐‐

IGMP V2 client joined multicast

Group : %s



Group : %s



Group : %s



Group : %s



Group : %s



Group : %s


IGMP Leave group message

Received on interface %s







683 5.9.0 ‐‐‐ Multicast NOTICE ‐‐‐

IGMP packet dropped, wrong

checksum received on inter‐

face %s




face %s




face %s


Multicast UDP packet dropped,

no state entry



no state entry



no state entry

694 5.9.0 ‐‐‐ Multicast WARNING ‐‐‐


RTP stateful failed



RTP stateful failed

76 |



RTP stateful failed

701 5.9.0 ‐‐‐ Multicast DEBUG ‐‐‐

IGMP querier Router detected

on interface %s



on interface %s



on interface %s

706 5.9.0 ‐‐‐ Network Monitor ALERT 14005

Network Monitor: Host %s is

offline



offline



offline



online



online



online


TCP packet received with

invalid SEQ number; TCP packet

dropped




dropped




dropped



invalid ACK number; TCP packet

dropped




dropped




dropped


TCP connection reject received;

TCP connection dropped









TCP connection abort received;








714 5.9.0 Debug Network Access NOTICE ‐‐‐ EIGRP packet dropped



719 5.9.0 System Error VPN ERROR ‐‐‐

VPN policy count received

exceeds the limit; %s







720 5.9.0 Maintenance PPPoE INFO ‐‐‐ Sending LCP Echo Request



721 5.9.0 Maintenance PPPoE INFO ‐‐‐ Received LCP Echo Request



722 5.9.0 Maintenance PPPoE INFO ‐‐‐ Sending LCP Echo Reply



723 5.9.0 Maintenance PPPoE INFO ‐‐‐ Received LCP Echo Reply



724 5.9.0 ‐‐‐ Network Access INFO ‐‐‐

Guest Services drop traffic to

deny network



deny network



deny network

78 |


Guest Services pass traffic to

access allow network








WLAN max concurrent users

reached already



reached already



reached already

727 5.9.0 SonicPoint SonicPoint INFO ‐‐‐ SonicPoint Provision




Authenticated

Access INFO ‐‐‐ WLAN disabled by schedule


Authenticated



Authenticated



Authenticated

Access INFO ‐‐‐ WLAN enabled by schedule


Authenticated



Authenticated


732 5.9.0

TCP | UDP |

ICMP Wireless WARNING ‐‐‐

Packet dropped by WLAN SSL

VPN enforcement check

732 6.0.5

TCP | UDP |




732 6.2.0

TCP | UDP |




733 5.9.0 Maintenance Wireless INFO ‐‐‐ SSL VPN enforcement



734 5.9.0 ‐‐‐ Firewall Event INFO ‐‐‐

Source IP address connection

status: %s




status: %s



status: %s


Destination IP address connec‐

tion status: %s



tion status: %s



tion status: %s


SMTP authentication prob‐

lem:%s



lem:%s



lem:%s


PPPoE Client: Previous session










communication problem








User login denied ‐ LDAP









User login denied ‐ LDAP server

Timeout



Timeout

80 |



Timeout



down or misconfigured








User login denied ‐ LDAP com‐

munication problem



munication problem



munication problem


User login denied ‐ invalid cre‐

dentials on LDAP server








User login denied ‐ insufficient

access on LDAP server









schema mismatch



schema mismatch



schema mismatch


Allowed LDAP server certificate

with wrong host name










name resolution failed









server name resolution failed









certificate not valid








User login denied ‐ TLS or local

certificate problem



certificate problem



certificate problem


User login denied ‐ LDAP direc‐

tory mismatch



tory mismatch



tory mismatch


LDAP server does not allow

CHAP



CHAP



CHAP


Authenticated


User login denied ‐ user already

logged in

82 |


Authenticated



logged in


Authenticated



logged in

760 5.9.0 ‐‐‐ Network Access NOTICE ‐‐‐

TCP handshake violation

detected; TCP connection

dropped




dropped




dropped


Access attempt from host out of

compliance with GSC Policy







762 5.9.0 Maintenance Security Services INFO ‐‐‐ GSC Policy out‐of‐date on host



763 5.9.0 Maintenance Security Services INFO 8627


out GSC installed



out GSC installed



out GSC installed


Failed to synchronize license

information with Licensing

Server. %s




Server. %s




Server. %s

773 5.9.0 System Error DDNS ERROR ‐‐‐ DDNS Failure: Provider %s







776 5.9.0 Maintenance DDNS INFO ‐‐‐

DDNS Update success for

domain %s



domain %s



domain %s

777 5.9.0 System Error DDNS WARNING ‐‐‐ DDNS Warning: Provider %s




DDNS association %s taken

Offline locally



Offline locally



Offline locally

779 5.9.0 Maintenance DDNS INFO ‐‐‐ DDNS association %s added



780 5.9.0 Maintenance DDNS INFO ‐‐‐ DDNS association %s enabled



781 5.9.0 Maintenance DDNS INFO ‐‐‐ DDNS association %s disabled




DDNS Association %s put on

line



line



line


All DDNS associations have

been deleted



been deleted

84 |



been deleted


DDNS association %s deacti‐

vated



vated



vated

785 5.9.0 Maintenance DDNS INFO ‐‐‐ DDNS association %s deleted



786 5.9.0 ‐‐‐ DDNS INFO ‐‐‐ DDNS association %s updated



789 5.9.0 Attack

Intrusion Detec‐


789 6.0.5 Attack

Intrusion Detec‐


789 6.2.0 Attack

Intrusion Detec‐


790 5.9.0 Attack

Intrusion Detec‐


790 6.0.5 Attack

Intrusion Detec‐


790 6.2.0 Attack

Intrusion Detec‐


791 5.9.0 ‐‐‐ DPI‐SSL INFO ‐‐‐ DPI‐SSL: %s

791 6.0.5 Network Access DPI‐SSL INFO ‐‐‐ DPI‐SSL: %s

791 6.2.0 ‐‐‐ DPI‐SSL INFO ‐‐‐ DPI‐SSL: %s


Application Fire‐

wall ALERT 13201 Application Firewall Alert: %s


Application Fire‐



Application Fire‐


794 5.9.0 Attack

Intrusion Detec‐

tion ALERT 6437

Anti‐Spyware Prevention Alert:

%s

794 6.0.5 Attack

Intrusion Detec‐

tion ALERT 6437


%s


794 6.2.0 Attack

Intrusion Detec‐

tion ALERT 6437


%s

795 5.9.0 Attack

Intrusion Detec‐

tion ALERT 6438

Anti‐Spyware Detection Alert:

%s

795 6.0.5 Attack

Intrusion Detec‐

tion ALERT 6438


%s

795 6.2.0 Attack

Intrusion Detec‐

tion ALERT 6438


%s

796 5.9.0 Maintenance Security Services WARNING 8631 Anti‐Spyware Service Expired



797 5.9.0 ‐‐‐ RBL NOTICE ‐‐‐

Outbound connection to RBL‐

listed SMTP server dropped

797 6.0.5 ‐‐‐ RBL NOTICE ‐‐‐



797 6.2.0 ‐‐‐ RBL NOTICE ‐‐‐



798 5.9.0 ‐‐‐ RBL NOTICE ‐‐‐

Inbound connection from RBL‐


798 6.0.5 ‐‐‐ RBL NOTICE ‐‐‐



798 6.2.0 ‐‐‐ RBL NOTICE ‐‐‐



799 5.9.0 ‐‐‐ RBL NOTICE ‐‐‐

SMTP server found on RBL

blacklist

799 6.0.5 ‐‐‐ RBL NOTICE ‐‐‐


blacklist

799 6.2.0 ‐‐‐ RBL NOTICE ‐‐‐


blacklist

800 5.9.0 ‐‐‐ RBL ERROR ‐‐‐

No valid DNS server specified

for RBL lookups

800 6.0.5 ‐‐‐ RBL ERROR ‐‐‐


for RBL lookups

800 6.2.0 ‐‐‐ RBL ERROR ‐‐‐


for RBL lookups

805 5.9.0 ‐‐‐ GMS INFO ‐‐‐ Interface statistics report



806 5.9.0 ‐‐‐ GMS INFO ‐‐‐ SonicPoint statistics report

86 |



809 5.9.0 Attack Security Services ALERT 8632 Gateway Anti‐Virus Alert: %s




Gateway Anti‐Virus Service

expired



expired



expired


PPP Dial‐Up: Invalid DNS IP

address returned from Dial‐Up

ISP; overriding using dial‐up

profile settings





profile settings





profile settings

815 5.9.0 ‐‐‐ Network WARNING ‐‐‐

Too many gratuitous ARPs

detected



detected



detected


Authenticated


Incoming call received for

Remotely Triggered Dial‐out

session


Authenticated




session


Authenticated




session



Authenticated



session started. Requesting

authentication


Authenticated




authentication


Authenticated




authentication


Authenticated


Incorrect authentication

received for Remotely Trig‐

gered Dial‐out


Authenticated




gered Dial‐out


Authenticated




gered Dial‐out


Authenticated


Successful authentication


gered Dial‐out


Authenticated




gered Dial‐out


Authenticated




gered Dial‐out


Authenticated


Authentication Timeout during


session


Authenticated




session


Authenticated




session


Authenticated



session ended. Valid WAN

bound data found. Normal dial‐

up sequence will commence

88 |


Authenticated







Authenticated






823 5.9.0 System Error High Availability ERROR ‐‐‐

Secondary will be shut down in

%s minutes



%s minutes



%s minutes


Secondary shut down because

license is expired



license is expired



license is expired

825 5.9.0 System Error High Availability INFO ‐‐‐ Secondary active



826 5.9.0 ‐‐‐ High Availability ERROR ‐‐‐ %s



828 5.9.0 ‐‐‐ High Availability INFO ‐‐‐ %s



829 5.9.0 ‐‐‐ High Availability ALERT ‐‐‐ %s



830 5.9.0 ‐‐‐ High Availability NOTICE ‐‐‐ %s



832 5.9.0 ‐‐‐ DHCP Server INFO ‐‐‐

DHCP Scopes altered automati‐

cally due to change in network

settings for interface %s










833 5.9.0 System Error DHCP Server WARNING ‐‐‐

DHCP lease file in the storage is

corrupted; read failed








Failed to write DHCP leases to

storage



storage



storage

835 5.9.0 Maintenance DHCP Server INFO ‐‐‐ DHCP leases written to storage



840 5.9.0 ‐‐‐ ARS INFO ‐‐‐ %s

840 6.0.5 ‐‐‐ ARS INFO ‐‐‐ %s

840 6.2.0 ‐‐‐ ARS INFO ‐‐‐ %s

841 5.9.0 ‐‐‐ ARS NOTICE ‐‐‐ %s

841 6.0.5 ‐‐‐ DHCP Server NOTICE ‐‐‐ %s

841 6.2.0 ‐‐‐ DHCP Server NOTICE ‐‐‐ %s

842 5.9.0 ‐‐‐ ARS DEBUG ‐‐‐ %s

842 6.0.5 ‐‐‐ ARS DEBUG ‐‐‐ %s

842 6.2.0 ‐‐‐ ARS DEBUG ‐‐‐ %s

847 5.9.0 Maintenance Network WARNING ‐‐‐

IP address conflict detected

from Ethernet address %s







848 5.9.0 User Activity VPN PKI INFO ‐‐‐ OCSP sending request.


90 |


849 5.9.0 User Activity VPN PKI ERROR ‐‐‐

OCSP send request message

failed.



failed.



failed.

850 5.9.0 User Activity VPN PKI INFO ‐‐‐ OCSP received response.



852 5.9.0 User Activity VPN PKI INFO ‐‐‐ OCSP Resolved Domain Name.




OCSP Failed to Resolve Domain

Name.



Name.



Name.


OCSP Internal error handling

received response.



received response.



received response.

856 5.9.0 Attack

Intrusion Detec‐


SYN Flood Mode changed by

user to: Watch and report pos‐

sible SYN floods

856 6.0.5 Debug

Intrusion Detec‐




sible SYN floods

856 6.2.0 Attack

Intrusion Detec‐




sible SYN floods

857 5.9.0 Attack

Intrusion Detec‐



user to: Watch and proxy WAN

connections when under attack


857 6.0.5 Debug

Intrusion Detec‐





857 6.2.0 Attack

Intrusion Detec‐





858 5.9.0 Attack

Intrusion Detec‐



user to: Always proxy WAN con‐

nections

858 6.0.5 Debug

Intrusion Detec‐




nections

858 6.2.0 Attack

Intrusion Detec‐




nections

859 5.9.0 Attack

Intrusion Detec‐

tion ALERT ‐‐‐

Possible SYN flood detected on

WAN IF %s ‐ switching to con‐

nection‐proxy mode

859 6.0.5 Debug

Intrusion Detec‐





859 6.2.0 Attack

Intrusion Detec‐





860 5.9.0 Attack

Intrusion Detec‐

tion ALERT ‐‐‐ Possible SYN Flood on IF %s

860 6.0.5 Debug

Intrusion Detec‐


860 6.2.0 Attack

Intrusion Detec‐


861 5.9.0 Attack

Intrusion Detec‐


SYN flood ceased or flooding

machines blacklisted ‐ connec‐

tion proxy disabled

861 6.0.5 Debug

Intrusion Detec‐




tion proxy disabled

861 6.2.0 Attack

Intrusion Detec‐




tion proxy disabled

92 |

862 5.9.0 Attack

Intrusion Detec‐


SYN Flood blacklisting enabled

by user

862 6.0.5 Debug

Intrusion Detec‐



by user

862 6.2.0 Attack

Intrusion Detec‐



by user

863 5.9.0 Attack

Intrusion Detec‐


SYN Flood blacklisting disabled

by user

863 6.0.5 Debug

Intrusion Detec‐



by user

863 6.2.0 Attack

Intrusion Detec‐



by user

864 5.9.0 Attack

Intrusion Detec‐


SYN‐Flooding machine %s black‐

listed

864 6.0.5 Debug

Intrusion Detec‐



listed

864 6.2.0 Attack

Intrusion Detec‐



listed

865 5.9.0 Attack

Intrusion Detec‐


Machine %s removed from SYN

flood blacklist

865 6.0.5 Debug

Intrusion Detec‐



flood blacklist

865 6.2.0 Attack

Intrusion Detec‐



flood blacklist

866 5.9.0 Attack

Intrusion Detec‐


Possible SYN Flood on IF %s

continues

866 6.0.5 Debug

Intrusion Detec‐



continues

866 6.2.0 Attack

Intrusion Detec‐



continues

867 5.9.0 Attack

Intrusion Detec‐


Possible SYN Flood on IF %s has

ceased

867 6.0.5 Debug

Intrusion Detec‐



ceased

867 6.2.0 Attack

Intrusion Detec‐



ceased

868 5.9.0 Attack

Intrusion Detec‐


SYN Flood Blacklist on IF %s

continues


868 6.0.5 Debug

Intrusion Detec‐



continues

868 6.2.0 Attack

Intrusion Detec‐



continues

869 5.9.0 Attack

Intrusion Detec‐

tion DEBUG ‐‐‐ TCP SYN received

869 6.0.5 Debug

Intrusion Detec‐


869 6.2.0 Attack

Intrusion Detec‐


872 5.9.0 User Activity Security Services NOTICE ‐‐‐ %s



874 5.9.0 User Activity VPN PKI ALERT ‐‐‐ CRL has expired



875 5.9.0 User Activity VPN PKI ALERT ‐‐‐ Failed to find certificate




CRL missing ‐ Issuer requires

CRL checking.



