SonicOS Log Event Reference Guide

(1)

COMPREHENSIVE INTERNET SECURITY™

S o n i c WALL Internet Security Ap p l i a n c e s

(2)

Using the SonicOS Log Event

Reference Guide

This reference guide lists and describes SonicOS log event messages. Reference a log event mes-sage by using the alphabetical index of log event mesmes-sages.

This document contains the following sections:

• “SonicOS Log Event Messages Overview” on page 1 • “Configuring SonicOS ‘Log’ > ‘View’” on page 4

• “Referencing the SonicOS ‘Log’ > ‘View ’ Field Display” on page 7 • “Index of Log Event Messages” on page 9

• “Index of Syslog Tag Field Description” on page 63

SonicOS Log Event Messages Overview

During the operation of a SonicWALL security appliance, SonicOS software sends log event mes-sages to the ‘Log’ > ‘View’ page in the SonicWALL management interface.

In Figure 1, the ‘Log’ > ‘View’ page is displayed.

Figure 1 SonicOS Enhanced ‘Log’ > ‘View’ page

Event logging automatically begins when the SonicWALL security appliance is powered on and con-figured. SonicOS supports a traffic log containing entries with multiple fields.

Log event messages provide operational informational and debugging information to help you diag-nose problems with communication lines, internal hardware, or your firmware configuration.

Note: For the SonicOS CLI console display, use the show log command to display log events. Refer

(3)

Note: Not all log event messages indicate operational issues with your SonicWALL security

appliance.

SonicOS Log Entries

Each log entry contains the date and time of the event and a brief message describing the event. The SonicWALL manages log events in the following manner:

• TCP, UDP, or ICMP packets dropped

When IP packets are dropped by the SonicWALL security appliance, dropped TCP, UDP and ICMP messages are displayed. The messages include the source and destination IP addresses of the packet. The TCP or UDP port number or the ICMP code follows the IP address. Log event messages usually include the name of the service in quotation marks.

• Web, FTP, Gopher, or Newsgroup blocked

When a computer attempts to connect to the blocked site or newsgroup, a log event is displayed. Blocked is defined as a Web site, connection, or event that is denied access from the SonicWALL security appliance. The computer’s IP address, Ethernet address, the name of the blocked Web site, and the Content Filter List Code is displayed. Code definitions for the 12 Content Filter List categories are shown below.

• ActiveX, Java, Cookie or Code Archive blocked

When ActiveX, Java or Web cookies are blocked, messages with the source and destination IP addresses of the connection attempt is displayed.

• Ping of Death, IP Spoof, and SYN Flood Attacks

The IP address of the machine under attack and the source of the attack is displayed. In most attacks, the source address shown is fake and does not reflect the real source of the attack.

SonicOS ‘Log View Settings’

The ‘Log View Settings’ section of the ‘Log’ > ‘View’ page provides you the filtering controls to filter log event messages based on your configured log filter logic. It also contains the following log manage-ment buttons:

• Refresh—Renews the ‘Log View’ table with current log event messages. • Clear Log—Empties the entries in the ‘Log View’ table.

• E-mail Log—E-mails log event messages to your configured SMTP server or list of e-mail

addresses.

• Export Log—Exports the log into a plain .txt or .csv file format.

1. Violence 7. Cult

2. Intimate Apparel/Swim-suit

8. Drugs/Illegal Drugs

3. Nudism 9. Criminal Skills/Illegal Skills

4. Adult/Mature Content/ Pornography

10. Sex Education

5. Weapons 11. Gambling

(4)

SonicOS ‘Log View’ Display Format

The ‘Log’ > ‘View’ page displays log event messages in following format for alert notification:

• Time—Displays the hour and minute the event occurred. • Priority—Displays the level urgency for the event. • Category—Displays the event type.

• Message—Displays a description of the event.

• Source—Displays the source IP address of incoming IP packet.

• Destination—Displays the destination IP address of incoming IP packet.

• Note—Displays displays additional information specific to a particular event occurrence.

• Rule—Displays the source and destination zones for the access rule. This field provides a link to

the access rule defined in the ‘Firewall’ > ‘Access Rules’ page.

(5)

Configuring SonicOS ‘Log’ > ‘View’

The ‘Log’ > ‘View” page in the Web-based SonicWALL management interface allows you to export log reports, e-mail log reports, and monitor real-time Syslog data. As soon as you power on your Son-icWALL security appliance, SonicOS software sends Syslog data to your log. In the SonSon-icWALL man-agement interface, you can navigate through the subcategories of the ‘Log’ setting for reporting and customizing log reports.

In Figure 2, the ‘Log’ > ‘View’ page is displayed.

(6)

Setting the Log Filter Logic

By default, the SonicOS filter logic is set to “Priority && Category && Source && Destination.” The double ampersand symbols (&&) indicate the boolean expression “and.” The default SonicOS filter logic displays all log events.

In Figure 3, the ‘Log’ > ‘View’ > ‘Log View Settings’ page is displayed.

Figure 3 SonicOS ‘Log View Settings’

Applying Custom Log Event Message Filters

This section provides examples on using the ‘Log View Settings’ to filter log event messages dis-played in the ‘Log View’ page.

