ScreenOS Message Log Reference Guide Release 6.3.0, Rev. 01 Messages -- Text Only
P/N , Revision  01




Addresses
----------------------------------------


Notification (00001)

Address group <address-group-name> <config-action> <member-name> <user-name> session.

Address group <address-group-name> <config-action> <user-name> session.

Address <address-name> for domain address <domain-name> in zone <zone-name> <config-action> <user-name> session.

Address <address-name> for ip address <ip-address> in zone <zone-name> <config-action> <user-name> session.

Address <address-name> for IP address <ip-address>/<net-mask> in zone <zone-name> <config-action> <user-name> session.


Admin
----------------------------------------


Alert (00027)

Admin <user-name> is locked and will be unlocked after <time> minutes

Admin <user-name> is locked, please contact Security Administrator to unlock it

Login attempt by admin <user-name> from <src-ip> is refused as this account is locked

ScreenOS <major_version>.<minor_version>.<rev_version> Serial# <serial_number>: <ar_log_initiated_string>

ScreenOS <major_version>.<minor_version>.<rev_version> Serial# <serial_number>: <ar_log_aborted_string>

System configuration has been erased


Critical (00027)

Admin <user-name> has been re-enabled <changer> after being locked due to excessive failed login attempts

Multiple login failures occurred for user <user-name>

Multiple login failures occurred for user <user-name> from IP address <src-ip>:<src-port>

Remote authentication is refused for admin <user-name> since the maximum number of locked admin has been reached


Warning (00002)

ADMIN AUTH: Local instance of an external admin user privilege has been changed from <privilege> to <privilege>.


Warning (00515)

Admin user <user-name> has been forced to log out of the serial console session.

Admin user <user-name> has been forced to log out of the SSH session on host <src-ip>:<src-port>

Admin user <user-name> has been forced to log out of the Telnet session on host <src-ip>:<src-port>

Admin user <user-name> has been forced to log out of the Web session on host <src-ip>:<src-port>

Admin user <user-name> has logged on via SSH from <src-ip>:<src-port>

Admin user <user-name> has logged on via Telnet from <src-ip>:<src-port>

Admin user <user-name> has logged on via the console

Admin user <user-name> has logged out via SSH from <src-ip>:<src-port>

Admin user <user-name> has logged out via Telnet from <src-ip>:<src-port>

Admin user <user-name> has logged out via the console

Login attempt to system by admin <user-name> via SSH from <src-ip>:<src-port> has failed<reason>

Login attempt to system by admin <user-name> via Telnet from <src-ip>:<src-port> has failed<reason>

Login attempt to system by admin <user-name> via the console has failed<reason>

Management session via serial console for <vsys>admin <user-name> has timed out

Management session via SSH from <src-ip>:<src-port> for <vsys>admin <user-name> has timed out

Management session via Telnet from <src-ip>:<src-port> for <vsys>admin <user-name> has timed out

Remotely authenticated Admin <user-name> demoted from ROOT privilege to RW privilege.

Remotely authenticated Admin <user-name> demoted from <old_priv> privilege to <new_priv> privilege.

Vsys admin user <user-name> has logged on via SSH from <src-ip>:<src-port>

Vsys admin user <user-name> has logged on via Telnet from <src-ip>:<src-port>

Vsys admin user <user-name> has logged on via the console

Vsys admin user <user-name> has logged out via SSH from <src-ip>:<src-port>

Vsys admin user <user-name> has logged out via Telnet from <src-ip>:<src-port>

Vsys admin user <user-name> has logged out via the console


Warning (00518)

ADM: Local admin authentication failed for login name <user-name>: invalid login name

ADM: Local admin authentication failed for login name <user-name>: invalid password

Admin user <user-name> has been rejected via the <server_name> server at <ip_addr>.


Warning (00519)

Admin user <user-name> has been accepted via the <server_name> server at <ip_addr>.


Notification (00002)

Root admin access restriction through console only has been disabled by admin <user-name> <changed_via>

Root admin access restriction through console only has been enabled by admin <user-name> <changed_via>

Root admin password restriction of minimum <passwd_len> characters has been disabled by admin <user-name> <changed_via>

Root admin password restriction of minimum <passwd_len> characters has been enabled by admin <user-name> <changed_via>

Single use password restriction for read-write administrators has been disabled by admin <user-name> <changed_via>

Single use password restriction for read-write administrators has been enabled by admin <user-name> <changed_via>

Access scheduler <scheduler_name> is affiliated with admin <attached_admin> in vsys <vsys_name>.(by admin <cmd_admin>).

Access scheduler <scheduler_name> is unaffiliated with admin <attached_admin> in vsys <vsys_name>.(by admin <cmd_admin>).

Access scheduler affiliated with admin <attached_admin> is changed from <old_scheduler_name> to <new_scheduler_name> in vsys <vsys_name>.(by admin <user-name>).

ADM: Non-primary authentication server <status> to authenticate non-ROOT privileged admins. Modifier: <user-name>

ADM: Non-primary authentication server <status> to authenticate ROOT privileged admins. Modifier: <user-name>

ADM: Remote authentication server set to <status>. Modifier: <user-name>

ADM: Remotely authenticated admins <status> READ-ONLY privilege. Modifer: <user-name>

ADM: Remotely authenticated ROOT privileged admins <status>. Modifer: <user-name>

Admin user <user-name> with role <role> violated the role privilege attempting to run command of <cmd_line>

Maximum failed login attempts before administrative session disconnects has been modified from <orig_value> to <new_value> <changed_via>


Notification (00003)

The console debug buffer has been <status>

The console page size changed from <old_page_size> to <new_page_size>

The console timeout value changed from <old_timeout_value> to <new_timeout_value> minutes

The serial console has been <status> by admin <user-name>


Information (00002)

Admin account created for <user-name> <changer>

Admin account deleted for <user-name> <changer>

Admin account modified for <user-name> <changer>

Admin name for account <old_admin_name> has been modified to <new_admin_name> <changer>

Admin password for account <user-name> has been modified <changer>

Dial-in admin authentication timeout value has been changed from <old_timeout> to <new_timeout> minutes

Extraneous exit is issued <changer>

HTTP port has been changed from <old_port> to <new_port> <user-name>

Management restriction for IP <ip_addr> has been removed in vsys <vsys_name>. (by admin <admin_name>)

Management restriction for IP <ip_addr> subnet <ip_mask> has been added in vsys '<vsys_name>'. (by admin <admin_name>)

Management restriction removed for all IPs in vsys <vsys_name>. (by admin <admin_name>)

Management restriction removed for all IPs on device. (by admin <admin_name>)

Role for admin <admin_name> has been modified from <old_role> to <new_role> <user-name>

SSH port has been changed from <old_port> to <new_port> <user-name>

System IP has been changed from <old_ip_addr> to <new_ip_addr> <user-name>

Telnet port has been changed from <old_port> to <new_port> <user-name>

Web admin authentication idle timeout value has been changed from <old_timeout> to <new_timeout> minutes


Information (00519)

ADM: Local admin authentication successful for login name <user-name>


ADSL
----------------------------------------


Notification (00557)

ADSL Line Activating.

ADSL Line Close Rejected.

ADSL Line Closed.

ADSL Line Down.

ADSL Line in an unknown state.

ADSL Line Open Failed (Error Message Received from ATU-C).

ADSL Line Open Failed (Forced Silence).

ADSL Line Open Failed (Incompatible Line Conditions).

ADSL Line Open Failed (Protocol Error).

ADSL Line Open Failed (Spurious ATU Detected).

ADSL Line Open Failed (Unable to Lock with ATU-C).

ADSL Line Open Failed (Unknown Error Code).