CRL checking.



CRL checking.


CRL validation failure for Root

Certificate



Certificate



Certificate

878 5.9.0 User Activity VPN PKI ALERT ‐‐‐ Cannot Validate Issuer Path



879 5.9.0 ‐‐‐ RF Management WARNING ‐‐‐

WLAN radio frequency threat

detected



detected

94 |



detected


Dynamic Address

Objects INFO ‐‐‐

Unable to resolve dynamic

address object


Dynamic Address



address object


Dynamic Address



address object

881 5.9.0 ‐‐‐ Firewall Logging NOTICE ‐‐‐ System clock manually updated



882 5.9.0 TCP Network Access DEBUG ‐‐‐

HTTP method detected; exam‐

ining stream for host header







883 5.9.0 TCP|UDP Network Access NOTICE ‐‐‐

IP Header checksum error;

packet dropped



packet dropped



packet dropped

884 5.9.0 TCP Network Access NOTICE ‐‐‐

TCP checksum error; packet

dropped



dropped



dropped

885 5.9.0 UDP Network Access NOTICE ‐‐‐

UDP checksum error; packet

dropped



dropped



dropped


ICMP checksum error; packet

dropped



dropped




dropped



invalid header length; TCP

packet dropped




packet dropped




packet dropped


TCP packet received on non‐

existent/closed connection; TCP

packet dropped




packet dropped




packet dropped


TCP packet received without

mandatory SYN flag; TCP packet

dropped




dropped




dropped



mandatory ACK flag; TCP packet

dropped




dropped




dropped

96 |


TCP packet received on a clos‐

ing connection; TCP packet

dropped




dropped




dropped

892 5.9.0 Debug Network INFO ‐‐‐

TCP packet received with SYN

flag on an existing connection;

TCP packet dropped




TCP packet dropped




TCP packet dropped



invalid SACK option length; TCP

packet dropped




packet dropped




packet dropped



invalid MSS option length; TCP

packet dropped




packet dropped




packet dropped



invalid option length; TCP

packet dropped





packet dropped




packet dropped



invalid source port; TCP packet

dropped




dropped




dropped

897 5.9.0 Attack Network INFO ‐‐‐


invalid SYN Flood cookie; TCP

packet dropped




packet dropped

897 6.2.0 Attack Network INFO ‐‐‐



packet dropped

898 5.9.0 Attack

Intrusion Detec‐


RST‐Flooding machine %s black‐

listed

898 6.0.5 Debug

Intrusion Detec‐



listed

898 6.2.0 Attack

Intrusion Detec‐



listed

899 5.9.0 Attack

Intrusion Detec‐


RST Flood Blacklist on IF %s con‐

tinues

899 6.0.5 Debug

Intrusion Detec‐



tinues

899 6.2.0 Attack

Intrusion Detec‐



tinues

900 5.9.0 Attack

Intrusion Detec‐


Machine %s removed from RST

flood blacklist

900 6.0.5 Debug

Intrusion Detec‐



flood blacklist

98 |

900 6.2.0 Attack

Intrusion Detec‐



flood blacklist

901 5.9.0 Attack

Intrusion Detec‐


FIN‐Flooding machine %s black‐

listed

901 6.0.5 Debug

Intrusion Detec‐



listed

901 6.2.0 Attack

Intrusion Detec‐



listed

902 5.9.0 Attack

Intrusion Detec‐


FIN Flood Blacklist on IF %s con‐

tinues

902 6.0.5 Debug

Intrusion Detec‐



tinues

902 6.2.0 Attack

Intrusion Detec‐



tinues

903 5.9.0 Attack

Intrusion Detec‐


Machine %s removed from FIN

flood blacklist

903 6.0.5 Debug

Intrusion Detec‐



flood blacklist

903 6.2.0 Attack

Intrusion Detec‐



flood blacklist

904 5.9.0 Attack

Intrusion Detec‐

tion ALERT ‐‐‐ Possible RST Flood on IF %s

904 6.0.5 Debug

Intrusion Detec‐


904 6.2.0 Attack

Intrusion Detec‐


905 5.9.0 Attack

Intrusion Detec‐

tion ALERT ‐‐‐ Possible FIN Flood on IF %s

905 6.0.5 Debug

Intrusion Detec‐


905 6.2.0 Attack

Intrusion Detec‐


906 5.9.0 Attack

Intrusion Detec‐


Possible RST Flood on IF %s has

ceased

906 6.0.5 Debug

Intrusion Detec‐



ceased

906 6.2.0 Attack

Intrusion Detec‐



ceased


907 5.9.0 Attack

Intrusion Detec‐


Possible FIN Flood on IF %s has

ceased

907 6.0.5 Debug

Intrusion Detec‐



ceased

907 6.2.0 Attack

Intrusion Detec‐



ceased

908 5.9.0 Attack

Intrusion Detec‐


Possible RST Flood on IF %s con‐

tinues

908 6.0.5 Debug

Intrusion Detec‐



tinues

908 6.2.0 Attack

Intrusion Detec‐



tinues

909 5.9.0 Attack

Intrusion Detec‐


Possible FIN Flood on IF %s con‐

tinues

909 6.0.5 Debug

Intrusion Detec‐



tinues

909 6.2.0 Attack

Intrusion Detec‐



tinues

910 5.9.0 Debug Network WARNING ‐‐‐ Packet Dropped ‐ IP TTL expired




Dynamic Address


Added host entry to dynamic

address object


Dynamic Address



address object


Dynamic Address



address object


Dynamic Address


Removed host entry from

dynamic address object


Dynamic Address





Dynamic Address





IKE Responder: Phase 1 Authen‐

tication Method does not

match




match

100 |




match


IKE Responder: Phase 1 encryp‐

tion algorithm does not match









tion algorithm keylength does

not match




not match




not match


IKE Responder: Phase 1 hash

algorithm does not match








IKE Responder: Phase 1 XAUTH

required but Policy has no user

name




name




name




password




password





password


IKE Responder: Phase 1 DH

Group does not match








IKE Responder: AH authentica‐









IKE Responder: ESP encryption









IKE Responder: ESP authentica‐










tion key length does not match









key length does not match







102 |












tion key rounds does not match









key rounds does not match

















IKE Initiator: Remote party

Timeout ‐ Retransmitting IKE

Request.




Request.




Request.


IKE Responder: Remote party


Request.




Request.





Request.


IKE Responder: IPsec protocol

mismatch



mismatch



mismatch


IKE Initiator: Proposed IKE ID

mismatch



mismatch



mismatch


IKE Responder: Peer's local net‐

work does not match VPN Pol‐

icy's [Destination ]










IKE Responder: Peer's destina‐

tion network does not match

VPN Policy's [Local Network]










IKE Responder: Route table

overrides VPN Policy







104 |


IKE Initiator: IKE proposal does

not match (Phase 1)



not match (Phase 1)



not match (Phase 1)


IKEv2 Initiator: Send

IKE_SA_INIT Request



IKE_SA_INIT Request



IKE_SA_INIT Request


IKEv2 Responder: Received

IKE_SA_INIT Request



IKE_SA_INIT Request



IKE_SA_INIT Request


IKEv2 Initiator: Send IKE_AUTH

Request



Request



Request



IKE_AUTH Request



IKE_AUTH Request



IKE_AUTH Request

942 5.9.0 User Activity VPN IKE INFO ‐‐‐ IKEv2 Authentication successful



943 5.9.0 User Activity VPN IKE INFO ‐‐‐ IKEv2 Accept IKE SA Proposal



944 5.9.0 User Activity VPN IKE INFO ‐‐‐ IKEv2 Accept IPsec SA Proposal






CREATE_CHILD_SA Request

















IKEv2 Send delete IKE SA

Request



Request



Request


IKEv2 Received delete IKE SA

Request



Request



Request


IKEv2 Send delete IPsec SA

Request



Request



Request


IKEv2 Received delete IPsec SA

Request



Request



Request


IKEv2 Responder: Peer's desti‐

nation network does not match


106 |










IKEv2 Responder: Peer's local

network does not match VPN

Policy's [Destination Network]









953 5.9.0 User Activity VPN IKE WARNING ‐‐‐ IKEv2 Payload processing error




IKEv2 Initiator: Negotiations

failed. Extra payloads present.









failed. Missing required pay‐

loads.




loads.




loads.



failed. Invalid input state.










failed. Invalid output state.







958 5.9.0 User Activity VPN IKE WARNING ‐‐‐ IKEv2 Payload validation failed.



959 5.9.0 User Activity VPN IKE WARNING ‐‐‐ IKEv2 Unable to find IKE SA



960 5.9.0 User Activity VPN IKE WARNING ‐‐‐ IKEv2 Decrypt packet failed



961 5.9.0 User Activity VPN IKE WARNING ‐‐‐ IKEv2 Out of memory




IKEv2 Responder: Policy for

remote IKE ID not found








IKEv2 Process Message queue

failed



failed



failed

964 5.9.0 User Activity VPN IKE WARNING ‐‐‐ IKEv2 Invalid state



965 5.9.0 System Error VPN IKE ERROR ‐‐‐

IKE Responder: Client Policy has

no VPN Access Networks

assigned. Check Configuration.

108 |









966 5.9.0 User Activity VPN IKE WARNING ‐‐‐ IKEv2 Invalid SPI size



967 5.9.0 User Activity VPN IKE WARNING ‐‐‐ IKEv2 VPN Policy not found




IKEv2 IPsec proposal does not

match



match



match

969 5.9.0 User Activity VPN IKE WARNING ‐‐‐ IKEv2 IPsec attribute not found



970 5.9.0 User Activity VPN IKE WARNING ‐‐‐ IKEv2 IKE attribute not found




IKEv2 Peer is not responding.

Negotiation aborted.








IKEv2 Initiator: Remote party

Timeout ‐ Retransmitting IKEv2

Request.




Request.




Request.



IKEv2 Initiator: Received

IKE_SA_INT response



IKE_SA_INT response



IKE_SA_INT response



IKE_AUTH response



IKE_AUTH response



IKE_AUTH response



CREATE_CHILD_SA response








IKEv2 Responder: Send

IKE_SA_INIT response









IKE_AUTH response



IKE_AUTH response



IKE_AUTH response

978 5.9.0 User Activity VPN IKE INFO ‐‐‐ IKEv2 negotiation complete




IKEv2 Function sendto() failed

to transmit packet.



to transmit packet.



to transmit packet.

110 |


IKEv2 Initiator: Proposed IKE ID

mismatch



mismatch



mismatch


IKEv2 IKE proposal does not

match



match



match


IKEv2 Received notify status

payload



payload



payload


IKEv2 Received notify error pay‐

load



load



load


IKEv2 No NAT device detected

between negotiating peers








IKEv2 NAT device detected









Authenticated


User login denied ‐ not allowed

by Policy rule



Authenticated



by Policy rule


Authenticated



by Policy rule


Authenticated


User login denied ‐ not found

locally


Authenticated



locally


Authenticated



locally


Authenticated


User login denied ‐ SSO agent

Timeout


Authenticated



Timeout


Authenticated



Timeout


Authenticated



configuration error


Authenticated



configuration error


Authenticated



configuration error


Authenticated





Authenticated





Authenticated





Authenticated





Authenticated





Authenticated




992 5.9.0 User Activity CIA WARNING ‐‐‐

SSO agent returned user name

too long



too long

112 |



too long


SSO agent returned domain

name too long



name too long



name too long


Authenticated


Configuration mode administra‐

tion session started


Authenticated





Authenticated





Authenticated



tion session ended


Authenticated



tion session ended


Authenticated



tion session ended


Authenticated


Read‐only mode GUI adminis‐

tration session started


Authenticated





Authenticated





Authenticated


Non‐config mode GUI adminis‐



Authenticated





Authenticated





Authenticated


GUI administration session

ended


Authenticated



ended


Authenticated



ended


999 5.9.0 Blocked Sites Network Access INFO ‐‐‐

SSL Control: Website found in

blacklist



blacklist



blacklist



whitelist



whitelist



whitelist

1001 5.9.0 Blocked Sites Network Access INFO ‐‐‐ SSL Control: HTTPS via SSL2




SSL Control: Certificate with

invalid date



invalid date



invalid date


SSL Control: Self‐signed certifi‐

cate



cate



cate


SSL Control: Weak cipher being

used



used



used

1005 5.9.0 Blocked Sites Network Access INFO ‐‐‐ SSL Control: Untrusted CA




SSL Control: Certificate chain

not complete

114 |



not complete



not complete


SSL Control: Failed to decode

Server Hello



Server Hello



Server Hello


Authenticated


User logged out ‐ logout

detected by SSO


Authenticated



detected by SSO


Authenticated



detected by SSO

1009 5.9.0 System Error RADIUS ERROR ‐‐‐ Bind to LDAP server failed



1010 5.9.0 System Error RADIUS ALERT ‐‐‐

Using LDAP without TLS ‐ highly

insecure



insecure



insecure

1011 5.9.0 System Error RADIUS WARNING ‐‐‐

LDAP using non‐administrative

account ‐ VPN client user will

not be able to change pass‐

words





words





words













response



response



response



response



response



response



response



response



response



response



response



response

1017 5.9.0

System Envi‐

ronment Firewall Hardware INFO ‐‐‐ 3G/4G %s device detected

1017 6.0.5

System Envi‐


1017 6.2.0

System Envi‐


1018 5.9.0 ‐‐‐ PPP INFO ‐‐‐ PPP message: %s



1019 5.9.0 User Activity PPP Dial‐Up INFO ‐‐‐ Chat started


116 |


1020 5.9.0 User Activity PPP Dial‐Up INFO ‐‐‐ Chat completed



1021 5.9.0 User Activity PPP Dial‐Up INFO ‐‐‐ Chat wrote '%s'



1022 5.9.0 User Activity PPP Dial‐Up INFO ‐‐‐ Chat %s



1023 5.9.0 User Activity PPP Dial‐Up INFO ‐‐‐ Chat failed: %s



1024 5.9.0 System Error PPP Dial‐Up ERROR ‐‐‐

Unable to send message to dial‐

up task



up task



up task

1026 5.9.0 User Activity PPP Dial‐Up ALERT ‐‐‐ 3G/4G Dial‐up: %s.