Configuration Example: Filtering Log Event Messages by Priority Value

To set the log filter logic to display only log event messages with a priority level of Emergency: 1. Select Emergency from the filter-Priority Value pull-down menu.

2. Click on the Apply Filters button.

Configuration Example: Filtering Log Event Messages by Category Value

To set the log filter logic to display only log event messages with a category event type of Attacks: 1. Select Attacks from the filter-Category Value pull-down menu.

Apply filters

Reset filters

Export logs Default filter logic

Group filters Default filter logic value

(7)

Configuration Example: Filtering Log Event Messages by Source Value

To set the log filter logic to display only log event messages associated to a source IP address: 1. Enter the source IP address or select an interface from the filter-Source Value pull-down menu. 2. Click on the Apply Filters button.

Configuration Example: Filtering Log Event Messages by Destination Value

To set the log filter logic to display only log event messages associated to a destination IP address: 1. Enter the destination IP address or select an interface from the filter-Source Value pull-down

menu.

Using Group Filters

Use Group filters to change the default SonicOS filter logic (Priority && Category && Source && Des-tination) from double ampersand symbols (&&) to double pipe symbols (||) to indicate the boolean expression “or.” When using group filters, select two or more Group Filters checkboxes.

Note: If you select only one Group Filter checkbox, the filter logic will remain the same. Selecting only

the Priority-Group Filter checkbox provides you with the following filter logic:

(Priority) && Category && Source && Destination

Configuration Example: Using the ‘Priority’ Group Filter and ‘Category Group’ Filter

To set the log filter logic to display log event messages with a priority level of Emergency or a category event type of Attack:

1. Select the ‘Priority’ group filter checkbox. 2. Select the ‘Category’ group filter checkbox.

3. Select Emergency from the filter-Priority Value pull-down menu. 4. Select Attacks from the filter-Category Value pull-down menu. Figure 4 illustrates the SonicOS filter logic updated as follows:

(Priority || Category) && Source && Destination

Figure 4 SonicOS Log Group Filters

(8)

Exporting the Logs to a File

This section provides instructions to export your log to a file. To export the log to a file:

1. Click on the Export Log button. You will be prompted to select a export file format type as illustrated in Figure 5.

Figure 5 SonicOS Export Log

2. Select a file format:

Plain text format used in log and alert e-mail—Saves the log file as plain text, which can be

used for alert e-mails.

Comma-Separated Value (CSV) format—Saves the log file for importing into Microsoft Excel or

other presentation development application. 3. Click on the Export button.

4. Save the exported log file to a location on your personal computer’s hard drive.

Note: You can export a log to a file with applied filter settings.

Referencing the SonicOS ‘Log’ > ‘View ’

Field Display

SonicOS 2.5 Enhanced and Standard releases and greater provide the SonicOS ‘Log’ > ‘View’ field display as illustrated in Figure 6.

Figure 6 SonicOS ‘Log’ > ‘View’ Field Display

Time and DateStamp Priority

Referencing the SonicWALL Firmware ‘Log’ > ‘View Log’ Field Display

SonicWALL Firmware 6.6.0.0 release and greater provide the SonicWALL Firmware ‘Log’ > ‘View Log’ field display as illustrated in Figure 7.

Figure 7 SonicWALL Firmware Log’ > ‘View Log’ Field Display

Time and Date Stamp

Event Message

Source IP Address

Destination IP Address

Additional Information

(10)

Index of Log Event Messages

This section contains a list of log event messages for all SonicWALL Firmware and SonicOS Software Releases, ordered alphabetically. Use your web browser’s Find function to search for a command.

Log Event Message Symbols Key

TCP IP Layered-Data Packet Processing and SonicOS Log Event Handling

In specific cases of multi-layer packet processing, a TCP connection initially logged as "open," will be rejected by a deeper layer of packet processing. In these cases, the connection request has not been forwarded by the SonicWALL security appliance, and the initial Connection Open SonicOS log event message should be ignored in favor of the TCP Connection Dropped log event message.

Each log event message described in the following table provides the following log event details:

• SonicOS Category—Displays the SonicOS Software category event type.

• Legacy Category—Displays the SonicWALL Firmware Software category event type. • Priority Level—Displays the level of urgency of the log event message.

• Log Message ID Number—Displays the ID number of the log event message. • SNMP Trap Type—Displays the SNMP Trap ID number of the log event message. Log Event Message Symbol Description Context

%s Ethernet Port Down Represents a character string. [WAN | LAN | DMZ] Ethernet Port Down

The cache is full; %u open connections; some will be dropped

Represents a numerical string. The cache is full; [40,000] open connections; some will be dropped

Log Event Message SonicOS Category Legacy Category Priority Level Log Message ID Number SNMP Trap Type Log Event Type

#Web site hit Network Traffic Connection Traffic Information 97 --- Standard HTTP Traffic Report

%s VPN IKE User Activity Information 171 --- Standard

Message String

%s ARS --- Information 840 --- Standard

Message String

%s ARS --- Notice 841 --- Standard

Message String

%s ARS --- Debug 842 --- Standard

(11)