ADSL Line Open Failed (Unselectable Operation Mode).

ADSL Line Open Rejected.

ADSL Line Opened (=>Showtime).

ADSL Line Signal Lost detected.

ADSL Line Suicide Request Received.

ADSL Line UP Fast and Interleave Channels.

ADSL Line UP Fast Channel, change Utopia address to match it.

ADSL Line UP Fast Channel.

ADSL Line UP Interleaved Channel, change Utopia address to match it.

ADSL Line UP Interleaved Channel.

ADSL Line Waiting for Activating.


Notification (00616)

ADSL<none>/0 Line Down.

ADSL<none>/0 Line Training.

ADSL<none>/0 Line Up.

ADSL<none>/0 SOC Firmware Failed (Load Bootrom Failure).

ADSL<none>/0 SOC Firmware Failed (Load image Failure).

ADSL<none>/0 SOC Firmware Failed (push configuration failure).

ADSL<none>/0 SOC Firmware Reboot(Keepalive timeout).

ADSL<none>/0 SOC Firmware Reset.

ADSL<none>/0 SOC Firmware Startup Failed (Wait Startup timeout).

ADSL<none>/0 SOC Firmware Startup Successful.


Anti-spam
----------------------------------------


Warning (00064)

Anti-Spam is attached to policy ID <policy-id>.

Anti-Spam is detached from policy ID <policy-id>.


Warning (00563)

Anti-Spam: SPAM FOUND ! <as-sender-info>.


Notification (00064)

Anti-Spam action changed.

Anti-Spam blacklist is changed.

Anti-Spam SBL server configured: <sbl-server-name>.

Anti-Spam whitelist is changed.


Notification (00563)

Anti-Spam key is expired (expiration date: <expiration-date>2; current date: <current-date>2).

Anti-Spam: Exceeded maximum concurrent connections (<url-server-vendor-name>).


Antivirus
----------------------------------------


Critical (00554)

SCAN-MGR: Cannot write AV pattern file to flash.

SCAN-MGR: Check AV pattern file failed with error code: <outcome>.

SCAN-MGR: Check AV pattern file failed with error code: <outcome>.

SCAN-MGR: AV pattern file size is too large (<size> bytes).

WARNING: Current hardware configuration does not support embedded AV scanning. Please upgrade system memory.


Critical (00574)

ICAP: Input file size is too large (<size> bytes).


Error (00054)

APPPRY: Suspicious client <src-ip>:<src-port>-><dst-ip>:<dst-port> used <used> percent of AV resources, which exceeded the maximum of <max> percent.


Warning (00066)

AV configures an Extension list <extension-list> with extension <extension>.

AV configures MIME list <MIME-list> with MIME <MIME>.

AV creates profile <profile>.

AV object <none> <none> timeout is reset to default value.

AV object <none> <none> timeout is reset to its default value.

AV pattern type is changed from <pre-dbtype> to <new-dbtype> due to increasing pattern file size and limited flash space.

AV profile <common-name> sets ICAP <param-type> to <suffix>.

AV profile <common-name> <cmd-name>s protocol <app-type> <param-type> <dim0> <value> <dim1> <dim2>.

AV profile <common-name> <cmd-name>s protocol <app-type> <param-type> <dim0> <value> <dim1> <dim2>.

AV profile <common-name> unsets ICAP <param-type>.

AV removes extension list <extension-list>.

AV removes MIME list <MIME-list>.

AV removes profile <profile>.

AV <av> is attached to policy ID <policy-id>.

AV <av> is detached from policy ID <policy-id>


Warning (00547)

AV: Content from <ip>:<port>-><ip>:<port><none>64s<caption> is dropped because maximum concurrent messages are exceeded.

AV: Content from <ip>:<port>-><ip>:<port><none>64s<caption> is dropped because maximum content size is exceeded.

AV: Content from <ip>:<port>-><ip>:<port><none>64s<caption> is dropped due to scan-engine error or constraint with code <file> for <none>.

AV: Content from <ip>:<port>-><ip>:<port><none>64s<caption> is passed because maximum concurrent messages are exceeded.

AV: Content from <ip>:<port>-><ip>:<port><none>64s<caption> is passed because maximum content size is exceeded.

AV: Content from <ip>:<port>-><ip>:<port><none>64s<caption> is passed due to scan-engine error or constraint with code <file> for <none>.

AV: VIRUS FOUND: <ip>:<port>-><ip>:<port><none>64s<caption> file <file>64s virus <none> virus description: <file>

AV: Content from <src-ip>:<src-port>-><dst-ip>:<dst-port><none>64s<caption> is dropped due to scan-engine error or constraint with code <file> for <none>.

AV: Content from <src-ip>:<src-port>-><dst-ip>:<dst-port><none>64s<caption> is passed due to scan-engine error or constraint with code <file> for <none>.

AV: VIOLATION FOUND: <src-ip>:<src-port>-><dst-ip>:<dst-port><none>64s<caption> total <file>, id <none>: violation <total> action <id>.(file <violation>)


Warning (00566)

APP session <src-ip>:<src-port>-><dst-ip>:<dst-port> is aborted due to <msg> with code <code>.

APP session <src-ip>:<src-port>-><dst-ip>:<dst-port> notification email failed due to <none> with code <outcome>.


Notification (00066)

AV configuration: charset of virus notification E-mail is removed.

AV configuration: charset of virus notification E-mail is set to <charset>.

AV configuration: source address of notification E-mail is removed.

AV configuration: source address of notification E-mail is set to <src-ip>.

AV configuration: subject of virus notification E-mail is set to <subject>.

AV configuration: virus warning message is removed.

AV configuration: virus warning message is set to <warning-msg>.

AV fail mode is set to <fail-mode> unexamined traffic if a corrupt file is detected.

AV fail mode is set to <fail-mode> unexamined traffic if a password protected file is detected.

AV fail mode is set to <fail-mode> unexamined traffic if any error occurs.

AV fail mode is set to <fail-mode> unexamined traffic if content size exceeds maximum.

AV fail mode is set to <fail-mode> unexamined traffic if number of decompress layers exceeds maximum.

AV fail mode is set to <fail-mode> unexamined traffic if the firewall runs out of resources.

AV fail mode is set to <fail-mode> unexamined traffic if the operation times out.

AV fail mode is set to <fail-mode> unexamined traffic if the scan engine is not ready.

AV HTTP sets webmail pattern <none> <none> <none>.

AV HTTP trickling setting to be trickling <none> byte for every <none> KB if content length is larger than <none> KB, timeout interval is <none> seconds.

AV HTTP trickling setting to be trickling <none> byte for every <none> Mb, if content length is larger than <none> MB.

AV HTTP turns off HTTP trickling.

AV HTTP turns <none> HTTP connection header close modification.

AV HTTP turns <none> HTTP webmail scanning.

AV HTTP unsets webmail pattern <none>.

AV maximum content size is set to <size> KB.

AV maximum number of concurrent messages is set to <max-concurrent-messages>.

AV object <none> <none> is enabled with timeout <none>.

AV object <none> <none> is enabled with timeout <none>.

AV per client allowed resource is set to <resource-allowed> percent.

AV queue size is set to <queue-size>.

SCAN-MGR: <none> sending Admin E-mail after AV pattern file updated.

SCAN-MGR: Set scan-mgr pattern-update use-proxy

SCAN-MGR: Unset scan-mgr pattern-update use-proxy


Notification (00081)

ICAP server <server> has maximum connections set to <max-connections>.

ICAP server <server> is added to server-group <group>.

ICAP server <server> is disabled.

ICAP server <server> is enabled.

ICAP server <server> is removed from server-group <group>.