1027 5.9.0 User Activity PPP Dial‐Up ALERT 7643

3G/4G Dial‐up: data usage limit

reached for the '%s' billing

cycle. Disconnecting the ses‐

sion.





sion.





sion.

1028 5.9.0 System Error PPP Dial‐Up ALERT ‐‐‐

%s auto‐dial failed: Current

Connection Model is configured

as Ethernet Only





as Ethernet Only




as Ethernet Only


TCP packet received with non‐

permitted option; TCP packet

dropped




dropped




dropped



invalid Window Scale option

length; TCP packet dropped












value; TCP packet dropped










Authenticated


Problem occurred during user

group membership retrieval


Authenticated





Authenticated




118 |


Authenticated


User login denied ‐ password

expired


Authenticated



expired


Authenticated



expired


IKE Responder: IKE Phase 1

exchange does not match







1037 5.9.0 ‐‐‐ PPP Dial‐Up INFO ‐‐‐ PPP Dial‐Up: Starting PPP



1038 5.9.0 ‐‐‐ PPP Dial‐Up INFO ‐‐‐

Dial‐up: Traffic generated by

'%s'

1038 6.0.5 ‐‐‐ PPP Dial‐Up INFO ‐‐‐


'%s'

1038 6.2.0 ‐‐‐ PPP Dial‐Up INFO ‐‐‐


'%s'

1039 5.9.0 ‐‐‐ PPP Dial‐Up INFO ‐‐‐

Dial‐up: Session initiated by

data packet

1039 6.0.5 ‐‐‐ PPP Dial‐Up INFO ‐‐‐


data packet

1039 6.2.0 ‐‐‐ PPP Dial‐Up INFO ‐‐‐


data packet

1040 5.9.0 ‐‐‐ DHCP Server ALERT ‐‐‐

DHCP Server: IP conflict

detected



detected



detected


DHCP Server: Received DHCP

decline from client



decline from client



decline from client


1043 5.9.0 ‐‐‐ Firewall Hardware ERROR 5425

Power supply without redun‐

dancy



dancy



dancy

1044 5.9.0 ‐‐‐ High Availability INFO ‐‐‐ Discovered HA %s Firewall




Diagnostic Auto‐restart sched‐

uled for %s minutes from now








Diagnostic Auto‐restart can‐

celed



celed



celed


As per Diagnostic Auto‐restart

configuration Request, restart‐

ing system




ing system




ing system

1048 5.9.0 ‐‐‐

Authenticated



doesn't meet constraints

1048 6.0.5 ‐‐‐

Authenticated




1048 6.2.0 ‐‐‐

Authenticated




1050 5.9.0 User Activity VPN INFO ‐‐‐ VPN policy %s is added

1050 6.0.5 ‐‐‐ VPN INFO ‐‐‐ VPN Policy Added

1050 6.2.0 User Activity VPN INFO ‐‐‐ VPN policy %s is added

120 |

1051 5.9.0 User Activity VPN INFO ‐‐‐ VPN policy %s is deleted

1051 6.0.5 ‐‐‐ VPN INFO ‐‐‐ VPN Policy Deleted

1051 6.2.0 User Activity VPN INFO ‐‐‐ VPN policy %s is deleted

1052 5.9.0 User Activity VPN INFO ‐‐‐ VPN policy %s is modified

1052 6.0.5 ‐‐‐ VPN INFO ‐‐‐ VPN Policy Modified

1052 6.2.0 User Activity VPN INFO ‐‐‐ VPN policy %s is modified

1053 5.9.0 ‐‐‐ Firewall Hardware ALERT 5418 PC Card removed.



1054 5.9.0 ‐‐‐ Firewall Hardware ALERT 5419 PC Card inserted.



1055 5.9.0 ‐‐‐ Firewall Hardware ALERT ‐‐‐ 3G/4G: No SIM detected



1057 5.9.0 ‐‐‐ High Availability INFO ‐‐‐ Peer firewall rebooting (%s)



1058 5.9.0 ‐‐‐ High Availability INFO ‐‐‐

Primary firewall rebooting itself

as it transitioned from Active to

Standby while Preempt










Secondary firewall rebooting

itself as it transitioned from

Active to Standby while Pre‐

empt





empt





empt


1060 5.9.0 ‐‐‐ Crypto Test ERROR ‐‐‐

Crypto SHA1 based DRNG KAT

test failed



test failed



test failed


Successfully sent %s file to

remote backup server








Failed to send file to remote

backup server, Error: %s







1068 5.9.0 ‐‐‐ DHCP Server WARNING ‐‐‐

Multiple DHCP Servers are

detected on network



detected on network



detected on network


Invalid DNS Server will not be

accepted by the dynamic client







1071 5.9.0 ‐‐‐ Firewall Event CRITICAL ‐‐‐

DHCP Server sanity check

passed %s



passed %s



passed %s


DHCP Server sanity check failed

%s

122 |



%s



%s

1073 5.9.0 User Activity CIA WARNING ‐‐‐ SSO agent returned error



1074 5.9.0 ‐‐‐ L2TP Client INFO ‐‐‐ L2TP Tunnel Negotiation %s



1075 5.9.0 User Activity CIA ALERT ‐‐‐ SSO agent is down



1076 5.9.0 User Activity CIA ALERT ‐‐‐ SSO agent is up



1077 5.9.0 ‐‐‐ SonicPoint‐N INFO ‐‐‐ SonicPoint‐N Status



1078 5.9.0 ‐‐‐ SonicPoint‐N INFO ‐‐‐ SonicPoint‐N Provision



1079 5.9.0 ‐‐‐ SSL VPN INFO ‐‐‐ %s

1079 6.0.5 ‐‐‐ SSL VPN INFO ‐‐‐ %s

1079 6.2.0 ‐‐‐ SSL VPN INFO ‐‐‐ %s

1080 5.9.0 ‐‐‐

Authenticated


SSL VPN zone remote user login

allowed

1080 6.0.5 ‐‐‐

Authenticated



allowed

1080 6.2.0 ‐‐‐

Authenticated



allowed



MD5 Digest Signature Algo‐

rithm




rithm





rithm

1082 5.9.0 ‐‐‐ Anti‐Spam WARNING 13801 %s is operational.



1083 5.9.0 ‐‐‐ Anti‐Spam WARNING 13802 %s is unavailable.



1084 5.9.0 ‐‐‐ Anti‐Spam INFO 13803

Anti‐Spam service is enabled by

administrator.

1084 6.0.5 ‐‐‐ Anti‐Spam INFO 13803


administrator.

1084 6.2.0 ‐‐‐ Anti‐Spam INFO 13803


administrator.

1085 5.9.0 ‐‐‐ Anti‐Spam INFO 13804

Anti‐Spam service is disabled by

administrator.

1085 6.0.5 ‐‐‐ Anti‐Spam INFO 13804


administrator.

1085 6.2.0 ‐‐‐ Anti‐Spam INFO 13804


administrator.

1086 5.9.0 ‐‐‐ Anti‐Spam WARNING 13805

Your Anti‐Spam Service sub‐

scRIPtion has expired.








SMTP connection limit is

reached. Connection is

dropped.




dropped.




dropped.

1088 5.9.0 ‐‐‐ Anti‐Spam WARNING 13807 Anti‐Spam Startup Failure ‐ %s



124 |


Anti‐Spam Teardown Failure ‐

%s



%s



%s

1090 5.9.0 ‐‐‐ DHCP Server NOTICE ‐‐‐


message from untrusted relay

agent




agent




agent

1091 5.9.0 ‐‐‐ Anti‐Spam NOTICE 13809

Outbound connection to GRID‐


1091 6.0.5 ‐‐‐ Anti‐Spam NOTICE 13809



1091 6.2.0 ‐‐‐ Anti‐Spam NOTICE 13809



1092 5.9.0 ‐‐‐ Anti‐Spam NOTICE 13810

Inbound connection from GRID‐


1092 6.0.5 ‐‐‐ Anti‐Spam NOTICE 13810



1092 6.2.0 ‐‐‐ Anti‐Spam NOTICE 13810



1093 5.9.0 ‐‐‐ Anti‐Spam NOTICE 13811

SMTP server found on Reject

List

1093 6.0.5 ‐‐‐ Anti‐Spam NOTICE 13811


List

1093 6.2.0 ‐‐‐ Anti‐Spam NOTICE 13811


List

1094 5.9.0 ‐‐‐ Anti‐Spam ERROR 13812


for GRID lookups

1094 6.0.5 ‐‐‐ Anti‐Spam ERROR 13812


for GRID lookups

1094 6.2.0 ‐‐‐ Anti‐Spam ERROR 13812


for GRID lookups


1095 5.9.0 ‐‐‐ Anti‐Spam INFO 13813

Unprocessed E‐mail received

from MTA on Inbound SMTP

port

1095 6.0.5 ‐‐‐ Anti‐Spam INFO 13813



port

1095 6.2.0 ‐‐‐ Anti‐Spam INFO 13813



port

1097 5.9.0 ‐‐‐ VPN PKI NOTICE ‐‐‐ SCEP Client: %s



1098 5.9.0 ‐‐‐

Intrusion Detec‐

tion ALERT 6465

Possible DNS rebind attack

detected

1098 6.0.5 ‐‐‐

Intrusion Detec‐

tion ALERT 6465


detected

1098 6.2.0 ‐‐‐

Intrusion Detec‐

tion ALERT 6465


detected

1099 5.9.0 ‐‐‐

Intrusion Detec‐

tion ALERT 6466 DNS rebind attack blocked

1099 6.0.5 ‐‐‐

Intrusion Detec‐


1099 6.2.0 ‐‐‐

Intrusion Detec‐



Network Monitor: Policy %s sta‐

tus is UP



tus is UP



tus is UP



tus is DOWN



tus is DOWN



tus is DOWN



tus is UNKNOWN

126 |



tus is UNKNOWN



tus is UNKNOWN


Network Monitor: Host %s sta‐

tus is UNKNOWN



tus is UNKNOWN



tus is UNKNOWN

1104 5.9.0 ‐‐‐ Network Monitor INFO ‐‐‐

Network Monitor Policy %s

Added



Added



Added



Deleted



Deleted



Deleted



Modified



Modified



Modified

1107 5.9.0 System Error Firewall Event ALERT ‐‐‐ %s



1108 5.9.0 ‐‐‐ Anti‐Spam INFO ‐‐‐

Message blocked by Real‐Time

E‐mail Scanner

1108 6.0.5 ‐‐‐ Anti‐Spam INFO ‐‐‐


E‐mail Scanner

1108 6.2.0 ‐‐‐ Anti‐Spam INFO ‐‐‐


E‐mail Scanner

1109 5.9.0 ‐‐‐ VPN PKI INFO ‐‐‐ CSR Generation: %s




1110 5.9.0 ‐‐‐ DHCP Server INFO ‐‐‐ Assigned IP address %s



1111 5.9.0 ‐‐‐ DHCP Server INFO ‐‐‐ Released IP address %s



1112 5.9.0 ‐‐‐ FTP DEBUG ‐‐‐

FTP server accepted the con‐

nection

1112 6.0.5 ‐‐‐ FTP DEBUG ‐‐‐


nection

1112 6.2.0 ‐‐‐ FTP DEBUG ‐‐‐


nection

1113 5.9.0 ‐‐‐ FTP DEBUG ‐‐‐ FTP client user name was sent



1114 5.9.0 ‐‐‐ FTP DEBUG ‐‐‐

FTP client user logged in suc‐

cessfully

1114 6.0.5 ‐‐‐ FTP DEBUG ‐‐‐


cessfully

1114 6.2.0 ‐‐‐ FTP DEBUG ‐‐‐


cessfully

1115 5.9.0 ‐‐‐ FTP DEBUG ‐‐‐ FTP client user logged in failed



1116 5.9.0 ‐‐‐ FTP DEBUG ‐‐‐ FTP client user logged out




Authenticated


User login denied ‐ SSO probe

failed


Authenticated



failed


Authenticated



failed


Authenticated


User login denied ‐ Mail

Address(From/to) or SMTP

Server is not configured

128 |


Authenticated






Authenticated






Authenticated


RADIUS user cannot use One

Time Password ‐ no mail

address set for equivalent local

user


Authenticated





user


Authenticated





user


Authenticated


User login denied ‐ Terminal

Services agent Timeout


Authenticated





Authenticated





Authenticated



Services agent name resolution

failed


Authenticated




failed


Authenticated




failed


Authenticated


User login denied ‐ No name

received from Terminal Services

agent


Authenticated




agent



Authenticated




agent


Authenticated



Services agent communication

problem


Authenticated




problem


Authenticated




problem


Authenticated



reported by Terminal Services

agent


Authenticated




agent


Authenticated




agent

1125 5.9.0 User Activity High Availability INFO ‐‐‐

High Availability has been

enabled, Dial‐Up device(s) are

not supported in High Availabil‐

ity processing.





ity processing.

1125 6.2.0 User Activity High Availability INFO ‐‐‐




ity processing.

1126 5.9.0 User Activity High Availability ERROR ‐‐‐

The High Availability monitoring

IP configuration of Interface %s

is incorrect.