%s Ethernet Port Down

Firewall Event System Error Error 333 641 Standard

String Service

%s Ethernet Port Up

Firewall Event System Error Warning 332 640 Standard

String Service

%s-payload processing error

VPN IKE Debug Error 616 --- Standard

Message String SonicWALL Registration Update Needed: Restore your existing security service subscriptions by clicking here. Security Services

Maintenance Warning 496 --- Simple

802.11b Management Wireless 802.11b Management Information 518 --- Simple Destination A prior version of preferences was loaded because the most recent preferences file was inaccessible

Firewall Event System Error Warning 572 648 Simple

A SonicOS Standard to

Enhanced Upgrade was performed

Firewall Event Maintenance Information 611 --- Simple

Access attempt from host out of compliance with GSC policy

Security Services

Maintenance Information 761 --- Standard

Access attempt from host without Anti-Virus agent installed

Security Services

Access attempt from host without GSC installed

Security Services

Maintenance Information 763 524 Standard

Access rule added Firewall Rule User Activity Information 440 --- Simple Rule

Access rule deleted

Firewall Rule User Activity Information 442 --- Simple

(12)

Access rule modified

Firewall Rule User Activity Information 441 --- Simple

Rule

Access to proxy server denied

Network Access

Blocked Sites Notice 60 705 Standard

Note Blocked ActiveX access denied Network Access

Blocked Code Notice 18 --- Standard

Note Blocked ActiveX or Java archive access denied Network Access

Note Blocked AD agent %s is not responding MS AD --- Error 769 --- Standard Message String Add an attack message

Firewall Event Attack Error 143 525 Simple

String

Adding Dynamic Entry for Bound MAC Address

Network --- Information 813 --- Standard

Note ENET

Adding L2TP IP pool Address object Failed

L2TP Server System Error Error 603 661 Simple

Adding to multicast policyList, interface: %s

Multicast --- Debug 697 --- Standard

Message String

Adding to Multicast policyList, VPN SPI: %s

Message String

Administrator logged out

Authentication User Activity Information 261 --- Standard

Administrator logged

out - inactivity timer expired

Administrator login allowed

Administrator login denied due to bad credentials

(13)

Administrator login denied from %s; logins disabled from this interface

Authentication Attack Alert 35 506 Standard

Message String

Adminstrator name changed

Authentication Maintenance Information 328 --- Standard

All DDNS

associations have been deleted

DDNS Maintenance Information 783 --- Simple

All preference values have been set to factory default values

Firewall Event System Error Warning 574 650 Simple

Allowed LDAP server certificate with wrong host name

RADIUS User Activity Warning 752 --- Standard

Note String

Anti-Spyware Detection Alert: %s

Intrusion Detection

Attack Alert 795 576 Standard

Anti-Spy Message String Anti-Spyware Prevention Alert: %s Intrusion Detection

Anti-Spy Message String Anti-Spyware Service Expired Security Services

Maintenance Warning 796 577 Simple

Anti-Virus agent out-of-date on host

Security Services

Anti-Virus

Licenses Exceeded

Security Services

Arp request packet received

Note ENET

Arp request packet sent

Note ENET

Arp response packet received

Note ENET

Arp response packet sent

Note ENET

ARP timeout Network Debug Debug 45 --- Standard

Association Flood from wlan station

WLAN IDS WLAN IDS Alert 548 903 Simple

(14)

Authentication timeout during Remotely

Triggered Dial-out session

Authentication User Activity Information 821 --- Simple

Back Orifice attack dropped

Intrusion Detection

Backup active High Avaiability

System Error Information 825 --- Simple

Backup firewall being preempted by Primary

High Availability

System Error Error 152 619 Simple

Backup firewall has transitioned to Active

High Availability

Maintenance Information 145 --- Simple

Backup firewall has transitioned to Idle

High Availability

Backup going Active in preempt mode after reboot

High Availability

Backup missed heartbeats from Primary

High Availability

Backup received error signal from Primary

High Availability

Backup received reboot signal from Primary

High Availability

Backup shut down because license is expired

High Availability

System Error Error 824 --- Simple

Backup will be shut down in %s minutes

High Availability

System Error Error 823 --- Standard

String Service

Bad CRL format VPN PKI User Activity Alert 277 --- Simple Destination

Blocked Quick Mode for Client using Default KeyId

(15)

BOOTP Client IP address on LAN conflicts with remote device IP, deleting IP address from remote table

BOOTP Maintenance Information 619 --- Standard

Destination

BOOTP reply relayed to local device

BOOTP Maintenance Information 620 --- Standard

Destination

BOOTP Request received from remote device

BOOTP Debug Debug 621 --- Standard

Destination

BOOTP server response relayed to remote device

BOOTP Debug Debug 618 --- Standard

Destination

Broadcast packet dropped

Network Access

Debug Debug 46 --- Standard

Note Protocol

Cannot connect to the CRL server

VPN PKI User Activity Alert 274 --- Simple

Destination

Cannot Validate Issuer Path

Destination

Certificate on Revoked list (CRL)

Destination CFL auto-download disabled, time problem detected Security Services

CLI administrator logged out

CLI administrator login allowed

CLI administrator login denied due to bad credentials

Authentication User Activity Warning 200 --- Simple

Computed hash does not match hash received from peer

VPN IKE User Activity Warning 410 --- Standard

(16)

Connection Closed

Note: In specific cases of

multi-layer packet processing, a TCP connection initially logged as "open," will be rejected by a deeper layer of packet processing. In these cases, the connection request has not been forwarded by the SonicWALL security appliance, and the initial Connection Open SonicOS log event message should be ignored in favor of the TCP Connection Dropped log event message. Network Traffic Connection Traffic Information 537 --- Standard Traffic Report Connection Opened

Note: In specific cases of

multi-layer packet processing, a TCP connection initially logged as "open," will be rejected by a deeper layer of packet processing. In these cases, the connection request has not been forwarded by the SonicWALL security appliance, and the initial Connection Open SonicOS log event message should be ignored in favor of the TCP Connection Dropped log event message.