ICAP server <server> is removed.

ICAP server <server> is set with host address <host-address> and port <host-port>.

ICAP server <server> probe interval is set to <interval>.

ICAP server <server> probe URL is set to <url>.

ICAP server-group <group> is added.

ICAP server-group <group> is removed.


Notification (00547)

ICAP: Server <server> status changed from <status> to <status>.


Notification (00554)

SCAN-MGR: Attempted to load AV pattern file created on <none>2 after the AV license expired on <none>2.

SCAN-MGR: AV scan engine is ready.

SCAN-MGR: Cannot retrieve AV pattern file due to <msg> (<outcome>). HTTP status code: <status>.

SCAN-MGR: New AV pattern file has been updated. Version: <version>; size: <size> bytes.

SCAN-MGR: <none>

SCAN-MGR: The URL for AV pattern update server is set to <url> and the update interval is set to <interval> minutes.

SCAN-MGR: The URL for AV pattern update server is unset and the update interval returned to its default.


ARP
----------------------------------------


Critical (00031)

<detected-name> detected an IP conflict (IP <ip>, MAC <mac>) on interface <interface-name>


Critical (00079)

<detected-name> detected a duplicate VSD group master (IP <ip>, MAC <mac>) on interface <interface-name>


Notification (00031)

ARP detected IP conflict: IP address <ip> changed from interface <interface-name> to interface <interface-name>


Notification (00051)

Static ARP entry added to interface <interface-name> with IP <ip> and MAC <mac>


Notification (00052)

Static ARP entry deleted from interface <interface-name> with IP address <ip> and MAC address <mac>


Notification (00053)

ARP always on destination enabled


Notification (00054)

ARP always on destination disabled


Notification (00082)

IRDP cli: <none> <none>


Notification (00088)

The DSCP value <dscp-value> is set for <service> <user-name>.

The DSCP value is unset for <service> <user-name>.


Notification (90)

Proxy-arp-entry was added to interface <interface-name> with IP range from <proxy_arp_entry_min> to <proxy_arp_entry_max> in VSYS <vsys_name>

Proxy-arp-entry was removed from interface <interface-name> with IP range from <proxy_arp_entry_min> to <proxy_arp_entry_max> in VSYS <vsys_name>


Notification (92)

TCP keep-alive idle time has been changed from <old-idle-time> to <idle-time> by <user-name>

TCP keep-alive probe interval has been changed from <old-probe-interval> to <probe-interval> by <user-name>

TCP keep-alive probes threshold has been changed from <old-probe-threshold> to <probe-threshold> by <user-name>


Information (90)

Dst NAT ARP is enabled, but it is deprecated


Attack Database
----------------------------------------


Critical (00767)

WARNING: Current hardware configuration cannot support Deep Inspection. Please upgrade system memory.


Warning (00767)

Attack database update cannot be rolled back.


Notification (00767)

Attack database update has been rolled back.

Attack database version <none> is rejected because the authentication check failed.

Attack database version <none> is <none>saved to flash.

Attack group <none> is added to <none> <none> <user-name>.

Attack group <none> is changed to <none> <none> <user-name>.

Attack group <none> is created <none> <user-name>.

Attack group <none> is deleted <none> <user-name>.

Attack group <none> is removed from <none> <none> <user-name>.

Attack <none> is added to attack group <none> <none> <user-name>.

Attack <none> is changed to <none> <none> <user-name>.

Attack <none> is created <none> <user-name>.

Attack <none> is deleted <none> <user-name>.

Attack <none> is removed from <none> <none> <user-name>.

Cannot download attack database from <none> (error <none>).

Cannot parse attack database header info.

Cannot parse attack database.

Cannot save attack database version <none>.

Cannot switch to attack database version <none>.

Deep Inspection update key is expired.


Attacks
----------------------------------------


Emergency (00005)

SYN flood! From <src-ip>:<src-port> to <dst-ip>:<dst-port>, proto TCP (zone <zone-name>, int <interface-name>). Occurred <none> times.


Emergency (00006)

Teardrop attack! From <src-ip>:<src-port> to <dst-ip>:<dst-port>, proto { TCP | UDP | <protocol> } (zone <zone-name>, int <interface-name>). Occurred <none> times.


Emergency (00007)

Ping of Death! From <src-ip> to <dst-ip>, proto 1 (zone <zone-name>, int <interface-name>). Occurred <none> times.


Alert (00004)

WinNuke attack! From <src-ip>:<src-port> to <dst-ip>:139, proto TCP (zone <zone-name>, int <interface-name>). Occurred <none> times.


Alert (00008)

IP spoofing! From <src-ip>:<src-port> to <dst-ip>:<dst-port>, proto { TCP | UDP | <protocol> } (zone <zone-name>, int <interface-name>). Occurred <none> times.


Alert (00009)

Source Route IP option! From <src-ip>:<src-port> to <dst-ip>:<dst-port>, proto { TCP | UDP | <protocol> } (zone <zone-name>, int <interface-name>). Occurred <none> times.


Alert (00010)

Land attack! From <src-ip>:<src-port> to <dst-ip>:<dst-port>, proto TCP (zone <zone-name>, int <interface-name>). Occurred <none> times.


Alert (00011)

ICMP flood! From <src-ip> to <dst-ip>, proto 1 (zone <zone-name>, int <interface-name>). Occurred <none> times.


Alert (00012)

UDP flood! From <src-ip>:<src-port> to <dst-ip>:<dst-port>, proto UDP (zone <zone-name>, int <interface-name>). Occurred <none> times.


Alert (00016)

Port scan! From <src-ip>:<src-port> to <dst-ip>:<dst-port>, proto { TCP | UDP | <protocol> } (zone <zone-name>, int <interface-name>). Occurred <none> times.


Alert (00017)

Address sweep! From <src-ip> to <dst-ip>, proto 1 (zone <zone-name>, int <interface-name>). Occurred <none> times.


Critical (00024)

<entryies> has overflowed.


Critical (00032)

Malicious URL! From <src-ip>:<src-port> to <dst-ip>:<dst-port>, proto TCP (zone <zone-name>, int <interface-name>). Occurred <none> times.


Critical (00033)

Src IP session limit! From <src-ip>:<src-port> to <dst-ip>:<dst-port>, proto { TCP | UDP | <protocol> } (zone <zone-name>, int <interface-name>). Occurred <none> times.


Critical (00412)

SYN fragment! From <src-ip>:<src-port> to <dst-ip>:<dst-port>, proto TCP (zone <zone-name>, int <interface-name>). Occurred <none> times.


Critical (00413)

No TCP flag! From <src-ip>:<src-port> to <dst-ip>:<dst-port>, proto { TCP | UDP | <protocol> } (zone <zone-name>, int <interface-name>). Occurred <none> times.


Critical (00414)

Unknown protocol! From <src-ip>:<src-port> to <dst-ip>:<dst-port>, proto <protocol> (zone <zone-name>, int <interface-name>). Occurred <none> times.


Critical (00415)

Bad IP option! From <src-ip>:<src-port> to <dst-ip>:<dst-port>, proto { TCP | UDP | <protocol> } (zone <zone-name>, int <interface-name>). Occurred <none> times.


Critical (00430)

Dst IP session limit! From <src-ip>:<src-port> to <dst-ip>:<dst-port>, proto { TCP | UDP | <protocol> } (zone <zone-name>, int <interface-name>). Occurred <none> times.


Critical (00431)

ZIP file blocked! From <src-ip>:<src-port> to <dst-ip>:<dst-port>, proto { TCP | UDP | <protocol> } (zone <zone-name>, int <interface-name>). Occurred <none> times.