1126 6.0.5 ‐‐‐ High Availability ERROR ‐‐‐



is incorrect.

130 |

1126 6.2.0 User Activity High Availability ERROR ‐‐‐



is incorrect.


IKE Responder: ESP mode mis‐

match Local ‐ Tunnel Remote ‐

Transport




Transport




Transport



match Local ‐ Transport

Remote ‐ Tunnel




Remote ‐ Tunnel




Remote ‐ Tunnel

1131 5.9.0 ‐‐‐ Anti‐Spam DEBUG ‐‐‐ Probe Response Success ‐ %s



1132 5.9.0 ‐‐‐ Anti‐Spam DEBUG ‐‐‐ Probe Response Failure ‐ %s



1133 5.9.0 ‐‐‐ PPPoE INFO ‐‐‐ %s

1133 6.0.5 ‐‐‐ PPPoE INFO ‐‐‐ %s

1133 6.2.0 ‐‐‐ PPPoE INFO ‐‐‐ %s

1134 5.9.0 Maintenance PPTP INFO ‐‐‐ %s



1135 5.9.0 Maintenance L2TP Client INFO ‐‐‐ %s



1138 5.9.0 ‐‐‐ Anti‐Spam DEBUG ‐‐‐

Received unauthenticated GRID

response


1138 6.0.5 ‐‐‐ Anti‐Spam DEBUG ‐‐‐


response

1138 6.2.0 ‐‐‐ Anti‐Spam DEBUG ‐‐‐


response

1139 5.9.0 ‐‐‐ Anti‐Spam DEBUG ‐‐‐

Invalid key or serial number

used for GRID response

1139 6.0.5 ‐‐‐ Anti‐Spam DEBUG ‐‐‐



1139 6.2.0 ‐‐‐ Anti‐Spam DEBUG ‐‐‐



1140 5.9.0 ‐‐‐ Anti‐Spam DEBUG ‐‐‐

Invalid key version used for

GRID response

1140 6.0.5 ‐‐‐ Anti‐Spam DEBUG ‐‐‐


GRID response

1140 6.2.0 ‐‐‐ Anti‐Spam DEBUG ‐‐‐


GRID response

1141 5.9.0 ‐‐‐ Anti‐Spam DEBUG ‐‐‐ Host IP address not in GRID List



1142 5.9.0 ‐‐‐ Anti‐Spam DEBUG ‐‐‐

No response received from DNS

server

1142 6.0.5 ‐‐‐ Anti‐Spam DEBUG ‐‐‐


server

1142 6.2.0 ‐‐‐ Anti‐Spam DEBUG ‐‐‐


server

1143 5.9.0 ‐‐‐ Anti‐Spam DEBUG ‐‐‐

Not blacklisted as per configu‐

ration

1143 6.0.5 ‐‐‐ Anti‐Spam DEBUG ‐‐‐


ration

1143 6.2.0 ‐‐‐ Anti‐Spam DEBUG ‐‐‐


ration

1144 5.9.0 ‐‐‐ Anti‐Spam DEBUG ‐‐‐ Default to not blacklisted



1145 5.9.0 ‐‐‐ Anti‐Spam DEBUG ‐‐‐

Failed to insert entry into GRID

result IP cached table

1145 6.0.5 ‐‐‐ Anti‐Spam DEBUG ‐‐‐



132 |

1145 6.2.0 ‐‐‐ Anti‐Spam DEBUG ‐‐‐



1146 5.9.0 ‐‐‐ Anti‐Spam DEBUG ‐‐‐ Resolved ES Cloud ‐ %s



1147 5.9.0 ‐‐‐ Anti‐Spam DEBUG ‐‐‐ Updated ES Cloud Address ‐ %s



1148 5.9.0

Advanced

Switching

Advanced Switch‐

ing INFO ‐‐‐ %s

1148 6.0.5 ‐‐‐

Advanced Switch‐


1148 6.2.0

Advanced

Switching

Advanced Switch‐


1149 5.9.0 ‐‐‐ High Availability WARNING ‐‐‐

Your Active/Active Clustering

subscRIPtion has expired.







1150 5.9.0 User Activity CIA ALERT ‐‐‐ Terminal Services agent is down



1151 5.9.0 User Activity CIA ALERT ‐‐‐ Terminal Services agent is up




Active/Active Clustering license

is not activated on the following

cluster units: %s




cluster units: %s




cluster units: %s

1153 5.9.0

Connection

Traffic SSL VPN INFO ‐‐‐ SSL VPN Traffic

1153 6.0.5

Connection



1153 6.2.0

Connection


1154 5.9.0 ‐‐‐

Application Con‐

trol Detection ALERT 15001

Application Control Detection

Alert: %s

1154 6.0.5 ‐‐‐

Application Con‐



Alert: %s

1154 6.2.0 ‐‐‐

Application Con‐



Alert: %s

1155 5.9.0 ‐‐‐

Application Con‐


Application Control Prevention

Alert: %s

1155 6.0.5 ‐‐‐

Application Con‐



Alert: %s

1155 6.2.0 ‐‐‐

Application Con‐



Alert: %s

1156 5.9.0 ‐‐‐ Firewall Event ERROR ‐‐‐

Name Resolution for Syslog or

GMS failed.



GMS failed.



GMS failed.


Authenticated


User account '%s' expired and

disabled


Authenticated



disabled


Authenticated



disabled


Authenticated



pruned


Authenticated



pruned


Authenticated



pruned

1159 5.9.0 ‐‐‐ Security Services WARNING ‐‐‐

Received Alert: Your Visualiza‐

tion Control subscRIPtion has

expired.




expired.

134 |




expired.

1160 5.9.0 Maintenance Firewall Event DEBUG ‐‐‐

Attempt to contact Remote

backup server for upload

approval failed




approval failed




approval failed


Backup remote server did not

approve upload Request








Modules attached to HA units

do not match: %s



do not match: %s



do not match: %s

1163 5.9.0 ‐‐‐ E1/T1 Status INFO ‐‐‐ E1_T1 Layer 1 status: No signal

1163 6.0.5 ‐‐‐ None INFO ‐‐‐ E1_T1 Layer 1 status: No signal

1163 6.2.0 ‐‐‐ E1/T1 Status INFO ‐‐‐ E1_T1 Layer 1 status: No signal

1164 5.9.0 ‐‐‐ E1/T1 Status INFO ‐‐‐

E1_T1 Layer 1 status: No frame

synchronization

1164 6.0.5 ‐‐‐ None INFO ‐‐‐


synchronization

1164 6.2.0 ‐‐‐ E1/T1 Status INFO ‐‐‐


synchronization

1165 5.9.0 ‐‐‐ E1/T1 Status INFO ‐‐‐

E1_T1 Layer 1 status: No multi‐

frame synchronization

1165 6.0.5 ‐‐‐ None INFO ‐‐‐



1165 6.2.0 ‐‐‐ E1/T1 Status INFO ‐‐‐




1166 5.9.0 ‐‐‐ E1/T1 Status INFO ‐‐‐

E1_T1 Layer 1 status: Remote

alarm detected

1166 6.0.5 ‐‐‐ None INFO ‐‐‐


alarm detected

1166 6.2.0 ‐‐‐ E1/T1 Status INFO ‐‐‐


alarm detected

1167 5.9.0 ‐‐‐ E1/T1 Status INFO ‐‐‐

E1_T1 Layer 1 status: Controlled

slip

1167 6.0.5 ‐‐‐ None INFO ‐‐‐


slip

1167 6.2.0 ‐‐‐ E1/T1 Status INFO ‐‐‐


slip

1168 5.9.0 ‐‐‐ E1/T1 Status INFO ‐‐‐ E1_T1 Layer 1 status: OK

1168 6.0.5 ‐‐‐ None INFO ‐‐‐ E1_T1 Layer 1 status: OK

1168 6.2.0 ‐‐‐ E1/T1 Status INFO ‐‐‐ E1_T1 Layer 1 status: OK

1169 5.9.0 ‐‐‐

Bandwidth Opti‐

mization INFO ‐‐‐

WAN Acceleration device %s

found

1169 6.0.5 ‐‐‐ Unused DEBUG ‐‐‐


found

1169 6.2.0 ‐‐‐

Bandwidth Opti‐



found

1170 5.9.0 ‐‐‐

Bandwidth Opti‐

mization ALERT ‐‐‐

WAN Acceleration device %s is

operational

1170 6.0.5 ‐‐‐ Unused DEBUG ‐‐‐


operational

1170 6.2.0 ‐‐‐

Bandwidth Opti‐



operational

1171 5.9.0 ‐‐‐

Bandwidth Opti‐



no longer operational

1171 6.0.5 ‐‐‐ Unused DEBUG ‐‐‐



1171 6.2.0 ‐‐‐

Bandwidth Opti‐




1172 5.9.0 ‐‐‐

Bandwidth Opti‐



being used

1172 6.0.5 ‐‐‐ Unused DEBUG ‐‐‐


being used

1172 6.2.0 ‐‐‐

Bandwidth Opti‐



being used

136 |

1173 5.9.0 ‐‐‐

Bandwidth Opti‐



no longer being used

1173 6.0.5 ‐‐‐ Unused DEBUG ‐‐‐



1173 6.2.0 ‐‐‐

Bandwidth Opti‐




1174 5.9.0 ‐‐‐

Bandwidth Opti‐

mization WARNING ‐‐‐

Remote WAN Acceleration

device stopped responding to

probes

1174 6.0.5 ‐‐‐ Unused DEBUG ‐‐‐



probes

1174 6.2.0 ‐‐‐

Bandwidth Opti‐




probes

1175 5.9.0 ‐‐‐

Bandwidth Opti‐



device started responding to

probes

1175 6.0.5 ‐‐‐ Unused DEBUG ‐‐‐



probes

1175 6.2.0 ‐‐‐

Bandwidth Opti‐




probes

1176 5.9.0 ‐‐‐

Bandwidth Opti‐


Your WAN Acceleration Service


1176 6.0.5 ‐‐‐ Unused DEBUG ‐‐‐



1176 6.2.0 ‐‐‐

Bandwidth Opti‐




1177 5.9.0 Debug Network Access ALERT ‐‐‐

Malformed DNS packet

detected



detected



detected

1178 5.9.0 User Activity CIA ALERT ‐‐‐

A high percentage of the system

packet buffers are held waiting

for SSO





for SSO




for SSO


A user has a very high number

of connections waiting for SSO







1183 5.9.0 ‐‐‐ VPN IKE DEBUG ‐‐‐ Deleting IPsec SA. (Phase 2)




Delete invalid scope because

port IP in the range of this DHCP

scope.




scope.




scope.

1185 5.9.0 ‐‐‐ DSL ALERT ‐‐‐ DSL: %s Device Up



1186 5.9.0 ‐‐‐ DSL ALERT ‐‐‐ DSL: %s Device Down



1187 5.9.0 ‐‐‐ DSL ALERT ‐‐‐ DSL: %s WAN is connected



1188 5.9.0 ‐‐‐ DSL ALERT ‐‐‐ DSL: %s WAN is initializing



1189 5.9.0 ‐‐‐ VPN IKE WARNING ‐‐‐

IKE Responder: Peer's pro‐

posed network does not match

VPN Policy's Network

138 |

1189 6.0.5 ‐‐‐ VPN IKE WARNING ‐‐‐




1189 6.2.0 ‐‐‐ VPN IKE WARNING ‐‐‐




1190 5.9.0 ‐‐‐ RADIUS INFO ‐‐‐

Added new LDAP mirror user

group: %s

1190 6.0.5 ‐‐‐ RADIUS INFO ‐‐‐


group: %s

1190 6.2.0 ‐‐‐ RADIUS INFO ‐‐‐


group: %s

1191 5.9.0 ‐‐‐ RADIUS INFO ‐‐‐

Deleted LDAP mirror user

group: %s

1191 6.0.5 ‐‐‐ RADIUS INFO ‐‐‐


group: %s

1191 6.2.0 ‐‐‐ RADIUS INFO ‐‐‐


group: %s

1192 5.9.0 ‐‐‐ RADIUS INFO ‐‐‐

Added a new member to an

LDAP mirror user group

1192 6.0.5 ‐‐‐ RADIUS INFO ‐‐‐



1192 6.2.0 ‐‐‐ RADIUS INFO ‐‐‐



1193 5.9.0 ‐‐‐ RADIUS INFO ‐‐‐

Removed a member from an


1193 6.0.5 ‐‐‐ RADIUS INFO ‐‐‐



1193 6.2.0 ‐‐‐ RADIUS INFO ‐‐‐




Monitoring probe out interface

mismatch %s



mismatch %s



mismatch %s

1195 5.9.0

Security Ser‐

vices Security Services WARNING ‐‐‐

Received Alert: Your Firewall

Botnet Filter subscRIPtion has

expired.


1195 6.0.5

Security Ser‐




expired.

1195 6.2.0

Security Ser‐




expired.


Product maximum entries

reached ‐ %s



reached ‐ %s



reached ‐ %s

1197 5.9.0 ‐‐‐ Network Access NOTICE ‐‐‐ Nat Mapping



1198 5.9.0 ‐‐‐ GeoIP ALERT ‐‐‐

Initiator from country blocked:

%s

1198 6.0.5 ‐‐‐ GeoIP ALERT ‐‐‐


%s

1198 6.2.0 ‐‐‐ GeoIP ALERT ‐‐‐


%s

1199 5.9.0 ‐‐‐ GeoIP ALERT ‐‐‐

Responder from country

blocked: %s

1199 6.0.5 ‐‐‐ GeoIP ALERT ‐‐‐


blocked: %s

1199 6.2.0 ‐‐‐ GeoIP ALERT ‐‐‐


blocked: %s

1200 5.9.0 ‐‐‐ Botnet ALERT ‐‐‐

Suspected Botnet initiator

blocked: %s

1200 6.0.5 ‐‐‐ Botnet ALERT ‐‐‐


blocked: %s

1200 6.2.0 ‐‐‐ Botnet ALERT ‐‐‐


blocked: %s

1201 5.9.0 ‐‐‐ Botnet ALERT ‐‐‐

Suspected Botnet responder

blocked: %s

1201 6.0.5 ‐‐‐ Botnet ALERT ‐‐‐


blocked: %s

1201 6.2.0 ‐‐‐ Botnet ALERT ‐‐‐


blocked: %s

140 |


Authenticated

Access INFO ‐‐‐ %s


Authenticated



Authenticated



Authenticated

Access WARNING ‐‐‐ %s


Authenticated



Authenticated



Authenticated

Access ERROR ‐‐‐ %s


Authenticated



Authenticated


1205 5.9.0 System Error High Availability ALERT ‐‐‐

On HA peer firewall, Interface

%s Link Is Up



%s Link Is Up



%s Link Is Up



%s Link Is Down



%s Link Is Down



%s Link Is Down

1207 5.9.0 Maintenance High Availability INFO ‐‐‐

Peer firewall has reduced link

status. In event of failover, it

will operate with limited capa‐

bility.





bility.






bility.