Network Traffic

Connection Information 98 --- Standard

Note Protocol

Connection timed out

Destination

Cookie removed Network Access

String Service

CRL has expired VPN PKI User Activity Alert 874 --- Simple Destination

CRL loaded from VPN PKI User Activity Information 270 --- Simple Destination

CRL

missing - Issuer requires CRL checking

Destination

CRL validation failure for Root Certificate

Destination

Crypto DES test failed

Crypto Test Maintenance Error 360 --- Simple

Crypto DH test failed

(17)

Crypto Hardware 3Des test failed

Crypto Hardware 3DES with SHA test failed

Crypto Hardware AES test failed

Crypto Test Maintenance Error 610 --- Standard

Crypto hardware DES test failed

Crypto Haredware DES with SHA test failed

Crypto Hmac-MD5 fest failed

Crypto Hmac-Sha1 test failed

Crypto MD5 test failed

Crypto RSA test failed

Crypto Sha1 test failed

DDNS association %s disabled

Message String

DDNS association %s enabled

Message String

DDNS association %s added

Message String

DDNS association %s deactivated

Message String

DDNS association %s deleted

Message String

DDNS Association %s put on line

(18)

DDNS association %s taken Offline locally

Message String

DDNS Failure: Provider %s

DDNS System Error Error 774 --- Simple

Message String

DDNS Update success for domain %s

DDNS Maintenance Information 776 --- Standard

Message String

DDNS Warning: Provider %s

DDNS System Error Warning 777 --- Simple

Message String

Deleting from Multicast policy list, interface : %s

Message String

Deleting from Multicast policy list, VPN SPI : %s

Message String

Deleting IPSec SA VPN IKE User Activity Information 92 --- Standard Note SPI

DHCP client enabled but not ready

DHCP Client Maintenance Information 504 --- Simple

DHCP Client did not get DHCP ACK

DHCP Client Maintenance Information 109 --- Standard

DHCP Client failed to verify and lease has expired. Go to INIT state.

DHCP Client got a new IP address lease.

Destination

DHCP Client got ACK from server

Destination

DHCP Client got NACK

(19)

DHCP Client is declining address offered by the server.

Destination

DHCP Client sending REQUEST and going to REBIND state

Destination

DHCP Client sending REQUEST and going to RENEW state

Destination

DHCP DISCOVER received from remote device

DHCP Relay Debug Information 474 --- Standard

Destination DHCP lease dropped. Lease from Central Gateway conflicts with Relay IP

DHCP Relay Maintenance Warning 228 --- Standard

Destination DHCP lease dropped. Lease from Central Gateway conflicts with Remote Management IP

DHCP Relay Maintenance Warning 484 --- Standard

Destination

DHCP lease relayed to local device

DHCP Relay Maintenance Information 223 --- Standard

Destination

DHCP lease relayed to remote device

Destination

DHCP lease to LAN device conflicts with remote device, deleting remote IP entry

Destination

DHCP NAK received from server

Destination

DHCP OFFER received from server

(20)

DHCP Ranges altered automatically due to change in network settings for interface %s

Firewall Event --- Information 832 --- Standard

String Service

DHCP RELEASE received from remote device

Destination

DHCP RELEASE relayed to Central Gateway

Destination

DHCP REQUEST received from remote device

Destination

DHCP Server not available. Did not get any DHCP OFFER.

Diagnostic Code A Firewall Hardware

Note String

Diagnostic Code B Firewall Hardware

Note String

Diagnostic Code C Firewall Hardware

Note String

Diagnostic Code D Firewall Hardware

System Error Error 64 610 Standard

Note Code

Diagnostic Code D Firewall Hardware

Note String

Diagnostic Code E VPN IPSec System Error Error 61 609 Standard Note Code

Diagnostic Code F Firewall Hardware

Note String

Diagnostic Code G Firewall Hardware

Note String

Diagnostic Code H Firewall Hardware

Note String

Diagnostic Code I Firewall Hardware

Note String

Disconnecting L2TP Tunnel due to traffic timeout

(21)

Disconnecting PPPoE due to traffic timeout

PPPoE Maintenance Information 168 --- Simple

Disconnecting PPTP Tunnel due to traffic timeout

PPTP Maintenance Information 389 --- Simple

Discovered HA Backup Firewall

High Availability

DNS packet allowed

Network Access

Debug Information 602 --- Standard

Policy

Drop Wlan traffic from non

SonicPoint devcies

Intrusion Detection

Attack Error 662 572 Standard

Dynamic IPSec client connected

VPN IPSec User Activity Information 62 --- Standard

Destination

EIGRP packet dropped

Network Access

Debug Notice 714 --- Standard

Note String

E-Mail fragment dropped

Intrusion Detection

Error initializing Hardware acceleration for VPN Firewall Hardware

Maintenance Error 374 --- Simple

Error Rebooting HA Peer Firewall

High Availability

Error setting the IP address of the backup, please manually set to backup LAN IP High Availability

Error

Synchronizing HA Peer Firewall

High Availability

Exceeded Max multicast address limit

Multicast --- Warning 703 --- Standard

Failed payload validation

Failed payload verification after decryption.