Critical (00432)

Java applet blocked! From <src-ip>:<src-port> to <dst-ip>:<dst-port>, proto { TCP | UDP | <protocol> } (zone <zone-name>, int <interface-name>). Occurred <none> times.


Critical (00433)

EXE file blocked! From <src-ip>:<src-port> to <dst-ip>:<dst-port>, proto { TCP | UDP | <protocol> } (zone <zone-name>, int <interface-name>). Occurred <none> times.


Critical (00434)

ActiveX control blocked! From <src-ip>:<src-port> to <dst-ip>:<dst-port>, proto { TCP | UDP | <protocol> } (zone <zone-name>, int <interface-name>). Occurred <none> times.


Critical (00435)

ICMP fragment! From <src-ip> to <dst-ip>, proto 1 (zone <zone-name>, int <interface-name>). Occurred <none> times.


Critical (00436)

Large ICMP packet! From <src-ip> to <dst-ip>, proto 1 (zone <zone-name>, int <interface-name>). Occurred <none> times.


Critical (00437)

SYN and FIN bits! From <src-ip>:<src-port> to <dst-ip>:<dst-port>, proto TCP (zone <zone-name>, int <interface-name>). Occurred <none> times.


Critical (00438)

FIN but no ACK bit! From <src-ip>:<src-port> to <dst-ip>:<dst-port>, proto TCP (zone <zone-name>, int <interface-name>). Occurred <none> times.


Critical (00439)

SYN-ACK-ACK Proxy DoS! From <src-ip>:<src-port> to <dst-ip>:<dst-port>, proto TCP (zone <zone-name>, int <interface-name>). Occurred <none> times.


Critical (00440)

Fragmented traffic! From <src-ip>:<src-port> to <dst-ip>:<dst-port>, proto { TCP | UDP | <protocol> } (zone <zone-name>, int <interface-name>). Occurred <none> times.


Notification (00002)

Bypass non-IP traffic option is <action>.

Bypass-icmpv6-mld option is <action>.

Bypass-icmpv6-mrd option is <action>.

Bypass-icmpv6-msp option is <action>.

Bypass-icmpv6-ndp option is <action>.

Bypass-icmpv6-snd option is <action>.

Bypass-ipv6-others-IPSec option is <action>.

Bypass-others-IPSec option is <action>.

Logging of dropped traffic to self (excluding multicast) has been <action>.

Logging of dropped traffic to self has been <action>.

Logging of ICMP traffic to self has been <action>.

Logging of IKE traffic to self has been <action>.

Logging of SNMP traffic to self has been <action>.

Malicious URL <service-name> is <action> for <none> <none>.

<service-name> is <none> on <none> <none> <none>.

<service-name> is set to <none> for <none> <none>.

Screening of all attacks is <action> on <none> <none> <none>.

Logging of TELNET traffic to self has been <action>.

Logging of NSM traffic to self has been <action>.

Logging of SSH traffic to self has been <action>.

Logging of WEB traffic to self has been <action>.


Information (00534)

<ostor-name> is cleared.


Auth
----------------------------------------


Critical (00015)

Administrator's password complexity is set to scheme '<length>' by admin '<user-name>'.

Administrator's password minimum length is set to '<length>' by admin '<user-name>'.

Auth user's password complexity is set to scheme '<length>' by admin '<user-name>'.

Minimum length of auth user's password is set to '<length>' by admin '<user-name>'.


Critical (00518)

Admin user '<user-name>' authorization failure: Password does not comply with password policy.

Auth user <user-name> authorization failure: Password does not comply with password policy.


Warning (00015)

IDP attack notifications to Infranet Controller are being dropped because too many attacks are being detected in too short a period of time.


Warning (00518)

Authentication for user <user-name> at <src-ip> was denied (long password).

Authentication for user <user-name> at <src-ip> was denied (long password).

Authentication for user <user-name> at <src-ip> was denied (long username).

Authentication for user <user-name> at <src-ip> was denied (long username).

Error in authentication for WebAuth user <user-name> at <src-ip>

Local authentication for user <user-name> at <src-ip> was denied<reason>.

Local authentication for WebAuth user <user-name> at <src-ip> was denied<reason>

Authentication for client <src-ip> was denied (too long a password).

Authentication for client <src-ip> was denied (too long a username).

User <user-name> at <src-ip> is challenged by the <auth_server_type> server at <auth_server_ip>. (Rejected because challenge is not supported for FTP).

User <user-name> at <src-ip> is challenged by the <auth_server_type> server at <auth_server_ip>. (Rejected because challenge is not supported for Web).

User <user-name> at <src-ip> is rejected by the <auth_server_type> server at <auth_server_ip>.

User <user-name> at <src-ip> is rejected by the <auth_server_type> server at <auth_server_ip>.

User <user-name> at <src-ip> is rejected through the <auth_server_type> server at <auth_server_ip>.

User <user-name> at <src-ip> <auth_server_type> authentication attempt has timed out.

User <user-name> at <src-ip> <auth_server_type> authentication attempt has timed out.

User <user-name> at <src-ip> <auth_server_type> authentication attempt has timed out.

WebAuth user <user-name> at <src-ip> is rejected/timed out by the <server-type> server at <dst-ip>.


Warning (00519)

Local authentication for user <user-name> at <src-ip> was successful.

Local authentication for WebAuth user <user-name> at <src-ip> was successful

User <user-name> at <of_group> is accepted by the <src-ip> server at <auth_server_type>.

User <user-name> at <of_group> is accepted by the <src-ip> server at <auth_server_type>.

User <user-name> at <of_group> is accepted via the <src-ip> server at <auth_server_type>.

WebAuth user <user-name> at <src-ip> is accepted by the <server-type> server at <dst-ip>.


Warning (00520)

Server <server-ip> is unavailable.

Active Server Switchover: New requests for <server-ip> server will try <next-server-ip> from now on.

Backup1 <primary_server_name>, backup2 <backup1_server_name>, and primary <backup2_server_name> servers failed.

Backup2 <backup2_server_name>, primary <primary_server_name>, and backup1 <backup1_server_name> servers failed.

Primary <primary_server_name>, backup1 <backup1_server_name>, and backup2 <backup2_server_name> servers failed.

Trying backup1 server <backup1_server_name>.

Trying backup2 server <backup2_server_name>.

Trying primary server <primary_server_name>.


Notification (00015)

Certificate Authority index for Infranet Controller <infranet_controller_obj_name> changed.

Certificate subject for Infranet Controller <infranet_controller_obj_name> changed from <old_cert_name> to <new_cert_name>.

Contact interval for Infranet settings changed from <old_contact_interval> to <new_contact_interval> seconds.

Infranet Enforcer could not connect to Infranet Controller <infranet_controller_obj_name> (ip <infranet_controller_ip>).

Infranet Enforcer could not connect to the Infranet Controller because a socket could not be created.

Infranet Enforcer could not connect to the Infranet Controller because a socket is already connected.

Infranet Enforcer could not connect to the Infranet Controller because no certificate is set for the Controller.

Infranet Enforcer could not connect to the Infranet Controller because no IP address is set for the Controller.

Infranet Enforcer could not connect to the Infranet Controller because no password is set for the Controller.

Infranet Enforcer could not connect to the Infranet Controller because the Controller could not be reached on the network.

Infranet Enforcer could not connect to the Infranet Controller because the <outgoing_interface> interface could not be bound to the socket.

Infranet Enforcer could not connect to the Infranet Controller because the socket could not be bound to SSL protocol.

Infranet Enforcer could not connect to the Infranet Controller because the socket could not be bound.

Infranet Enforcer did not receive a keepalive from the Infranet Controller(<infranet_controller_ip>) in the past <seconds_for_which_no_keepalive> seconds. Cleaning up internal state.