Peer firewall has equivalent link


will operate with equal capabil‐

ity.





ity.





ity.

1209 5.9.0 Attack MacIP Spoof ALERT ‐‐‐

MAC‐IP Anti‐spoof check

enforced for hosts



enforced for hosts



enforced for hosts


MAC‐IP Anti‐spoof cache not

found for this router








MAC‐IP Anti‐spoof cache found,

but it is not a router









but it is blacklisted device







142 |

1213 5.9.0 Attack

Intrusion Detec‐


Possible UDP flood attack

detected

1213 6.0.5 Attack

Intrusion Detec‐



detected

1213 6.2.0 Attack

Intrusion Detec‐



detected

1214 5.9.0 Attack

Intrusion Detec‐


Possible ICMP flood attack

detected

1214 6.0.5 Attack

Intrusion Detec‐



detected

1214 6.2.0 Attack

Intrusion Detec‐



detected


DHCP INFORM received from

remote device



remote device



remote device

1216 5.9.0 ‐‐‐ ‐‐‐ DEBUG ‐‐‐ IP Pool of the VPN Policy is Full



1217 5.9.0 ‐‐‐ ‐‐‐ DEBUG ‐‐‐

IP Pool of the VPN Policy is Not

Configured

1217 6.0.5 ‐‐‐ ‐‐‐ DEBUG ‐‐‐


Configured

1217 6.2.0 ‐‐‐ ‐‐‐ DEBUG ‐‐‐


Configured

1218 5.9.0 ‐‐‐ ‐‐‐ INFO ‐‐‐

MOBIKE: Update Peer Gateway

IP

1218 6.0.5 ‐‐‐ ‐‐‐ INFO ‐‐‐


IP

1218 6.2.0 ‐‐‐ ‐‐‐ INFO ‐‐‐


IP

1219 5.9.0 ‐‐‐ ‐‐‐ INFO ‐‐‐ IP Address is allocated for Client



1220 5.9.0 ‐‐‐ ‐‐‐ WARNING ‐‐‐ Invalid SNMP packet




1221 5.9.0 ‐‐‐ ‐‐‐ WARNING ‐‐‐ Invalid SNMPv3 engineID



1222 5.9.0 ‐‐‐ ‐‐‐ WARNING ‐‐‐ Invalid SNMPv3 User



1223 5.9.0 ‐‐‐ ‐‐‐ WARNING ‐‐‐ Invalid SNMPv3 Time Window



1225 5.9.0 ‐‐‐ ‐‐‐ INFO ‐‐‐ SNMP Packet Dropped



1226 5.9.0 ‐‐‐ ‐‐‐ INFO ‐‐‐ HTTPS Handshake: %s



1227 5.9.0 User Activity ‐‐‐ INFO ‐‐‐ Guest traffic quota exceeded



1229 5.9.0

TCP | UDP |

ICMP ‐‐‐ WARNING ‐‐‐

Packet dropped by wireless

Advanced IDP

1229 6.0.5

TCP | UDP |



Advanced IDP

1229 6.2.0

TCP | UDP |



Advanced IDP

1230 5.9.0 UDP ‐‐‐ NOTICE ‐‐‐

Failed on updating time from

NTP server

1230 6.0.5 UDP ‐‐‐ NOTICE ‐‐‐


NTP server

1230 6.2.0 UDP ‐‐‐ NOTICE ‐‐‐


NTP server

1231 5.9.0 UDP ‐‐‐ NOTICE ‐‐‐

Time update from NTP server

was successful

1231 6.0.5 UDP ‐‐‐ NOTICE ‐‐‐

Succeed in updating time from

NTP server

1231 6.2.0 UDP ‐‐‐ NOTICE ‐‐‐

Time update from NTP server

was successful

1232 5.9.0 UDP ‐‐‐ NOTICE ‐‐‐ NTP Request sent


144 |


1233 5.9.0 Debug ‐‐‐ NOTICE ‐‐‐

Unhandled link‐local or multi‐

cast IPv6 packet dropped

1233 6.0.5 Debug ‐‐‐ ALERT ‐‐‐



1233 6.2.0 Debug ‐‐‐ NOTICE ‐‐‐



1235 5.9.0 ‐‐‐ Network INFO ‐‐‐ Packet allowed by Access Rules

1235 6.0.5 ‐‐‐ Network INFO ‐‐‐ Packet allowed

1235 6.2.0 ‐‐‐ Network INFO ‐‐‐ Packet allowed: %s

1236 5.9.0 ‐‐‐ Security Services DEBUG ‐‐‐

Received Blacklisted Directive

from ‐ %s



from ‐ %s



from ‐ %s

1237 5.9.0 ‐‐‐ Security Services DEBUG ‐‐‐ Not Blacklisted by domain ‐ %s




No DNS response to domain ‐

%s



%s



%s


RBL DNS server responded with

error code ‐ %s



error code ‐ %s



error code ‐ %s

1240 5.9.0 ‐‐‐ ‐‐‐ INFO ‐‐‐ %s

1240 6.0.5 ‐‐‐ ‐‐‐ INFO ‐‐‐ %s

1240 6.2.0 ‐‐‐ ‐‐‐ INFO ‐‐‐ %s

1241 5.9.0 ‐‐‐ ‐‐‐ WARNING ‐‐‐ %s

1241 6.0.5 ‐‐‐ ‐‐‐ WARNING ‐‐‐ %s

1241 6.2.0 ‐‐‐ ‐‐‐ WARNING ‐‐‐ %s

1242 5.9.0 ‐‐‐ ‐‐‐ WARNING ‐‐‐ %s


1242 6.0.5 ‐‐‐ ‐‐‐ WARNING ‐‐‐ %s

1242 6.2.0 ‐‐‐ ‐‐‐ WARNING ‐‐‐ %s


Authenticated


User login Failed ‐ An error has

occurred while sending your

one‐time password


Authenticated




one‐time password


Authenticated




one‐time password

1244 5.9.0 ‐‐‐ RADIUS WARNING ‐‐‐

Failed to add an LDAP mirror

user group

1244 6.0.5 ‐‐‐ RADIUS WARNING ‐‐‐


user group

1244 6.2.0 ‐‐‐ RADIUS WARNING ‐‐‐


user group

1245 5.9.0 ‐‐‐ RADIUS WARNING ‐‐‐

Failed to add a member to an


1245 6.0.5 ‐‐‐ RADIUS WARNING ‐‐‐



1245 6.2.0 ‐‐‐ RADIUS WARNING ‐‐‐



1246 5.9.0 ‐‐‐ RADIUS WARNING ‐‐‐

An LDAP user group nesting is

not being mirrored

1246 6.0.5 ‐‐‐ RADIUS WARNING ‐‐‐


not being mirrored

1246 6.2.0 ‐‐‐ RADIUS WARNING ‐‐‐


not being mirrored

1247 5.9.0 ‐‐‐ Firewall Hardware ALERT 17001

Physical interface utilization is

greater than 80% of the maxi‐

mum rated tolerance(for the

interface)for more than 10 sec‐

onds.






onds.

146 |






onds.


CPU reaches 80% utilization for

more than 10 seconds.








Current session count is more

than 50% of the supported

maximum.




maximum.




maximum.


Current dynamic NAT transla‐

tion count is more than 50% of

the configured maximum.


Total firewall throughput is


mum rated tolerance for more

than 10 seconds.









than 10 seconds.









than 10 seconds.


1252 5.9.0 ‐‐‐ VPN IKE INFO ‐‐‐

IPv6 VPN only support IKEv2

mode

1252 6.0.5 ‐‐‐ VPN IKE INFO ‐‐‐


mode

1252 6.2.0 ‐‐‐ VPN IKE INFO ‐‐‐


mode

1253 5.9.0 ‐‐‐ VPN IKE NOTICE ‐‐‐ IPv6 Tunnel packet dropped



1254 5.9.0 ‐‐‐ Network NOTICE ‐‐‐

ICMPv6 packet from LAN

dropped

1254 6.0.5 ‐‐‐ Network NOTICE ‐‐‐


dropped

1254 6.2.0 ‐‐‐ Network NOTICE ‐‐‐


dropped

1255 5.9.0 ‐‐‐ Network INFO ‐‐‐


allowed

1255 6.0.5 ‐‐‐ Network INFO ‐‐‐


allowed

1255 6.2.0 ‐‐‐ Network INFO ‐‐‐


allowed

1256 5.9.0 ‐‐‐ Network INFO ‐‐‐ ICMPv6 packet allowed



1257 5.9.0 ‐‐‐ Network NOTICE ‐‐‐

ICMPv6 packet dropped due to

policy

1257 6.0.5 ‐‐‐ Network NOTICE ‐‐‐


policy

1257 6.2.0 ‐‐‐ Network NOTICE ‐‐‐


policy

1258 5.9.0 ‐‐‐ ‐‐‐ DEBUG ‐‐‐ %s

1258 6.0.5 ‐‐‐ ‐‐‐ DEBUG ‐‐‐ %s

1258 6.2.0 ‐‐‐ ‐‐‐ DEBUG ‐‐‐ %s


DHCPv6 lease file in the storage

is corrupted; read failed







148 |


Failed to write DHCPv6 leases

to storage



to storage



to storage


DHCPv6 leases written to stor‐

age



age



age

1262 5.9.0 ‐‐‐ Network Access DEBUG ‐‐‐ YouTube for school enforced



1263 5.9.0 Maintenance AppServerEvent INFO ‐‐‐ AppFlow Server Event

1263 6.0.5 ‐‐‐ Unused INFO ‐‐‐ Appflow Server Event

1263 6.2.0 ‐‐‐ Unused INFO ‐‐‐ Appflow Server Event

1264 5.9.0 ‐‐‐

Bandwidth Opti‐


WLAN HTTP traffic not being

sent to WXA WebCache; zone

conflict

1264 6.0.5 ‐‐‐

Bandwidth Opti‐




conflict

1264 6.2.0 ‐‐‐

Bandwidth Opti‐




conflict

1265 5.9.0 ‐‐‐ Firewall Event WARNING ‐‐‐

SonicPoint association request

to License Manager failed: %s








SonicPoint association posted

successfully to License Manager











1268 5.9.0

Firewall Set‐

tings Firewall Event NOTICE ‐‐‐ Firmware Update Failed

1268 6.0.5 ‐‐‐ ‐‐‐ NOTICE ‐‐‐ Firmware Update Failed

1268 6.2.0

Firewall Set‐

tings Firewall Event NOTICE ‐‐‐ Firmware Update Failed

1269 5.9.0

Firewall Set‐

tings Firewall Event NOTICE ‐‐‐ Firmware Update Success

1269 6.0.5 ‐‐‐ ‐‐‐ NOTICE ‐‐‐ Firmware Update Success

1269 6.2.0

Firewall Set‐

tings Firewall Event NOTICE ‐‐‐ Firmware Update Success

1270 5.9.0 Maintenance ‐‐‐ INFO ‐‐‐ Crypto DH test success



1271 5.9.0 Maintenance ‐‐‐ INFO ‐‐‐ Crypto Hmac‐MD5 test success



1272 5.9.0 Maintenance ‐‐‐ INFO ‐‐‐

Crypto hardware DES test suc‐

cess



cess



cess

1273 5.9.0 Maintenance ‐‐‐ INFO ‐‐‐ Crypto MD5 test success



1274 5.9.0 ‐‐‐ ‐‐‐ INFO ‐‐‐


test success

1274 6.0.5 ‐‐‐ ‐‐‐ INFO ‐‐‐


test success

1274 6.2.0 ‐‐‐ ‐‐‐ INFO ‐‐‐


test success

1275 5.9.0 Maintenance ‐‐‐ INFO ‐‐‐ Crypto Hmac‐Sha1 test success



150 |


Crypto hardware 3DES test suc‐

cess



cess



cess

1277 5.9.0 Maintenance ‐‐‐ INFO ‐‐‐ Crypto DES test success



1278 5.9.0 Maintenance ‐‐‐ ERROR ‐‐‐ Crypto AES test failed



1279 5.9.0 Maintenance ‐‐‐ INFO ‐‐‐ Crypto AES test success



1280 5.9.0 Maintenance ‐‐‐ INFO ‐‐‐ Crypto DRBG test success



1281 5.9.0 Maintenance ‐‐‐ ERROR ‐‐‐ Crypto DRBG test failed




Crypto Hmac‐Sha256 test suc‐

cess



cess



cess

1283 5.9.0 Maintenance ‐‐‐ ERROR ‐‐‐ Crypto Hmac‐Sha256 test failed



1284 5.9.0 Maintenance ‐‐‐ INFO ‐‐‐ Crypto RSA test success



1285 5.9.0 Maintenance ‐‐‐ INFO ‐‐‐ Crypto Sha1 test success







1287 5.9.0 Maintenance ‐‐‐ ERROR ‐‐‐ Crypto Sha256 test failed




Crypto hardware AES test suc‐

cess



cess



cess



test success



test success



test success


Crypto hardware 3DES with SHA

test success



test success



test success

1299 5.9.0 Maintenance ‐‐‐ ALERT ‐‐‐

Ndpp SelfTest write/read

encrypt/decrypt successsfully









encrypt/decrypt failure








Source or Destination IPv6

address is reserved by RFC

4291. Packet is dropped

152 |










Destination IPv6 address is

unspecified. Packet is dropped








Source IPv6 address is unspeci‐

fied but this packet is not

Neighbor Solicitation message

for DAD. Packet is dropped












Packet is dropped due to NDPP

rules.



rules.



rules.