Possible preshared key mismatch.

(22)

Failed to find certificate

Destination

Failed to get CRL from

Destination

Failed to Process CRL from

Destination

Failed to resolve name

Network Maintenance Information 84 --- Simple

Destination

Failed to

synchronize Relay IP Table

DHCP Relay System Error Warning 234 632 Standard

Failure to add data channel

Unused Debug Debug 49 --- Standard

Failure to reach Interface %s probe

High Availability

System Error Error 675 647 Standard

String Ser-vice

Fan Failure Firewall Hardware System Environment Alert 576 102 Simple Forbidden E-Mail attachment deleted Intrusion Detection

Destination Forbidden E-Mail attachment disabled Intrusion Detection

Destination

Found Rogue Access Point

Destination

Found Rogue Access Point

Destination Fragmented packet dropped Network TCP | UDP | ICMP Notice 28 --- Standard Note Protocol Fraudulent Microsoft certificate found; access denied Intrusion Detection

FTP: Data connection from non default port dropped

Network Access

FTP: PASV response bounce attack dropped.

Intrusion Detection

(23)

FTP: PASV response spoof attack dropped.

Intrusion Detection

FTP: PORT bounce attack dropped.

Intrusion Detection

Note String

Gateway Anti-Virus Alert: %s

Security Services

Attack Alert 809 --- Standard

Message String Gateway Anti-Virus Service expired Security Services

Maintenance Warning 810 --- Simple

Global VPN Client connection is not allowed. Appliance is not registered.

VPN Client System Error Information 529 643 Standard

Global VPN Client License Exceeded: Connection

denied.

VPN Client System Error Information 494 658 Standard

Global VPN Client version cannot enforce personal firewall. Minimum Version required is 2.1.

VPN Client User Activity Information 604 --- Standard

Destination

Got DHCP OFFER. Selecting.

Destination

GSC policy

out-of-date on host

Security Services

Guest account '%s' created

Message String

Guest account '%s' deleted

Message String

Guest account '%s' disabled

Message String

Guest account '%s' pruned

Message String

Guest account '%s' re-enabled

(24)

Guest account '%s' re-generated

Message String

Guest login denied. Guest '%s' is already logged in. Please try again later.

Message String

H.323/H.225 Connect

VoIP VoIP Debug 634 --- Standard

Note String

H.323/H.225 Setup VoIP VoIP Debug 633 --- Standard Note String

H.323/H.245 Address

Note String

H.323/H.245 End Session

Note String

H.323/RAS

Admission Confirm

Note String

H.323/RAS Admission Reject

Note String

H.323/RAS Admission Request

Note String

H.323/RAS Bandwidth Reject

Note String

H.323/RAS

Disengage Confirm

Note String

H.323/RAS Disengage Reject

Note String

H.323/RAS

Gatekeeper Reject

Note String

H.323/RAS Location Confirm

Note String

H.323/RAS Location Reject

Note String

H.323/RAS

Registration Reject

Note String

H.323/RAS

Unknown Message Response

(25)

H.323/RAS Unregistration Reject

Note String

HA packet processing error

High Availability

Hardware Failover settings were not upgraded

Header verification failed

HTTP

management port has changed

Note String

HTTPS

management port has changed

Note String

ICMP checksum error

Network Access

UDP Notice 886 --- Standard

ICMP packet allowed

Network Access

Policy

ICMP packet dropped

Network Access

ICMP Notice 38 --- Standard

Policy

ICMP packet dropped

Network Access

ICMP Notice 523 --- Standard

ICMP Service

ICMP packet from LAN allowed

Network Access

ICMP Service

ICMP packet from LAN dropped Network Access LAN ICMP | LAN TCP Notice 175 --- Standard ICMP Service If not already enabled, enabling NTP is recommended Firewall Hardware

System Error Warning 540 645 Simple

IGMP packet dropped, wrong checksum received on interface %s

Multicast --- Notice 683 --- Standard

Message String

IGMP Leave group message Received on interface %s

Multicast --- Information 682 --- Standard

(26)

IGMP packet dropped, decoding error

IGMP Packet Not handled. Packet type : %s

Message String

IGMP querier Router detected on interface %s

Message String IGMP querier Router detected on VPN tunnel , SPI %S

Message String

IGMP state table entry time out,deleting interface : %s for multicast address : %s

Message String

IGMP state table entry time

out,deleting VPN SPI :%s for

Multicast address : %s

Message String

IGMP V2 client joined multicast Group : %s

Message String IGMP V2 Membership report received from interface %s

Message String

IGMP V3 client joined multicast Group : %s

Message String IGMP V3 Membership report received from interface %s

Message String IGMP V3 packet dropped, unsupported Record type : %s

(27)