Infranet Enforcer has stopped dropping IDP attack notifications. IDP attack notifications are being sent to the Infranet Controller.

IP address for Infranet Controller <infranet_controller_obj_name> changed from <old_ip> to <new_ip>.

Password for Infranet Controller <infranet_controller_obj_name> changed.

Port number for Infranet Controller <infranet_controller_obj_name> changed from <old_port> to <new_port>.

Source interface for Infranet Controller <infranet_controller_obj_name> changed from <old_intf_name> to <new_intf_name>.

Timeout action for Infranet settings changed from <old_timeout_action> to <new_timeout_action>.

Accounting port of server <auth_server_obj_name> is reset to default <acct_port>.

Accounting port of server <auth_server_obj_name> is set to <acct_port>.

Admin user <user-name> attempted to verify the encrypted password <encr_pass>. Verification failed.

Admin user <user-name> attempted to verify the encrypted password <encr_pass>. Verification was successful.

Auth server <auth_server_obj_name> account type is set to <acct_types>.

Auth server <auth_server_obj_name> authentication timeout is set to <auth_timeout>.

Auth server <auth_server_obj_name> backup1 name is unset.

Auth server <auth_server_obj_name> backup1 server name is set to <backup1_name>.

Auth server <auth_server_obj_name> backup2 name is unset.

Auth server <auth_server_obj_name> backup2 server name is set to <backup2_name>.

Auth server <auth_server_obj_name> fail-over revert interval is set to <revert_interval> seconds.

Auth server <auth_server_obj_name> id is set to <new_as_id>.

Auth server <auth_server_obj_name> is created.

Auth server <auth_server_obj_name> is deleted.

Auth server <auth_server_obj_name> is modified.

Auth server <auth_server_obj_name> LDAP cn is set to <ldap_cn>.

Auth server <auth_server_obj_name> LDAP dn is set to <ldap_dn>.

Auth server <auth_server_obj_name> LDAP parameters are set to server name: <auth_server_name_ip>, port: <ldap_port>, dn: <ldap_dn>, cn: <ldap_cn>.

Auth server <auth_server_obj_name> LDAP port number is set to <ldap_port>.

Auth server <auth_server_obj_name> RADIUS port is set to <radius_port>.

Auth server <auth_server_obj_name> RADIUS port is unset to default <default_radius_port>.

Auth server <auth_server_obj_name> RADIUS retry timeout is set to default of <default_radius_retry_timeout>.

Auth server <auth_server_obj_name> RADIUS secret is changed.

Auth server <auth_server_obj_name> RADIUS secret is disabled.

Auth server <auth_server_obj_name> SecurID auth port is set to <auth_port>.

Auth server <auth_server_obj_name> SecurID backup1 server name is set to <backup1_auth_server_name_ip>.

Auth server <auth_server_obj_name> SecurID client retries is set to <securid_client_retries>.

Auth server <auth_server_obj_name> SecurID server name is set to <auth_server_name_ip>.

Auth server <auth_server_obj_name> SecurID timeout is set to <securid_client_timeout>.

Auth server <auth_server_obj_name> SecurID use duress is disabled.

Auth server <auth_server_obj_name> SecurID use duress is enabled.

Auth server <auth_server_obj_name> SecurID uses DES encryption.

Auth server <auth_server_obj_name> SecurID uses SDI encryption.

Auth server <auth_server_obj_name> server name is disabled.

Auth server <auth_server_obj_name> server name is set to <auth_server_name_ip>.

Auth server <auth_server_obj_name> timeout is unset to default <default_auth_timeout>.

Auth server <auth_server_obj_name> type is set to LDAP.

Auth server <auth_server_obj_name> type is set to RADIUS.

Auth server <auth_server_obj_name> type is set to SecurID.

Auth server <auth_server_obj_name> type is unset to default RADIUS.

Auth server <auth_server_obj_name> username character separator is set to <separator_char>; number of occurrences of character separator is <num_occurrence>.

Default firewall authentication server is changed to <auth_server_obj_name>.

Forced timeout for Auth server <auth_server_obj_name> authentication is set to <auth_forced_timeout> minutes.

Forced timeout for Auth server <auth_server_obj_name> is unset to its default value, <default_auth_timeout> minutes.

Host name for Infranet Controller <infranet_controller_obj_name> changed from <old_host_name> to <new_host_name>.

Infranet Controller <infranet_controller_obj_name> is created.

Infranet Controller <infranet_controller_obj_name> is deleted.

Infranet Enforcer is connected to Infranet Controller <infranet_controller_obj_name> (ip <infranet_controller_ip>).

Number of RADIUS retries for auth server <auth_server_obj_name> is set to <radius_retry_value>.

TACACS auth server '<server>' port set to '<tacacs_port>'.

TACACS auth server '<server>' port set to default '<tacacs_default_port>'.

TACACS auth server '<auth_server_obj_name>' shared secret disabled.

TACACS auth server '<auth_server_obj_name>' shared secret modified.

Timeout for Infranet Controller <infranet_controller_obj_name> changed from <old_timeout> to <new_timeout> seconds.

WebAuth is set to <auth_server_obj_name>.


Notification (00525)

The new PIN for user <user-name> at <src-ip> is <accept_or_reject> by SecurID <auth_server_ip>.

User <user-name> at <src-ip> has selected a system-generated PIN for authentication with SecurID <auth_server_ip>.

User <user-name> at <src-ip> must enter New PIN for SecurID <auth_server_ip>.

User <user-name> at <src-ip> must enter Next Code for SecurID <auth_server_ip>.

User <user-name> at <src-ip> must make a New PIN choice for SecurID <auth_server_ip>.


Notification (00543)

Access for firewall user <user-name> at <src-ip> (accepted at <time_connected_at>2 for duration <duration_connected_for> through the <auth_server_obj_name> auth server) by policy id <policy-id> is now over.

Access for firewall user <user-name> at <src-ip> (accepted at <time_connected_at>2 for duration <duration_connected_for> via the <auth_server_obj_name> auth server) by policy id <policy-id> is now over due to forced timeout.

Access for firewall user <user-name> at <src-ip> (accepted at <time_connected_at>2 for duration <duration_connected_for>) by policy id <policy-id> is now over due to forced timeout.

Access for firewall user <user-name> at <src-ip> (accepted at <time_connected_at>2 for duration <duration_connected_for>) by policy id <policy-id> is now over.

Access for WebAuth firewall user <user-name> at <src-ip> (accepted at <time_connected_at>2 for duration <duration_connected_for> through the <auth_server_obj_name> auth server) is now over due to forced timeout.

Access for WebAuth firewall user <user-name> at <src-ip> (accepted at <time_connected_at>2 for duration <duration_connected_for> through the <auth_server_obj_name> auth server) is now over.

Access for WebAuth firewall user <user-name> at <src-ip> (accepted at <time_connected_at>2 for duration <duration_connected_for>) is now over due to forced timeout.

Access for WebAuth firewall user <user-name> at <src-ip> (accepted at <time_connected_at>2 for duration <duration_connected_for>) is now over.


Notification (00546)

User <user-name> at <of_group> is challenged by the <src-ip> server at <auth_server_type>.


Notification (00767)

Cannot get route to SecurID server <server_ip>.

FIPS: Attempt to set RADIUS shared secret with invalid length <secret_len>.

The device cannot contact the SecurID server.

The device cannot send data to the SecurID server.

The dictionary file version on the RADIUS server <radius_server_dictionary_version> does not match the version <ns_device_dictionary_version> supported on the firewall.

User <user-name> belongs to a different group in the RADIUS server than that allowed in the device.