IKE Responder : VPN Policy for

IKE ID not found



IKE ID not found



IKE ID not found



gateway address not found









IKE Initiator : VPN Policy for IKE

ID not found



ID not found



ID not found


IKE Initiator : VPN Policy for









HA association request to

License Manager failed: %s








HA association posted success‐

fully to License Manager








DHCP Server: Resources of this

pool ran out. Client Info: %s







1312 5.9.0 ‐‐‐ VPN IKE INFO ‐‐‐

IKEv2: Peer's IP Version of Traf‐

fic Selector does not match with

ours

1312 6.0.5 ‐‐‐ VPN IKE INFO ‐‐‐



ours

154 |

1312 6.2.0 ‐‐‐ VPN IKE INFO ‐‐‐



ours

1313 5.9.0 ‐‐‐ ‐‐‐ INFO ‐‐‐ NAT policy added



1314 5.9.0 ‐‐‐ ‐‐‐ INFO ‐‐‐ NAT policy modified



1315 5.9.0 ‐‐‐ ‐‐‐ INFO ‐‐‐ NAT policy deleted



1316 5.9.0 ‐‐‐ Network ALERT ‐‐‐

Possible ARP attack from MAC

address %s

1316 6.0.5 ‐‐‐ Network ALERT ‐‐‐


address %s

1316 6.2.0 ‐‐‐ Network ALERT ‐‐‐


address %s

1317 5.9.0 ‐‐‐ Firewall Hardware ALERT 5426 %s























IKEv2 Received Dead Peer

Detection Request



Detection Request



Detection Request



Detection Response



Detection Response



Detection Response


IKEv2 Send Dead Peer Detection

Request



Request



Request



Response



Response



Response

1328 5.9.0 User Activity VPN IKE INFO ‐‐‐ IKEv2 Send Invalid SPI Request




IKEv2 Received Invalid SPI

Request



Request



Request

1330 5.9.0 User Activity VPN IKE INFO ‐‐‐ IKEv2 Send Invalid SPI Response



156 |



Response



Response



Response

1332 5.9.0 Maintenance Firewall Event ALERT ‐‐‐ NDPP mode is changed to %s




Authenticated



Authenticated



Authenticated



Authenticated



Authenticated



Authenticated



Authenticated



Authenticated



Authenticated


1336 5.9.0

Firewall Set‐

tings Firewall Event INFO ‐‐‐ Certification %s

1336 6.0.5

Firewall Set‐


1336 6.2.0

Firewall Set‐


1337 5.9.0

Firewall Set‐

tings Firewall Event INFO ‐‐‐ %s

1337 6.0.5

Firewall Set‐


1337 6.2.0

Firewall Set‐



1338 5.9.0

Firewall Set‐

tings Firewall Event INFO ‐‐‐ User %s password is changed

1338 6.0.5

Firewall Set‐


1338 6.2.0

Firewall Set‐


1339 5.9.0

Firewall Set‐

tings Firewall Event INFO ‐‐‐ Password rule %s is changed

1339 6.0.5

Firewall Set‐


1339 6.2.0

Firewall Set‐


1340 5.9.0

Firewall Set‐

tings Firewall Event INFO ‐‐‐

User Inactive timeout is

changed to %s

1340 6.0.5

Firewall Set‐



changed to %s

1340 6.2.0

Firewall Set‐



changed to %s


Authenticated



Authenticated



Authenticated



Authenticated


Update administrator/user

lockout params ‐ %s


Authenticated





Authenticated




1343 5.9.0 User Activity VPN INFO ‐‐‐ VPN Policy %s



1344 5.9.0 System Error Firewall Event INFO ‐‐‐ %s



1345 5.9.0 ‐‐‐ Crypto Test INFO ‐‐‐ Crypto Sha384 test success



158 |

1346 5.9.0 ‐‐‐ Crypto Test ERROR ‐‐‐ Crypto Sha384 test failed









1349 5.9.0 ‐‐‐ Crypto Test INFO ‐‐‐ Crypto Ikev1 test success



1350 5.9.0 ‐‐‐ Crypto Test ERROR ‐‐‐ Crypto Ikev1 test failed









1353 5.9.0 ‐‐‐ Crypto Test INFO ‐‐‐ Crypto SSH test success



1354 5.9.0 ‐‐‐ Crypto Test ERROR ‐‐‐ Crypto SSH test failed



1355 5.9.0 ‐‐‐ Crypto Test INFO ‐‐‐ Crypto SNMP test success



1356 5.9.0 ‐‐‐ Crypto Test ERROR ‐‐‐ Crypto SNMP test failed



1357 5.9.0 ‐‐‐ Crypto Test INFO ‐‐‐ Crypto TLS 1.0/1.1 test success



1358 5.9.0 ‐‐‐ Crypto Test ERROR ‐‐‐ Crypto TLS 1.0/1.1 test failed




1359 5.9.0 ‐‐‐ Crypto Test INFO ‐‐‐


cess



cess



cess

1360 5.9.0 ‐‐‐ Crypto Test ERROR ‐‐‐ Crypto Hmac‐Sha384 test failed





cess



cess



cess




1363 5.9.0

802.11b Man‐

agement Wireless ALERT ‐‐‐ Wireless Flood Attack

1363 6.0.5

802.11b Man‐

agement Wireless ALERT ‐‐‐ Wireless Flood Attacking

1363 6.2.0

802.11b Man‐

agement Wireless ALERT ‐‐‐ Wireless Flood Attack

1364 5.9.0 ‐‐‐ VPN PKI ALERT ‐‐‐ Cert Payload processing failed



1365 5.9.0 ‐‐‐ DPI‐SSL NOTICE ‐‐‐ DPI‐SSL: %s



1366 5.9.0 Attack

Intrusion Detec‐


TCP‐Flooding machine %s black‐

listed

1366 6.0.5 Attack

Intrusion Detec‐



listed

1366 6.2.0 Attack

Intrusion Detec‐



listed

160 |

1367 5.9.0 Attack

Intrusion Detec‐


TCP Flood Blacklist on IF %s con‐

tinues

1367 6.0.5 Attack

Intrusion Detec‐



tinues

1367 6.2.0 Attack

Intrusion Detec‐



tinues

1368 5.9.0 Attack

Intrusion Detec‐


Machine %s removed from TCP

flood blacklist

1368 6.0.5 Attack

Intrusion Detec‐



flood blacklist

1368 6.2.0 Attack

Intrusion Detec‐



flood blacklist

1369 5.9.0 Attack

Intrusion Detec‐

tion ALERT ‐‐‐ Possible TCP Flood on IF %s

1369 6.0.5 Attack

Intrusion Detec‐


1369 6.2.0 Attack

Intrusion Detec‐


1370 5.9.0 Attack

Intrusion Detec‐


Possible TCP Flood on IF %s has

ceased

1370 6.0.5 Attack

Intrusion Detec‐



ceased

1370 6.2.0 Attack

Intrusion Detec‐



ceased

1371 5.9.0 Attack

Intrusion Detec‐


Possible TCP Flood on IF %s con‐

tinues

1371 6.0.5 Attack

Intrusion Detec‐



tinues

1371 6.2.0 Attack

Intrusion Detec‐



tinues

1372 5.9.0 ‐‐‐ RADIUS WARNING ‐‐‐

LDAP mirroring overflow: too

many user groups

1372 6.0.5 ‐‐‐ RADIUS WARNING ‐‐‐


many user groups

1372 6.2.0 ‐‐‐ RADIUS WARNING ‐‐‐


many user groups

1373 5.9.0 Attack

Intrusion Detec‐


IPv6 fragment dropped, invalid

length (<1280 Bytes)


1373 6.0.5 Attack

Intrusion Detec‐




1373 6.2.0 Attack

Intrusion Detec‐




1374 5.9.0 Attack

Intrusion Detec‐


IGMP packet dropped, incom‐

plete fragments

1374 6.0.5 Attack

Intrusion Detec‐



plete fragments

1374 6.2.0 Attack

Intrusion Detec‐



plete fragments

1375 5.9.0 Attack

Intrusion Detec‐


UDP fragment dropped,

exceeds maximum IP datagram

size (>65535)

1375 6.0.5 Attack

Intrusion Detec‐




size (>65535)

1375 6.2.0 Attack

Intrusion Detec‐




size (>65535)

1376 5.9.0 Attack

Intrusion Detec‐


Nestea/Teardrop attack

dropped

1376 6.0.5 Attack

Intrusion Detec‐



dropped

1376 6.2.0 Attack

Intrusion Detec‐



dropped

1377 5.9.0 ‐‐‐ Anti‐Spam ALERT ‐‐‐

SHLO verification failed with

this client IP ‐ %s

1377 6.0.5 ‐‐‐ Anti‐Spam ALERT ‐‐‐



1377 6.2.0 ‐‐‐ Anti‐Spam ALERT ‐‐‐



1378 5.9.0 ‐‐‐ Anti‐Spam ALERT ‐‐‐

Possible replay attack with this

client IP ‐ %s

1378 6.0.5 ‐‐‐ Anti‐Spam ALERT ‐‐‐


client IP ‐ %s

1378 6.2.0 ‐‐‐ Anti‐Spam ALERT ‐‐‐


client IP ‐ %s

1379 5.9.0 ‐‐‐

Bandwidth Opti‐


WXA association request to


162 |

1379 6.0.5 ‐‐‐ Unused WARNING ‐‐‐



1379 6.2.0 ‐‐‐

Bandwidth Opti‐




1380 5.9.0 ‐‐‐

Bandwidth Opti‐


WXA association posted suc‐

cessfully to License Manager

1380 6.0.5 ‐‐‐ Unused INFO ‐‐‐



1380 6.2.0 ‐‐‐

Bandwidth Opti‐




1381 5.9.0 ‐‐‐ Security Services WARNING 15003

Received App‐Control Alert:

Your Application Control sub‐










1382 5.9.0 User Activity Unused INFO 5609 Configuration succeeded: %s

1382 6.0.5 User Activity Unused INFO 5609 Configuration succeeded: %s

1382 6.2.0 User Activity Firewall Logging INFO 5609 Configuration succeeded: %s

1383 5.9.0 User Activity Unused INFO 5610 Configuration failed: %s

1383 6.0.5 User Activity Unused INFO 5610 Configuration failed: %s

1383 6.2.0 User Activity Firewall Logging INFO 5610 Configuration failed: %s



invalid Timestamps option


1384 6.0.5 Debug Unused DEBUG ‐‐‐










wrapped sequence number;