IGMP V3 reord type : %s not Handled

Message String

IKE ID mismatch %s

VPN IKE Debug Debug 658 --- Standard

String Service

IKE Initiator drop: Packet dest address does not match selected local interface address

VPN IKE User Activity Information 544 --- Standard

IKE Initiator: Accepting IPSec proposal (Phase 2)

Note String

IKE Initiator: Accepting peer lifetime (Phase 1)

Destination

IKE Initiator: Aggressive Mode complete (Phase 1)

Destination

IKE Initiator: Main Mode complete (Phase 1)

Destination

IKE Initiator: Received notify. NO_PROPOSAL_ CHOSEN

Destination

IKE Initiator: Start Aggressive Mode negotiation (Phase 1)

IKE Initiator: Start Main Mode

negotiation (Phase 1)

IKE Initiator: Start Quick Mode (Phase 2)

IKE Initiator: Using secondary gateway to negotiate

(28)

IKE negotiation aborted due to timeout

IKE negotiation complete. Adding IPSec SA. (Phase 2)

IKE Responder drop: Packet dest address does not match selected local interface address

IKE Responder: %s policy does not allow static IP for Virtual Adapter.

VPN Client System Error Error 660 --- Standard

Message String

IKE Responder: Accepting IPSec proposal (Phase 2)

Note String

IKE Responder: Aggressive Mode complete (Phase 1)

Destination

IKE Responder: AH Perfect Forward Secrecy mismatch

VPN IKE User Activity Warning 258 544 Standard

IKE Responder: Algorithms and/or keys do not match

IKE Responder: Default LAN gateway is not set but peer is propos-ing to use this SA as a default route

VPN IKE Attack Error 516 553 Standard

Note String

IKE Responder: Default LAN gateway is set but peer is not

proposing to use this SA as a default route

(29)

IKE Responder: ESP Perfect Forward Secrecy mismatch

IKE Responder: IKE proposal does not match

(Phase 1)

Destination

IKE Responder: IP Address already exists in the DHCP relay table. Client traffic not allowed.

VPN Client System Error Error 659 --- Standard

Note String

IKE Responder: IPSec proposal does not match (Phase 2)

Note String

IKE Responder: Main Mode

complete (Phase 1)

Destination

IKE Responder: Mode %d - not transport mode. Xauth is required but not supported by peer.

VPN IKE Debug Warning 342 --- Standard

Message Number

IKE Responder: Mode %d - not tunnel mode

Message Number IKE Responder: No match for proposed remote network address

Note String IKE Responder: No matching Phase 1 ID found for proposed remote network

Note String

IKE Responder: Proposed local network is 0.0.0.0 but SA has no LAN Default Gateway

(30)

IKE Responder: Proposed remote network is 0.0.0.0 but not DHCP relay nor default route

IKE Responder: Received

Aggressive Mode request (Phase 1)

IKE Responder: Received Main Mode request (Phase 1)

IKE Responder: Received Quick Mode Request (Phase 2)

IKE Responder: Tunnel terminates inside firewall but proposed local network is not inside firewall

Note String IKE Responder: Tunnel terminates on DMZ but proposed local network is on LAN

Note String IKE Responder: Tunnel terminates on LAN but proposed local network is on DMZ

Note String

IKE Responder: Tunnel terminates outside firewall but proposed local network is not NAT public address

Note String

IKE Responder: Tunnel terminates outside firewall but proposed remote network is not NAT public address

(31)

IKE SA lifetime expired.

Illegal IPSec SPI VPN IPSec User Activity Information 65 --- Standard Destination

Imported VPN SA is invalid - disabled

Firewall Event Maintenance Warning 348 --- Standard

Note String Inbound connection from RBL-listed SMTP server dropped RBL --- Notice 798 --- Standard Incoming call received for Remotely Triggered Dial-out session

Incompatible IPSec Security

Association

VPN IPSec User Activity Information 69 --- Standard

Destination Incorrect authentication received for Remotely Triggered Dial-out

Ini Killer attack dropped

Intrusion Detection

Interface %s Link Is Down

String Service

Interface %s Link Is Up

Firewall Event System Error Warning 565 646 Standard

String Service Interface IP Assignment : Binding and initializing %s

Firewall Event Maintenance Information 568 --- Standard

String Service Interface IP Assignment changed: Shutting down %s

(32)

Invalid TCP flags on an incomplete connection Network Access --- Notice 760 --- Standard Note String Invalid VLAN packet dropped

Network --- Alert 836 --- Standard

Note String

IP Header checksum error

Network Access

TCP | UDP Notice 883 --- Standard

IP spoof detected on packet to Central Gateway, packet dropped

DHCP Relay Attack Error 229 533 Standard

Note ENET

IP spoof dropped Intrusion Detection

Note ENET IP type %s packet dropped Network Access LAN UDP | LAN TCP Notice 590 --- Standard Message String IPS Detection Alert: %s Intrusion Detection