BGP
----------------------------------------


Critical (00206)

The total number of redistributed routes into BGP in vrouter (<vrouter-name>) exceeded system limit (<system-limit>)


Notification (00039)

<configuration-command>

<set-or-unset> virtual router <vrouter-name> with the configuration command <configuration-command>

<set-or-unset> virtual router <vrouter-name> with the BGP protocol <configuration-command>


Information (00542)

BGP instance created for virtual router <vrouter-name>

BGP instance deleted for virtual router <vrouter-name>

BGP of vr: <vrouter-name>, closing the socket: exceeded maximum number of bgp peers allowed (<total-max-num-bgp-peers-cnt>)

BGP of vr: <vrouter-name>, failed to add prefix <dst-ip>/<ip-mask-len> to FDB

BGP of vr: <vrouter-name>, failed to add prefix <dst-ip>/<ip-mask-len> to FDB

BGP of vr: <vrouter-name>, prefix adding: <dst-ip>/<ip-mask-len>, ribin overflow <overflow-count> times (max rib-in <ribin-count>)

BGP of vr: <vrouter-name>, Route <dst-ip>/<ip-mask-len> ignored, Path Attr len: <path-attr-len> (greater than max. <max-path-attr-len>)

BGP of vr: <vrouter-name>, Route <dst-ip>/<ip-mask-len> ignored, Path Attr len: <path-attr-len> (greater than max. <max-path-attr-len>)

BGP peer <dst-ip> changed to Established state

BGP peer <dst-ip> changed to Established state

BGP peer <dst-ip> changed to Idle state

BGP peer <dst-ip> changed to Idle state

BGP peer <dst-ip> created.

BGP peer <dst-ip> created.

BGP peer <dst-ip> disabled.

BGP peer <dst-ip> disabled.

BGP peer <dst-ip> enabled.

BGP peer <dst-ip> enabled.

BGP peer <dst-ip> removed.

BGP peer <dst-ip> removed.

BGP received route-refresh request from peer <src-ip> for afi/safi: <address-family>/<sub-address-family>

BGP received route-refresh request from peer <src-ip> for afi/safi: <address-family>/<sub-address-family>

BGP sent route-refresh request to peer <dst-ip> for afi/safi: <address-family>/<sub-address-family>

BGP sent route-refresh request to peer <dst-ip> for afi/safi: <address-family>/<sub-address-family>

<error-string> invalid error code from notification message

<notification-type> <error-string>


Cisco-HDLC
----------------------------------------


Alert (00087)

Cisco-HDLC detected loop <times> times on interface <interface-name>.


Notification (00076)

CISCO-HDLC keepalive down count value was changed from <old_val> to <new_val> on interface <interface-name>.

CISCO-HDLC keepalive interval was changed from <old_val> to <new_val> on interface <interface-name>.

CISCO-HDLC keepalive is <enable> on interface <interface-name>.

CISCO-HDLC keepalive up count value was changed from <old_val> to <new_val> on interface <interface-name>.

Set interface <interface-name> encap as cisco-hdlc.

Unset interface <interface-name> encap from cisco-hdlc.


Notification (00571)

CISCO-HDLC is <status> on interface <interface-name>.


Device
----------------------------------------


Alert (00767)

<none>


Critical (00020)

The system memory is low (<none> bytes allocated out of total <none> bytes).


Critical (00022)

At least one fan is not functioning properly.

Set fan speed failed duty_reg=<none>x speed = <none>.

The battery is not functioning properly.

The battery is now functioning properly.

The power supply <none> is functioning properly.

The power supply <none> is not functioning properly.

The system temperature (<none> Centigrade, <none> Fahrenheit) is OK now.

The system temperature (<none> Centigrade, <none> Fahrenheit) is too high!

The system temperature: (<none> Centigrade, <none> Fahrenheit) is severely high!


Critical (00039)

Ethernet driver ran out of rx bd (port <none>).


Critical (00092)

WAN card <none> is not functioning properly and will be restarted.


Critical (00612)

Switch error: get <none> register (dev <none>, reg <none>) fail.

Switch error: set <none> register (dev <none>, reg <none>, value 0x<none>) fail.


Critical (00701)

Security Board <none> System Hanging.


Critical (00702)

Security Board <none> CPU <none> Packet Drop Counter <none>


Critical (00703)

Security Board <none> CPU <none> CPU utilization <none> threshold <none>

Security Board <none> CPU <none> memory available <none> threshold <none>

Security Board <none> CPU <none> session number <none> threshold <none>


Critical (00704)

Security Board <none> CPU <none> unresponsive.


Critical (00751)

Switch error: <none>.


Critical (00767)

All fans are now functioning properly.

<none>


Error (00009)

<none>/<none> vid <none> HW vtable leak, total <none> entries.


Notification (00002)

LCD control keys have been locked.

LCD display has been turned off and the LCD control keys have been locked.

LCD display has been turned on and the LCD control keys have been unlocked.

LCD display has been turned on.


Notification (00023)

System configuration has been erased.


Notification (00545)

Failed to initialize modem <none>, <none>

Modem <none> failed to dial <none>, <none>

Modem <none> has been disconnected.

Modem <none> is connected. Phone number: <none>, Account name: <none>, Status <none>

<none>


Notification (00560)

NAS: <nas_obj_name> object <action_name> <update_initiator>


Notification (00612)

bgroup event: <none>.

bgroup setting: bind port <none> to interface <interface-name>.

bgroup setting: unbind port <none> from interface <interface-name>.

Switch event: change interface <interface-name> from mii <none> to mii <none>.

Switch event: the status of ethernet interface <interface-name> change to link <none>, duplex <none>, speed <none>.

Switch event: the status of ethernet port <none> changed to link <none>, duplex <none>, speed <none>.

Switch init: <none>.

switch install: install port <none> to interface <interface-name>.

Switch setting: <none>.

Switch setting: set interface <interface-name> <none>.

Switch setting: set interface <interface-name> <none>.


Notification (00627)

activate <interface-name> fail.

activate <interface-name> successfully, PRL version <none>.

<interface-name> is connected to the carrier

<interface-name> is disconnected to the carrier (code <none>)

<none> on <interface-name>.

<interface-name> reset monthly traffic monitor <none>. <none>lu KB is used in this month.

<interface-name> <none>

<interface-name> <none>

<interface-name> <none> monthly traffic monitor.

<interface-name> <none>.

<interface-name> <none>.

<interface-name> traffic is over threshold (<none> KB) of this month.


Notification (00767)

Authentication failed from <none> CNID on interface serial<interface-id>/0.

Authentication passed from <none> CNID on interface serial<interface-id>/0.

Authentication timeout from <none> CNID on interface serial<interface-id>/0; the device hangs up the connection.

Maximum authentication attempts were reached from <none> CNID on interface serial<interface-id>/0; the device hangs up the connection.

Modem interface accepts a call received from <none> CNID in white list on interface serial<interface-id>/0.

Modem interface accepts a call received from unknown CNID('<none>') on interface serial<interface-id>/0.

Modem interface rejects a call received from <none> CNID in black list on interface serial<interface-id>/0.

Modem interface rejects a call received from unknown CNID('<none>') on interface serial<interface-id>/0.

Move <none> CNID to <interface-id> on interface serial<none>/0 failed; CNID has already been in <none>.

Move <none> CNID to <none> on interface serial<interface-id>/0 succeeded.

Move <none> CNID to <none> on interface serial<interface-id>/0, failed; <none> is full.

Remote peer from <none> CNID on interface serial<interface-id>/0 hangs up the connection.

Remove <none> CNID from <none> on interface serial<interface-id>/0.