TCP packet dropped

1385 6.0.5 Debug Unused DEBUG ‐‐‐



TCP packet dropped





TCP packet dropped

1387 5.9.0 Attack

Intrusion Detec‐

tion ALERT ‐‐‐ TCP Null Flag dropped

1387 6.0.5 Attack

Intrusion Detec‐


1387 6.2.0 Attack

Intrusion Detec‐


1388 5.9.0 Attack VPN IPsec ALERT ‐‐‐ IPSec VPN Decryption Failed





out Client CF agent installed

1389 6.0.5 Maintenance Unused INFO ‐‐‐







Client CF agent out‐of‐date on

host

1390 6.0.5 Maintenance Unused INFO ‐‐‐


host



host

1391 5.9.0 Attack Unused ALERT ‐‐‐ Packet Data

1391 6.0.5 Attack Unused ALERT ‐‐‐ Packet Data

1391 6.2.0 Attack Security Services ALERT ‐‐‐ Packet Data

1392 5.9.0 Maintenance Unused ALERT 5243 Blade up:%s

1392 6.0.5 Maintenance Firewall Event ALERT 5243 Blade up:%s

1392 6.2.0 Maintenance Unused ALERT 5243 Blade up:%s

1393 5.9.0 Maintenance Unused ALERT 5244 Blade down:%s

1393 6.0.5 Maintenance Firewall Event ALERT 5244 Blade down:%s

1393 6.2.0 Maintenance Unused ALERT 5244 Blade down:%s

1394 5.9.0 ‐‐‐

Bandwidth Opti‐

mization ERROR ‐‐‐ WXA Startup Failure ‐ %s

1394 6.0.5 ‐‐‐ Unused ERROR ‐‐‐ WXA Startup Failure ‐ %s

1394 6.2.0 ‐‐‐

Bandwidth Opti‐

mization ERROR ‐‐‐ WXA Startup Failure ‐ %s

164 |

1395 5.9.0 ‐‐‐

Bandwidth Opti‐

mization WARNING ‐‐‐ WXA Get Failure ‐ %s

1395 6.0.5 ‐‐‐ Unused WARNING ‐‐‐ WXA Get Failure ‐ %s

1395 6.2.0 ‐‐‐

Bandwidth Opti‐

mization WARNING ‐‐‐ WXA Get Failure ‐ %s

1396 5.9.0 ‐‐‐

Bandwidth Opti‐

mization NOTICE ‐‐‐ WXA Parse Failure ‐ %s

1396 6.0.5 ‐‐‐ Unused NOTICE ‐‐‐ WXA Parse Failure ‐ %s

1396 6.2.0 ‐‐‐

Bandwidth Opti‐

mization NOTICE ‐‐‐ WXA Parse Failure ‐ %s

1397 5.9.0 ‐‐‐

Bandwidth Opti‐

mization NOTICE ‐‐‐ WXA Register Failure ‐ %s

1397 6.0.5 ‐‐‐ Unused NOTICE ‐‐‐ WXA Register Failure ‐ %s

1397 6.2.0 ‐‐‐

Bandwidth Opti‐

mization NOTICE ‐‐‐ WXA Register Failure ‐ %s

1398 5.9.0 ‐‐‐

Bandwidth Opti‐

mization NOTICE ‐‐‐ WXA Unregister Failure ‐ %s

1398 6.0.5 ‐‐‐ Unused NOTICE ‐‐‐ WXA Unregister Failure ‐ %s

1398 6.2.0 ‐‐‐

Bandwidth Opti‐

mization NOTICE ‐‐‐ WXA Unregister Failure ‐ %s

1399 5.9.0 ‐‐‐

Bandwidth Opti‐

mization NOTICE ‐‐‐ WXA Probe Failure ‐ %s

1399 6.0.5 ‐‐‐ Unused NOTICE ‐‐‐ WXA Probe Failure ‐ %s

1399 6.2.0 ‐‐‐

Bandwidth Opti‐

mization NOTICE ‐‐‐ WXA Probe Failure ‐ %s

1400 5.9.0 ‐‐‐

Bandwidth Opti‐

mization ALERT ‐‐‐ WXA Create Failure ‐ %s

1400 6.0.5 ‐‐‐ Unused ALERT ‐‐‐ WXA Create Failure ‐ %s

1400 6.2.0 ‐‐‐

Bandwidth Opti‐

mization ALERT ‐‐‐ WXA Create Failure ‐ %s

1401 5.9.0 ‐‐‐

Bandwidth Opti‐

mization WARNING ‐‐‐ WXA Set Failure ‐ %s

1401 6.0.5 ‐‐‐ Unused WARNING ‐‐‐ WXA Set Failure ‐ %s

1401 6.2.0 ‐‐‐

Bandwidth Opti‐

mization WARNING ‐‐‐ WXA Set Failure ‐ %s

1402 5.9.0 ‐‐‐

Bandwidth Opti‐

mization ERROR ‐‐‐ WXA Delete Failure ‐ %s

1402 6.0.5 ‐‐‐ Unused ERROR ‐‐‐ WXA Delete Failure ‐ %s


1402 6.2.0 ‐‐‐

Bandwidth Opti‐

mization ERROR ‐‐‐ WXA Delete Failure ‐ %s

1403 5.9.0 ‐‐‐

Bandwidth Opti‐

mization INFO ‐‐‐ WXA Enable ‐ %s

1403 6.0.5 ‐‐‐ Unused INFO ‐‐‐ WXA Enable ‐ %s

1403 6.2.0 ‐‐‐

Bandwidth Opti‐

mization INFO ‐‐‐ WXA Enable ‐ %s

1404 5.9.0 ‐‐‐

Bandwidth Opti‐

mization INFO ‐‐‐ WXA Disable ‐ %s

1404 6.0.5 ‐‐‐ Unused INFO ‐‐‐ WXA Disable ‐ %s

1404 6.2.0 ‐‐‐

Bandwidth Opti‐

mization INFO ‐‐‐ WXA Disable ‐ %s

1405 5.9.0 ‐‐‐

Bandwidth Opti‐

mization WARNING ‐‐‐ WXA Request Failure ‐ %s

1405 6.0.5 ‐‐‐ Unused WARNING ‐‐‐ WXA Request Failure ‐ %s

1405 6.2.0 ‐‐‐

Bandwidth Opti‐

mization WARNING ‐‐‐ WXA Request Failure ‐ %s

1406 5.9.0 ‐‐‐ Unused INFO ‐‐‐

General DHCPv6 Client Informa‐

tion [%s]

1406 6.0.5 ‐‐‐ Unused INFO ‐‐‐


tion [%s]

1406 6.2.0 ‐‐‐ DHCP Client INFO ‐‐‐


tion [%s]

1407 5.9.0 ‐‐‐ Unused DEBUG ‐‐‐

DHCPv6 Client sent message

[%s]

1407 6.0.5 ‐‐‐ Unused DEBUG ‐‐‐


[%s]

1407 6.2.0 ‐‐‐ DHCP Client DEBUG ‐‐‐


[%s]

1408 5.9.0 ‐‐‐ Unused DEBUG ‐‐‐

DHCPv6 Client received mes‐

sage [%s]

1408 6.0.5 ‐‐‐ Unused DEBUG ‐‐‐


sage [%s]



sage [%s]

1409 5.9.0 ‐‐‐ Unused DEBUG ‐‐‐

DHCPv6 Client Duplicate

Address Detection [%s]

1409 6.0.5 ‐‐‐ Unused DEBUG ‐‐‐



166 |




1410 5.9.0 ‐‐‐ Unused DEBUG ‐‐‐

DHCPv6 Client waiting reply

timeout [%s]

1410 6.0.5 ‐‐‐ Unused DEBUG ‐‐‐


timeout [%s]



timeout [%s]

1411 5.9.0 ‐‐‐ Unused DEBUG ‐‐‐ Router Advertisement flags [%s]

1411 6.0.5 ‐‐‐ Unused DEBUG ‐‐‐ Router Advertisement flags [%s]

1411 6.2.0 ‐‐‐ DHCP Client DEBUG ‐‐‐ Router Advertisement flags [%s]

1412 5.9.0 ‐‐‐ Unused INFO ‐‐‐

DHCPv6 Client got a new lease

[%s]

1412 6.0.5 ‐‐‐ Unused INFO ‐‐‐


[%s]



[%s]

1413 5.9.0 ‐‐‐ Unused INFO ‐‐‐

DHCPv6 Client released lease

[%s]

1413 6.0.5 ‐‐‐ Unused INFO ‐‐‐


[%s]



[%s]

1414 5.9.0 ‐‐‐ Unused INFO ‐‐‐

DHCPv6 Server assigned lease

%s

1414 6.0.5 ‐‐‐ Unused INFO ‐‐‐


%s



%s

1415 5.9.0 ‐‐‐ Unused INFO ‐‐‐

DHCPv6 Server released lease

%s

1415 6.0.5 ‐‐‐ Unused INFO ‐‐‐


%s



%s

1416 5.9.0 ‐‐‐ Unused INFO ‐‐‐

DHCPv6 Server received

DHCPv6 Decline from client %s

1416 6.0.5 ‐‐‐ Unused INFO ‐‐‐







1417 5.9.0 ‐‐‐ Unused WARNING ‐‐‐

DHCPv6 Server: Resources of

this pool ran out. Client Info: %s

1417 6.0.5 ‐‐‐ Unused WARNING ‐‐‐






1418 5.9.0 ‐‐‐ Unused INFO ‐‐‐

DHCPv6 Server: Add a new

scope (%s)

1418 6.0.5 ‐‐‐ Unused INFO ‐‐‐


scope (%s)



scope (%s)

1419 5.9.0 ‐‐‐ Unused INFO ‐‐‐

DHCPv6 Server: Delete scope

(%s)

1419 6.0.5 ‐‐‐ Unused INFO ‐‐‐


(%s)



(%s)

1420 5.9.0 ‐‐‐ Unused DEBUG ‐‐‐

DHCPv6 Server received mes‐

sage (%s)

1420 6.0.5 ‐‐‐ Unused DEBUG ‐‐‐


sage (%s)

1420 6.2.0 ‐‐‐ DHCP Server DEBUG ‐‐‐


sage (%s)

1421 5.9.0 ‐‐‐ Unused DEBUG ‐‐‐

DHCPv6 Server sent message

(%s)

1421 6.0.5 ‐‐‐ Unused DEBUG ‐‐‐


(%s)

1421 6.2.0 ‐‐‐ DHCP Server DEBUG ‐‐‐


(%s)

1422 5.9.0 ‐‐‐ Unused WARNING ‐‐‐

IPv6 address conflict detected


1422 6.0.5 ‐‐‐ Unused WARNING ‐‐‐






168 |

Log > SyslogIn addition to the standard event log, the Dell SonicWALL security appliance can send a detailed log to an external Syslog server. The Dell SonicWALL Syslog captures all log activity and includes every connection source and destination IP address, IP service, and number of bytes transferred. Syslog Analyzers such as Dell SonicWALL ViewPoint, Analyzer, or WebTrends Firewall Suite can be used to sort, analyze, and graph the Syslog data.

For more information on configuring the Log > Syslog page, refer to the SonicOS Administrator’s Guide.


Index of Syslog Tag Field DescriptionsThis section provides an alphabetical listing of Syslog tags and the associated field descrip-tion. For more information about the “pri” Syslog Tag, see Table 3: Priority Level on page 182. The value here is taken from the “Priority Level” column of the Index of Log Event Messages on page 2. For more information about the “c” Syslog Tag, see Legacy Category on page 178.

TagTags for Arc-

SightField Description

<ddd>Syslog message prefix

The beginning of each syslog message has a string of the form <ddd> where ddd is a decimal number indicating facility and priority of the message

af_polid Application FilterDisplays the Application Filter Policy ID

af_policy Application Filter Displays the Application Policy name

af_type Application Filter

Displays the Application Policy type such as:

SMTP Client Request

HTTP Client Request

HTTP Server Response

FTP Client Request

FTP Client Upload File

FTP Client Download File

POP3 Client Request

POP3 Server Response

FTP Data Transfer

IPS Content

App Control Content

Custom Policy Type

CFS

af_service Application FilterDisplays the Application Policy service name

170 |

af_action Application Filter

Displays the Application Policy action such as

HTTP Block Page

HTTP Redirect

Bandwidth Management

Disable E-Mail Attachment

FTP Notification Reply

Reset/Drop

Block SMTP E-Mail

Bypass DPI

CFS Block Page

Packet Monitor

af_objectApplication policy object name

Displays the custom Application Policy object name

aiActive Interface via GMS heartbeat

Displays the Active WAN Interface. Normally it is Primary WAN but in a failover, it displays the value of the failover default outbound WAN interface, if there’s more than one WAN. When there is only one WAN interface, it is always Primary WAN regardless of the link state

app appNumeric applica-tion ID

Indicates the application for the applied syslog. Only displays when Flow Reporting is enabled.

appcat appcatApplication Con-trol

Display the application category when Application Control is enabled

appid appid Application IDDisplay the application ID when Appli-cation Control is enabled

appNameNon-Signature Application Name

Indicates the non-signature Application Name that matches the Application ID “app” or “f” of the Syslog.

arg arg URLUsed to render a URL: arg represents the URL path name part

bcastRx bcastRxInterface statis-tics report

Displays the broadcast packets received

bcastTx bcastTxInterface statis-tics report

Displays the broadcast packets trans-mitted

bytesRx bytesRxInterface statis-tics report

Displays the bytes received


bytesTx bytesTxInterface statis-tics report

Displays the bytes transmitted

c catMessage cate-gory (legacy only)

Indicates the legacy category number (Note: We are not currently sending new category information.)

category category Blocking code description

Applicable only when CFS is enabled, indicates the category of the blocked content such as “Gambling”. This works in conjunction with “code” Blocking code.

catid Rule category Indicates the category ID of the rule

cdur cn3LabelConnection Duration

Displays the connection duration

changeSWGMSchan-geUrl

Configuration change webpage

Displays the basename of the firewall web page that performed the last con-figuration change

code reason Blocking code Indicates the CFS block code category

icmpCode cn2ICMP type and code

Indicates the ICMP code

connsFirewall status report via GMS heartbeat

Indicates the number of connections in use

contentOb-ject

Application Filter Indicates rule name

cs4Interface Statis-tics

Display interface statistics

deviceOut-boundInterface

InterfaceIndicates interface on which the packet leaves the device

deviceInbound-Interface

InterfaceIndicates interface on which the packet enters the device

dpt Port Display destination port

dnpt NAT’ed Port Display NAT’ed destination port

dst dst DestinationDestination IP address, and optionally, port, network interface, and resolved name.

dstV6 dst DestinationDestination IPv6 address, and option-ally, port, network interface, and resolved name.

172 |

dstname request URLDisplays the URL of accessed Web-sites and hosts

dstname dstname NotesIndicates additional information such as description of forbidden/deleted email attachments

dstZonecs4Label (desti-nation)

Destination zone name

Displays destination zone

dur cs6labelNumeric, ses-sion duration in seconds

Indicates the duration in units of sec-onds that a session is connected

dynFirewall status report via GMS heartbeat

Displays the HA and dialup connection state (rendered as “h.d” where “h” is “n” (not enabled), “b” (backup), or “p” (pri-mary) and “d” is “1” (enabled) or “0” (disabled))

f flowTypeNumeric flow type

Indicates the flow type when Flow Reporting is disabled

fw Firewall WAN IP Indicates the WAN IP Address

fwlanFirewall status report via GMS heartbeat

Indicates the LAN zone IP address

gcat gcat Group categoryDisplay event group category when using Enhanced Syslog

goodRx-Bytes

goodRxBytesSonicPoint statis-tics report

Indicates the well formed bytes received

goodTx-Bytes

goodTxBytesSonicPoint statis-tics report

Indicates the well formed bytes trans-mitted

iFirewall status report via GMS heartbeat

Displays the GMS message interval in seconds

id=firewallWebTrends pre-fix

Syntactic sugar for WebTrends (and GMS by habit)

if ifInterface statis-tics report

Displays the interface on which statis-tics are reported

ipscat ipscat IPS message Displays the IPS category

ipspri ipspri IPS message Displays the IPS priority

licFirewall status report via GMS heartbeat

Indicates the number of licenses for firewalls with limited modes


m Message ID Provides the message ID number

mac smac or dmac MAC addressProvides the source or destination MAC address

mailFrom Email sender Originator of the email

msg msg Message

Displays the message which is com-posed of either or both a predefined message and a dynamic message con-taining a string %s or numeric %d argu-ment

n cnt Message countIndicates the number of times event occurs

natDst cs2Label NAT destination IP

Displays the NAT’ed destination IP address

natDstV6 cs2Label NAT destination IPv6

Displays the NAT’ed destination IPv6 address

natSrc cs1Label NAT source IP Displays the NAT’ed source IP address

natSrcV6 cs1Label NAT source IPv6Displays the NAT’ed source IPv6 address

note cs6 Additional Information

Additional information that is application-dependent

npcs cs5 URL

Applicable only when Network Packet Capture System (NPCS Solera) is enabled, displays URL of an NPCS object

op requestMethod HTTP OP codeDisplays the HTTP operation (GET, POST, etc.) of web site hit

pri Message priorityDisplays the event priority level (0=emergency..7=debug)

proto protoProtocol and ser-vice

Displays the protocol information (ren-dered as “proto=[protocol]” or just “[proto]/[service]”)

ptFirewall status report via GMS heartbeat

Displays the HTTP/HTTPS manage-ment port (rendered as “hhh.sss”)

radio radioSonicPoint statis-tics report

Displays the SonicPoint radio on which event occurred

rcptTo recipient Indicates the email recipient

174 |

rcvd in Bytes receivedIndicates the number of bytes received within connection

result outcomeHTTP Result code

Displays the HTTP result code (200, 403, etc.) of web site hit

rpkt cn1Label Packet received Display the number of packet received

rule cs1 Rule IDDisplays the Access Rule number causing packet drop. The policy index includes Address Object names

sent out Bytes sentDisplays the number of bytes sent within connection

sess cs5LabelPre-defined string indicating session type

Applies to syslogs with an associated user session being tracked by the UTM

sid sidIPS or Anti-Spy-ware message

Provides either IPS or Anti-Spyware signature ID

snFirewall serial number

Indicates the device serial number

spkt cn2Label Packet sent Display the number of packets sent

spt Port Displays source port

spycat spycatAnti-Spyware message

Displays the Anti-Spyware category

spypri spypriAnti-Spyware message

Displays the Anti-Spyware priority

snpt NAT source port Display NAT’ed source port

src src SourceIndicates the source IP address, and optionally, port, network interface, and resolved name.