IDP Message String IPS Detection Alert: %s Intrusion Detection

Message String IPS Prevention Alert: %s Intrusion Detection

IDP Message String IPS Prevention Alert: %s Intrusion Detection

Message String

IPSec (AH) packet dropped

VPN IPSec TCP | UDP |

ICMP

Notice 534 --- Standard

Note String

IPSec (AH) packet dropped; waiting for pending IPSec connection

VPN IPSec Debug Debug 536 --- Standard

IPSec (ESP) packet dropped

VPN IPSec TCP | UDP |

ICMP

Notice 533 --- Standard

Note String

IPSec (ESP) packet dropped; waiting for pending IPSec connection

(33)

IPSec

Authentication Failed

VPN IPSec Attack Error 67 508 Standard

Destination

IPSec connection interrupt

Network Access

IPSec Decryption Failed

Destination IPSec packet dropped Network Access TCP | UDP | ICMP Notice 40 --- Standard IPSec packet dropped; waiting for pending IPSec connection

Network Access

IPSec packet from an illegal host

VPN IPSec Maintenance Information 247 --- Standard

Destination

IPSec packet from or to an illegal host

Destination

IPSEC Replay Detected

VPN IPSec Attack Alert 180 531 Standard

Note String IPSecTunnel status changed VPN VPN Tunnel Status Information 427 801 Simple ISDN Driver Firmware successfully updated

Issuer match failed VPN PKI User Activity Alert 278 --- Simple Destination

Java access denied

Network Access

Note Blocked

L2TP enabled but not ready

Unused Maintenance Information 500 --- Simple

L2TP Max Retransmission Exceeded

L2TP Client Maintenance Information 203 --- Simple

L2TP PPP Authentication Failed

L2TP PPP Down L2TP Client Maintenance Information 211 --- Simple

L2TP PPP link down

(34)

L2TP PPP

Negotiation Started

L2TP PPP Session Up

L2TP Server : Deleting the L2TP active Session

L2TP Server Maintenance Information 337 --- Standard

Destination

L2TP Server : Deleting the Tunnel

Destination

L2TP Server : L2TP Session Estab-lished.

Destination

L2TP Server : L2TP Tunnel Estab-lished.

Destination

L2TP Server : Retransmission Timeout, Deleting the Tunnel

Destination

L2TP Server : User Name

authentication Failure locally.

Destination

L2TP Server: Local

Authentication Failure

Destination

L2TP Server: Local

Authentication Success.

Destination

L2TP Server: Radius

Authentication Success

Destination

L2TP Server: Radius reports Authentication Failure

Destination

L2TP Server: Radius server not assigned IP address

(35)

L2TP Server: Call Disconnect from Remote.

Destination

L2TP Server: Tunnel Disconnect from Remote.

Destination

L2TP Session Disconnect from Remote

L2TP Session Established

L2TP Session Negotiation Started

L2TP Tunnel Disconnect from Remote

L2TP Tunnel Established

L2TP Tunnel Negotiation Started

LAN Subnet configurations were not upgraded.

Land attack dropped

Intrusion Detection

License exceeded: Connection dropped because too many IP addresses are in use on your LAN

License of HA pair doesn't match

High Availability

Local user login allowed

String Service

Local user login denied due to bad credentials

String Service Locked-out user logins allowed - lockout period expired

(36)

Locked-out user logins allowed by administrator

Note String

Log Cleared Firewall Logging

Log Debug Firewall Event Debug Error 142 --- Simple String

Log successfully sent via email

Firewall Logging

Login screen timed out

String Service

MAC address collides with Static ARP Entry with Bound MAC address; packet dropped

Network --- Notice 814 --- Standard

Note ENET

Machine %s removed from SYN flood blacklist Intrusion Detection --- Alert 865 --- Standard String Service Malformed or unhandled IP packet dropped Network Access

Destination Maximum events per second threshold exceeded Firewall Logging

System Error Critical 654 --- Simple

Maximum sequential failed dial attempts (10) to a single dial-up number: %s

PPP Dial-up Attack Error 591 566 Standard

Message String

Maximum syslog data per second threshold exceeded

Firewall Logging

System Error Critical 655 --- Simple

Multicast

application %s not supported

Message String Multicast packet dropped, Invalid src IP received on interface : %s

Multicast --- Alert 685 --- Standard

(37)

Multicast packet dropped, wrong MAC address receieved on interface : %s

Multicast --- Alert 684 --- Standard

Message String

Multicast TCP packet dropped

Multicast UDP packet dropped, no state entry

Multicast UDP packet dropped, RTCP stateful failed

Multicast UDP packet dropped, RTP stateful failed

NAT device may not support IPSec AH passthrough

VPN IPSec Maintenance Information 266 --- Simple

NAT Discovery : No NAT/NAPT device detected between IPSec Security gateways

NAT Discovery : Local IPSec Security Gateway behind a NAT/ NAPT Device

NAT Discovery : Peer IPSec Security Gateway behind a NAT/ NAPT Device

NAT Discovery : Peer IPSec Security Gateway doesn't support VPN NAT Traversal

NAT translated packet exceeds size limit, packet dropped

(38)

Net Spy attack dropped

Intrusion Detection

NetBIOS settings were not upgraded. Use Network>IP Helper to

configure NetBIOS support

NetBus attack dropped

Intrusion Detection

Network for interface %s overlaps with another interface.