<none>

<none> CNID on interface serial<interface-id>/0 logout.


DHCP
----------------------------------------


Alert (00029)

IP pool of DHCP server on interface <interface-name> is full. Unable to <none> IP address to client at <mac>.


Critical (00029)

DHCP server set to OFF on <interface-name> (another server found on <ip_address>).


Warning (00527)

IP pool of DHCP server on interface <interface-name> is more than 90%allocated.


Notification (00009)

DHCP client is <none> on interface <interface-name> <none>.


Notification (00024)

DHCP client admin preference is set on <interface-name> as <admin-preference>.

DHCP client admin preference is unset on <interface-name> from <admin-preference>.

DHCP relay agent settings on <interface-name> are <none>.

DHCP server IP address pool is changed.

DHCP server is <none>.

DHCP server options are <none>.

DHCP server shared IP is <none>.


Notification (00027)

DHCP client auto-config is <none>.

DHCP client client identifier is set to <client_id>.

DHCP client client-identifier is reset.

DHCP client lease time is set to <lease> minutes.

DHCP client lease time is set to default value.

DHCP client server IP address is reset.

DHCP client server IP address is set to <ip_address>.

DHCP client server-update is <none>.

DHCP client vendor identifier is reset.

DHCP client vendor identifier is set to <vendor_id>.


Information (00527)

DHCP server has assigned or released an IP address.

DHCP server on interface <interface-name> received DHCPDISCOVER from <mac> requesting out-of-scope IP address <ip_address>/<netmask>.

DHCP server released an IP address.

IP address <ip_address> is assigned to <mac>.

IP address <ip_address> is released from <mac>.

MAC address <mac> has declined address <ip_address>.

One or more IP addresses are expired.


Information (00530)

An IP address conflict is detected and the DHCP client declined address <ip_address>.

DHCP client IP address <ip_address> for interface <interface-name> has been manually released.

DHCP client is unable to get IP address for interface <interface-name>.

DHCP client lease for <ip_address> has expired.

DHCP client on interface <interface-name> was offered IP <ip_address>/<netmask> and did not proceed with DHCPREQUEST. Reason -- <reason>

DHCP server <ip_address> assigned interface <interface-name> with IP address <ip_address> (lease time <lease> minutes).


Information (00767)

System auto-config of file <filename> from TFTP server <ip_address> has failed.

System auto-config of file <filename> from TFTP server <ip_address> is loaded successfully.


DHCP6
----------------------------------------


Notification (00009)

DHCP6 client is <none> on interface <interface-name> <none>.


Notification (00024)

DHCP server IP address pool has changed.

DHCP6 relay is <none> on <interface-name> <none>.

DHCP6 server configured on <interface-name> is <none>.

DHCP6 server options at <interface-name> are <none>.


Information (00527)

DHCP6 client error, received <prefix-len> bits prefix with <sla-len> bits in sla id.

DHCP6: Client received <msgtype> from <src-ip>, xid <xid>.

DHCP6: Client send <msgtype> from <interface-name> <src-ip> to <dst-ip>, xid <xid> len <length>.

DHCP6: Client start at <interface-name>.

DHCP6: Server received <msgtype> from <src-ip>, xid <xid>.

DHCP6: Server received <msgtype> from <src-ip>.

DHCP6: Server send <msgtype> from <interface-name> <src-ip> to <dst-ip>, xid <xid> len <length>.

DHCP6: Server send <msgtype> from <interface-name> <src-ip> to <dst-ip>, xid <xid> len <length>.


DIP, VIP, MIP, and Zones
----------------------------------------


Critical (00023)

VIP server <server_IP> cannot be contacted.


Critical (00102)

Utilization of DIP pool <dip_id> in vsys <vsys_name> hits raise threshold <threshold>.


Critical (00103)

Utilization of DIP pool <dip_id> in vsys <vsys_name> hits clear threshold <threshold>.


Notification (00010)

Mapped IP <is_ipv6>-<MIP_mapped_IP> <is_ipv6> <MIP_host_IP>


Notification (00016)

VIP (<VIP_IP_Address>:<VIP_Port> <VIP_Service> <VIP_Host_Port>) <action> <changed_from>

VIP (<VIP_IP_Address>:<Vport_low>-<Vport_high> <Host_ip>:<Hport_low>-<Hport_high>) <protocol> <action> <changed_from>

VIP multi-port was disabled <changed_from>

VIP multi-port was enabled <changed_from>


Notification (00021)

DIP group <DIP_group_id> was created <changed_from>

DIP group <DIP_group_id> was removed <changed_from>

DIP IP pool <DIP_member_id> was removed from DIP group <DIP_group_id> <changed_from>

DIP IP pool <is_ipv6>-<DIP_min_range>(scale-size=<is_ipv6>) <DIP_max_range> <dip_scale_size>

DIP IP range <DIP_min_range>-<DIP_max_range> was added into DIP pool <DIP_pool_id> <changed_from>

DIP IP range <DIP_min_range>-<DIP_max_range> was removed from DIP pool <DIP_pool_id> <changed_from>

DIP pool <DIP_member_id> was added into DIP group <DIP_group_id> <changed_from>

DIP port-translation stickiness was <new_state> <changed_from>


Notification (00037)

Asymmetric vpn was <enabled_disabled> on zone <zone_name>.

Intra-zone block for zone <zone_name> was set to <string_on_off>

IP/TCP reassembly for ALG was <enabled_disabled> on zone <zone_name>.

New zone <zone_name> (ID <zone_id>, vsys <vsys_name>) was created.

Shared-DMZ zone <zone_name> was created.

Shared-DMZ zone <zone_name> was deleted.

Tunnel zone <tzone_name> was bound to out zone <czone_name>

Zone <zone_name> (ID <zone_id>, vsys <vsys_name>) was deleted.

Zone <zone_name> was bound to virtual router <vr_name>

Zone <zone_name> was changed to non-shared.

Zone <zone_name> was changed to shared.

Zone <zone_name> was unbound from virtual router <vr_name>


Notification (00533)

VIP server <server_IP> is now alive.

VIP server <server_IP> is now in manual mode.


DNS
----------------------------------------


Critical (00021)

Connection refused by the DNS server.

DNS server is not configured.

Unknown DNS error.


Notification (00004)

Daily DNS lookup has been disabled.

Daily DNS lookup time has been changed to start at <arg1>:<arg2> with an interval of <arg3> hours.

DNS cache table has been cleared.

DNS Proxy module has been disabled.

DNS Proxy module has been enabled.

DNS Proxy module has more concurrent client requests than allowed.

DNS Proxy server select table added with domain <none>, interf <none>, ip <none> <none> <none> <none>.

DNS Proxy server select table deleted with domain <none>.

DNS Proxy server select table entries exceeded max limit.

<none> logging DNS access request.

The { primary | secondary | tertiary } DNS server IP address has been changed.

The { primary | secondary | tertiary } DNS server IP address has been changed.

The { primary | secondary | tertiary } DNS server IP address has been changed.


Notification (00029)

DNS has been refreshed.


Notification (00059)

Agent of DDNS entry with id <none> is reset to its default value.

DDNS entry with id <none> is configured with interface <none> host-name <none>.

DDNS entry with id <none> is configured with server type <none> name <none> refresh-interval <none> hours mininum update interval <none> minutes with <none> secure connection.

DDNS entry with id <none> is configured with user name <none> agent <none>.

DDNS entry with id <none> is deleted.

DDNS module is disabled.

DDNS module is enabled.

DDNS module is initialized.

DDNS module is shut down.

DDNS server <none> returned incorrect ip <none>, local-ip should be <none>.

Error response received for DDNS entry update for id <none> user <none> domain <none>, server type <none> name <none>.