srcZonecs3Label (source)

Source zone name

Displays source zone

station stationSonicPoint statis-tics report

Displays the client (station) on which event occurred

time Time Reports the time of event

type cn1ICMP type and code

Indicates the ICMP type

ucastRx ucastRxInterface statis-tics report

Displays the unicast packets received


Examples of Standard Syslogs

The following examples show the content of the Syslog packet. This type of message can be viewed on the Syslog server or any packet analyzer application. Note that this is the Default Syslog Format.

id=firewall123 sn=0017C5991784 time="2013-03-20 11:56:53" fw=10.0.203.108 pri=6 c=1024 m=97 n=1 src=1.2.3.4:5432:X0 dst=4.3.2.1:2345:X1 proto=tcp/2345 op=1 sent=9876 rcvd=6789 result=403 dstname=http: arg=//www.gui.log.eng.sonicwall.com code=20 Category="Online Banking"

id=firewall123 sn=0017C5991784 time="2013-03-20 11:57:04" fw=10.0.203.108 pri=6 c=262144 m=98 msg="Connection Opened" n=1437 usr="admin" src=192.168.168.1:61505:X0 dst=192.168.168.168:443:X0 proto=tcp/https sent=52

id=firewall123 sn=0017C5991784 time="2013-03-20 11:57:06" fw=10.0.203.108 pri=6 c=1024 m=537 msg="Connection Closed" n=3683 usr="admin" src=192.168.168.1:61505:X0 dst=192.168.168.168:443:X0 proto=tcp/https sent=1519 rcvd=951 spkt=7 rpkt=8 cdur=2133

id=firewall123 sn=0017C5991784 time="2013-03-20 11:56:53" fw=10.0.203.108 pri=1 c=32 m=609 msg="IPS Prevention Alert: P2P BitTorrent -- Peer Sync" sid=1994 ipscat=P2P ipspri=3 P2P BitTorrent -- Peer Sync, SID: 1994, Priority: Low n=1 src=1.2.3.4:5432:X0 dst=4.3.2.1:2345:X1

id=firewall123 sn=0017C5991784 time="2013-01-29 23:38:24" bid=1 fw=10.8.70.22 pri=1 c=16 m=793 msg="App Rules Alert" af_polid=1 af_policy="test" af_type="SMTP Client Request" af_service="SMTP (Send E-Mail)" af_action="No Action" n=0 src=10.10.10.245:50613:X0 dst=10.8.41.228:25:X1"

ucastTx ucastTxInterface statis-tics report

Displays the unicast packets transmit-ted

unsynchedFirewall status report via GMS heartbeat

Reports the time since last local change in seconds

usestand-bysa

Firewall status report via GMS heartbeat

Displays whether standby SA is in use (“1” or “0”) for GMS management

usr (or user) susr UserDisplays the user name (“user” is the tag used by WebTrends)

vpnpolicy cs2 (source)Source VPN pol-icy name

Displays the source VPN policy name of event

vpnpoli-cyDst

cs3 (destination)Destination VPN policy name

Displays the destination VPN policy name of event

176 |

id=firewall123 sn=0017C5991784 mgmtip=10.0.203.108 time="2013-03-20 20:14:30 UTC" fw=10.0.203.108 m=96 n=25 i=60 lic=0 unsynched=893 pt=80.443 usestandbysa=0 dyn=n.n ai=1 fwlan=192.168.168.168 conns=0

Examples of ArcSight Syslog

The following examples show the content of the Syslog packet. This type of message can be viewed on the Syslog server or any packet analyzer application.

MAR 20 2013 19:07:43 0017C5991784 CEF:0|SonicWALL|NSA 2400|5.9.0.0-d_75o|97|Syslog Website Accessed|4|cat=1024 gcat=2 src=1.2.3.4 spt=5432 deviceInboundInterface=X0 cs1Label=1.2.4.5 snpt=1 dst=4.3.2.1 dpt=2345 deviceOutboundInterface=X1 cs2Label=5.4.3.2 dnpt=2 proto=tcp/2345 out=9876 in=6789 requestMethod=1 outcome=403 request=http://www.gui.log.eng.sonicwall.com reason=20 Category-"Online Banking"

MAR 20 2013 19:07:49 0017C5991784 CEF:0|SonicWALL|NSA 2400|5.9.0.0-d_75o|98|Syslog Connection Logged|4|cat=262144 gcat=2 src=192.168.168.1 spt=61693 deviceInboundInterface=X0 dst=192.168.168.168 dpt=443 deviceOutboundInterface=X0 susr="admin" proto=tcp/https out=52 cnt=1570

MAR 20 2013 19:07:52 0017C5991784 CEF:0|SonicWALL|NSA 2400|5.9.0.0-d_75o|537|Syslog Close|4|cat=1024 gcat=2 smac=00:00:c5:b3:6b:e5 src=192.168.168.1 spt=61693 deviceInboundInterface=X0 cs3Label=Trusted dst=192.168.168.168 dpt=443 deviceOutboundInterface=X0 cs4Label=Trusted susr="admin" proto=tcp/https out=1519 in=967 cn2Label=7 cn1Label=8 cn3Label=2333 cnt=3815

MAR 20 2013 19:07:43 0017C5991784 CEF:0|SonicWALL|NSA 2400|5.9.0.0-d_75o|609|IDP Prevention Alert|9|cat=32 gcat=3 src=1.2.3.4 spt=5432 deviceInboundInterface=X0 cs1Label=1.2.4.5 snpt=1 dst=4.3.2.1 dpt=2345 deviceOutboundInterface=X1 cs2Label=5.4.3.2 dnpt=2 msg="IPS Prevention Alert: P2P BitTorrent -- Peer Sync, SID: 1994, Priority: Low" cnt=3

MAR 20 2013 19:07:43 0017C5991784 CEF:0|SonicWALL|NSA 2400|5.9.0.0-d_75o|793|Application Firewall Alert|9|cat=16 gcat=10 src=1.2.3.4 spt=5432 deviceInboundInterface=X0 dst=4.3.2.1 dpt=2345 deviceOutboundInterface=X1 msg="Application Firewall Alert: Policy: foobar, Action Type: Block SMTP E-Mail - Send Error Reply, Mail From: an unknown string of unknown length" cnt=3


Table of ValuesThis section can be used as a reference for understanding different categories and their descriptions.

Legacy Categories

The following table describes the Legacy categories shared in all SonicOS releases.

Table 1 Legacy Category

ID (used in Syslog) Name Description

0 Event is not Legacy Category, not backward compatible.

1 System Maintenance Logs general system activity, such as system activations.

2 System Errors Logs problems with DNS or Email.

4 Blocked Web Sites Logs Web sites or news groups blocked by the Content Filter List or by customized filtering.

8 Blocked Java Etc Logs Java, ActiveX, and Cookies blocked by the Dell SonicWALL security appliance.

16 User Activity Logs successful and unsuccessful log in attempts.

32 Attacks Logs messages showing Denial of Service attacks, such as SYN Flood, Ping of Death, and IP Spoofing.

64 Dropped TCP Logs blocked incoming TCP connections.

128 Dropped UDP Logs blocked incoming UDP packets.

256 Dropped ICMP Logs blocked incoming ICMP packets.

512 Network Debug Logs NetBIOS broadcasts, ARP resolution problems, and NAT resolution problems. Also, detailed messages for VPN connections are displayed to assist the network administrator with troubleshooting problems with active VPN tunnels. Network Debug information is intended for experienced network administrators.

1024 Syslog Only — For Traffic Reporting

Used for Syslog only to report HTTP connections opened and closed, and bytes transferred.

2048 Dropped LAN TCP Used for Syslog only to report that the TCP packet is dropped due to LAN management policy.

178 |

Expanded Categories

The following table displays expanded category information, also known as the SonicOS Category, for all firmware releases and platforms.

Table 2 Expanded Categories

4096 Dropped LAN UDP Used for Syslog only to report that the UDP packet is dropped due to LAN management policy.

8192 Dropped LAN ICMP Used for Syslog only to report that the ICMP packet is dropped due to LAN management policy.

32768 Modem Debug Logs Modem Debug activity.

65536 VPN Tunnel Status Logs status information on VPN tunnels.

131072 802.11 Management Logs WLAN IEEE 802.11 connections.

262144 Syslog Only — For Traffic Reporting

Used for Syslog only to report that the Network Traffic is logged when connection is opened.

524288 System Environment Logs system environment activity.

1048576 Expanded — VOIP Activity Used for Syslog only to log VoIP H.323/RAS, H.323/H.225, and H.323/H.245 activity.

2097152 Expanded — WLAN IDS Activity

Used for Syslog only to log WLAN IDS activity.

4194304 Expanded — SonicPoint Activity

Used for Syslog only to log SonicPoint activity.

ID (used in Syslog) Name Description

Category Description

802.11 Management Logs 802.11 management activity

Advanced Routing Logs Advanced Routing activity

Advanced Switching Logs Advanced Switching activity

Anti-Spam Service Logs the Anti-Spam service

App Flow Server Logs App Flow Server activity

App Rules Logs App Rules activity

Application Control Logs Application Control activity

Attacks Logs messages showing Denial of Service attacks, such as SYN Flood, Ping of Death, and IP Spoofing.

Authenticated Access Logs Authenticated Access activity

WAN Acceleration Logs the WAN Acceleration activity

Blocked Java Etc Logs Java, ActiveX, and Cookies blocked

Blocked WebSites Logs Websites blocked


BOOTP Logs Bootstrap Protocol (BOOTP) activity

Botnet Blocking Logs the Botnet Blocking activity

SSO Agent Authentication Logs the SSO Agent Authentication activity

Crypto Test Logs Crypto Test activity

DDNS Logs Dynamic Domain Name System (DDNS) activity

Denied LAN IP Logs LAN IP denied activity

DHCP Client Logs DHCP Client activity

DHCP Relay Logs DHCP Relay activity

DHCP Server Logs DHCP Server activity

DPI-SSL Logs the Deep Packet Inspection of Secure Socket Layer (DPI-SSL) activity

Dropped ICMP Logs blocked incoming Internet Control Message Protocol (ICMP) packet activity

Dropped TCP Logs blocked incoming Transmission Control Protocol (TCP) connection activity

Dropped UDP Logs blocked incoming User Datagram Protocol (UDP) packet activity

DSL Logs DSL activity

Dynamic Address Objects Logs Dynamic Address Object activity

E1-T1 Logs E1-T1 activity

Firewall Event Logs Firewall Event alerts and activity

Firewall Hardware Logs Firewall Hardware alerts and activity

Firewall Logging Logs other Firewall-related activity

Firewall Rule Logs Firewall Rule alerts and activity

FTP Logs File Transfer Protocol (FTP) activity

Geolocation Logs the Geolocation service activity

GMS Logs Dell SonicWALL Global Management System (GMS) activity

High Availability Logs High Availability activity

Intrusion Prevention Logs Intrusion Prevention activity

IPComp Logs IP Compression (IPComp) activity

IPNet Logs IPNet activity

IPv6 Tunnel Logs IPv6 activity

L2TP Client Logs Layer 2 Tunnel Protocol (L2TP) client activity

L2TP Server Logs Layer 2 Tunnel Protocol (L2TP) server activity

MAC-IP Anti-Spoof Logs the MAC-IP Spoofing activity

Modem Logs the Modem activity

Modem Debug Logs the Modem Debug activity

180 |

MSAD Logs Microsoft Active Directory (MSAD) activity

Multicast Logs Multicast activity

Network Logs Network activity

Network Debug Logs NetBios broadcasts, ARP resolution problems, and NAT resolution problems.

Network Access Logs successful and unsuccessful Network Access activity

Network Monitor Logs Network Monitor activity

Network Traffic Logs Network Traffic activity

PPP Logs Point-to-Point Protocol (PPP) activity

PPP Dial-Up Logs Point-to-Point Protocol (PPP) Dial-Up activity

PPPoE Logs Point-to-Point Protocol over Ethernet (PPPoE) activity

PPTP Logs Point-to-Point Tunneling Protocol (PPTP) activity

Remote Authentication Logs Remote Authentication activity

RBL Logs Realtime Black List (RBL) activity

RF Monitoring Logs RF Monitoring activity

RIP Logs Routing Information Protocol (RIP) activity

Security Services Logs Security Services activity

SNMP Logs the Simple Network Management Protocol (SNMP) activity

SonicPoint Logs the SonicPoint activity

SonicPointN Logs the SonicPointN activity

SSLVPN Logs Secure Socket Layer Virtual Private Network (SSLVPN) activity

System Environment Logs System Environment activity

System Errors Logs System Errors activity

System Maintenance Logs System Maintenance activity

User Activity Logs successful and unsuccessful log in attempts

VOIP Logs Voice over IP (VOIP) activity

VPN Logs Virtual Private Network (VPN) activity

VPN Tunnel Status Logs VPN Tunnel Status activity

VPN Client Logs VPN Client activity

VPN IKE Logs VPN IKE activity

VPN IPSec Logs VPN IP Security activity

WAN Availability Logs WAN Availability activity


Priority Level

The following table displays the Priority Number and Name for Syslog Tags. The value here is taken from the “Priority Level” column of the Index of Log Event Messages on page 2, or the “pri” tag in Index of Syslog Tag Field Descriptions on page 170. For example, a tag with “pri=0” means Emergency Priority.

Table 3 Priority Level

Wireless Logs Wireless activity

WLAN IDS Logs Wireless LAN Intrusion Detection System (IDS) activity

Priority Number Priority Name

0 Emergency

1 Alert

2 Critical

3 Error

4 Warning

5 Notice

6 Info

7 Debug

182 |

sonicos 5.9/6.0.5/6.2 log events reference...

Documents