String Service

Network Modem Mode Disabled: re-enabling NAT

PPP Dial-up Maintenance Information 531 --- Simple

Network Modem Mode Enabled: turning off NAT

PPP Dial-up Maintenance Information 530 --- Simple

New URL List loaded

Security Services

Newsgroup access allowed

Network Access

Note Blocked Newsgroup access denied Network Access

Note Blocked

No Certificate for VPN PKI User Activity Alert 280 --- Simple Destination

No new URL List available

Security Services

No response from ISP Disconnecting PPPoE.

PPPoE Maintenance Information 169 --- Simple

No response from PPTP server to call requests

No response from PPTP server to control connection requests

(39)

No response from server to Echo Requests, disconnecting PPTP Tunnel

No valid DNS server specified for RBL lookups RBL --- Error 800 --- Simple Not all configurations may have been completely upgraded

Not enough

memory to hold the CRL

VPN PKI User Activity Warning 272 --- Simple

Destination

Obtained Relay IP Table from Remote Gateway

OCSP Failed to Resolve Domain Name.

VPN PKI User Activity Error 853 --- Standard

Note String

OCSP Internal error handling received response.

Note String

OCSP received response error.

Note String

OCSP received response.

VPN PKI User Activity Information 850 --- Standard

Note String

OCSP Resolved Domain Name.

Note String

OCSP send request message failed.

Note String

OCSP sending request.

Note String Outbound connection to RBL-listed SMTP server dropped RBL --- Notice 797 --- Standard Out-of-order command packet dropped Network Access

(40)

Packet dropped by wlan guest check

Wireless TCP | UDP | ICMP Warning 488 --- Standard Destination Packet dropped by wlan vpn traversal check Wireless TCP | UDP | ICMP Warning 495 --- Standard Destination Packet dropped. No firewall rule associated with VPN policy.

VPN System Error Alert 739 --- Standard

Note String

Ping of death dropped

Intrusion Detection

PKI Failure: CA certificates store exceeded. Cannot verify this Local Certificate

VPN PKI Maintenance Error 453 --- Simple

PKI Failure: Cannot alloc memory

PKI Failure: Certificate's ID does not match this SonicWall

PKI Failure: Duplicate local certificate

PKI Failure: Duplicate local certificate name

PKI Failure: Import failed

PKI Failure: Improper file format. Please select PKCS#12 (*.p12) file

PKI Failure: Incorrect admin password

PKI Failure: Internal error

PKI Failure: Loaded but could not verify

certificate

(41)

PKI Failure: Loaded the certificate but could not verify it's chain

PKI Failure: No CA certificates yet loaded

PKI Failure: Output buffer too small

PKI Failure: public-private key mismatch

PKI Failure: Reached the limit for local certs, cant load any more

PKI Failure:

Temporary memory shortage, try again

PKI Failure: The certificate chain has no root

PKI Failure: The certificate chain is circular

PKI Failure: The certificate chain is incomplete

PKI Failure: The certificate or a certificate in the chain has a bad signature

PKI Failure: The certificate or a certificate in the chain has a validity period in the future

PKI Failure: The certificate or a certificate in the chain has expired

(42)

PKI Failure: The certificate or a certificate in the chain is corrupt

Please connect interface %s to another network to function properly

String Service

Please manually check all system configurations for correctness of Upgrade

Port configured to receive IPSEC ONLY. Drop packet received in the clear. Network Access TCP | UDP | ICMP Warning 347 --- Standard Destination

Possible port scan dropped

Intrusion Detection

Note String

Possible SYN flood attack detected

Intrusion Detection

Attack Warning 25 503 Standard

Possible SYN flood detected on WAN IF %s - switching to connection-proxy mode Intrusion Detection --- Alert 859 --- Standard String Service Possible SYN Flood on IF %s Intrusion Detection --- Alert 860 --- Standard String Service Possible SYN Flood on IF %s continues Intrusion Detection --- Warning 866 --- Standard String Service Possible SYN Flood on IF %s has ceased Intrusion Detection --- Alert 867 --- Standard String Service PPP Dial-Up: Connect request canceled

PPP Dial-up User Activity Information 306 --- Simple

PPP Dial-Up: Connected at %s bps - starting PPP

PPP Dial-up User Activity Information 286 --- Standard

(43)

PPP Dial-Up: Connection disconnected as scheduled.

PPP Dial-up --- Information 666 --- Standard

PPP Dial-Up: Dial initiated by %s

PPP Dial-up Maintenance Information 324 --- Standard

Message String

PPP Dial-Up: Dialed number did not answer

PPP Dial-Up: Dialed number is busy

PPP Dial-Up: Dialing not allowed by schedule. %s

PPP Dial-up --- Information 665 --- Standard

Message String

PPP Dial-Up: Dialing: %s

String Service

PPP Dial-Up: Idle time limit exceeded - disconnecting

PPP Dial-Up: Initialization : %s

String Service

PPP Dial-Up: Link carrier lost

PPP Dial-Up: Manual intervention needed. Check Primary Profile or Profile details

PPP Dial-Up: Maximum connection time exceeded - disconnecting

PPP Dial-Up: No dialtone detected - check phone-line connection