Hostname of DDNS entry with id <none> is cleared.

Minimum update interval of DDNS entry with id <none> is set to default value (60 min).

No-Change response received for DDNS entry update for id <none> user <none> domain <none> server type <none>, server name <none>.

Refresh interval of DDNS entry with id <none> is set to default value (168 hours).

Source interface of DDNS entry with id <none> is cleared.

Success response received for DDNS entry update for id <none> user <none> domain <none> server type <none> name <none>.

Updates for DDNS entry with id <none> are set to be sent in secure (https) mode.

Username and password of DDNS entry with id <none> are cleared.


Notification (0059)

Server of DDNS entry with id <none> is cleared.

Service type of DDNS entry with id <none> is set to default value (dyndns).


Information (00004)

DNS entries have been automatically refreshed.

DNS entries have been manually refreshed.

DNS entries have been refreshed as result of DNS server address change.

DNS entries have been refreshed as result of external event.

DNS entries have been refreshed by HA.


Information (00529)

DNS request <none> from <none>/<none> is forwarded to server <none>/<none>


Entitlement and System
----------------------------------------


Emergency (00093)

<none>


Alert (00027)

License key <key-name> expired after 30-day grace period.

License key <key-name> has expired.

License key <key-name> is due to expire in 2 months.

License key <key-name> is due to expire in 2 weeks.

License key <key-name> is due to expire in a month.

Request to register the device failed to reach the server by <retrieval-from>. Server url: <url>.

Request to retrieve license key failed to reach the server by <retrieval-from>. Server url: <url>


Critical (00027)

New config includes invalid settings. System rolled back to LKG config.

<reset-log-str>


Critical (00051)

Session utilization has dropped below <number>, which is <percent> of the system capacity!

Session utilization has reached <number>, which is <percent> of the system capacity!


Critical (00080)

Cannot create a DI pool with a size of <size> bytes.


Critical (00081)

Cannot allocate <size> bytes of memory.


Critical (00850)

Session limit alarm has been cleared for vsys <vsys-name> (current <current-sess>, dropped packets <drop-sess>)

Session limit alarm has been set for vsys <vsys-name> (current <current-sess>, alarm threshold <alarm-sess>).


Critical (00851)

Session limit alarm has been cleared for policy <policy-id> from src-ip <none>, current session count (<src-ip>) falls into the alarm threshold (<session-count>).

Session limit alarm has been set for policy <policy-id> from src-ip <none>, current session count (<src-ip>) exceeds the alarm threshold (<session-count>), <threshold>.


Error (00767)

Can only do set alg _all as unset alg _all command has been issued.


Warning (00093)

<none>


Notification (00002)

Session threshold has been changed to percentage <percent> <user-name>


Notification (00006)

Domain set to <name>.

Hostname set to <name>.


Notification (00008)

System clock configurations have been changed <user-name>

System clock was changed manually from <previous_value>.

System up time shifted by <increment> seconds.


Notification (00018)

In policy <policy-id>, the session limit per source IP is set to <threshold> <user-name>.


Notification (00036)

An optional ScreenOS feature has been activated via a software key.

No license key is available for retrieval by <retrieval-from>.

Received identical license key by <retrieval-from>.

Register device succeeded and warranty key is installed.

Retrieve firmware list failed.

Retrieve firmware list succeeded: <firmware-count> firmware.

Retrieve firmware list succeeded: <firmware-count> firmware.

<key-count> license keys were updated successfully by <retrieval-from>.


Notification (00086)

Configure pattern-update:<pattern-update-str>.


Notification (00526)

The user limit has been exceeded and <ipv6> cannot be added.


Notification (00553)

Invalid configuration size (<config-size-limit>).


Notification (00575)

<none>


Notification (00625)

Session (id <session-id> src-ip <state> dst-ip <src-ip> dst port <state>) route is invalid.

Session (id <session-id> src-ip <state> dst-ip <src-ip> dst port <state>) route is valid.


Notification (00767)

notification packets for <missed-notify-cnt> sessions are not sent.

Administrator <adm_name> issued command <cmd> to redirect output.

CPU-protection throttling mode engaged <cpu-prot-throttling-times> times in <cpu-prot-throttling-interval> seconds.

Fcb pool size is <fcb-pool-size>.

Fcb pool size is erroneous, change to default size <fcb-pool-size>.

<admin_name> turn off debug switch for <module>

<admin_name> turn on debug switch for <module>

Session (id <session-id>, <sess_src_dst_proto>) cleared: <sess_clr_cmd_issuer>

Set cpu-protection blacklist: <cpu-prot-blacklist-str>.

Set cpu-protection threshold <cpu-prot-threshold>.

System is operational.

System was reset at <user-name>

Trial keys are available to download to enable advanced features. To find out, please visit http://www.juniper.net/products/subscription/trial/.

<session-count> sessions in <vsys-name> were cleared due to <cmd> issued by <user-name>

Unset all blacklist.

Unset cpu-protection blacklist <cpu-prot-blacklist-id>.

Unsupported command <cmd>


Information (00767)

All system configurations saved to <config-changer> by <user-name>.

Daylight Saving Time ended.

Daylight Saving Time has started.

Environment variable <variable-name> changed to <variable-value>.

Environment variable <variable-name> set to <variable-value>.

Environment variable <variable-name> unset.

Load file from usb <usb-filename> to flash <flash-filename> by administrator <user-name>.

Lock configuration aborted because <timeout> minute(s) timeout was exceeded.

Lock configuration aborted explicitly by task <task-name>.

Lock configuration ended by task <task-name>.

Lock configuration started by task <task-name>, with a timeout value of <timeout> minute(s).

New GMT zone ahead or behind by <new-zone> seconds.

<user-name> turn off debug switch for <debug-name>.

Save configuration to IP address <dst-ip> under filename <file-name> by administrator <user-name>.

Save new patch from <src-ip> under filename <file-name> to flash memory <user-name>.

Save new software from <src-ip> under filename <file-name> to flash memory <user-name>.

Save new software from slot filename <slot-filename> to flash memory <user-name>.

Save new software from usb filename <usb-filename> to flash memory by administrator <user-name>.

Script has started.

Script has stopped.

Send file <flash-filename> from flash to usb <usb-filename> by administrator <user-name>.

Send new software from flash memory to slot filename <slot-filename> by administrator <user-name>.

Send new software from flash memory to usb filename <usb-filename> by administrator <user-name>.

Send new software from IP address <src-ip> under filename <file-name> to slot <slot-filename> by administrator <user-name>.

Send new software from IP address <src-ip> under filename <file-name> to usb <usb-filename> by administrator <user-name>.

Send new software to IP address <dst-ip> under filename <file-name> by administrator <user-name>.

System configuration saved <config-changer> by <user-name>.

The system configuration was loaded from flash memory to <usb-filename> by administrator <user-name>.

The system configuration was loaded from flash memory to slot <slot-filename> by administrator <user-name>.

The system configuration was loaded from <src-ip> under the filename <file-name> to slot <slot-filename> by administrator <user-name>.

The system configuration was loaded from <src-ip> under the filename <file-name> to usb <usb-filename> by administrator <user-name>.

The system configuration was loaded from IP address <src-ip> under filename <file-name> by administrator <user-name>.

The system configuration was loaded from slot <user-name>.

The system configuration was loaded from usb <usb-filename> by administrator <user-name>.

The system configuration was not saved <config-changer> by administrator <user-name>. It was locked by administrator <task-name>.

Timer <action-str> <user-name>


FIPs
----------------------------------------


Critical (00030)

FIPS error <error> error code <error-code>.

<crypto module name> self test invoked by <user-name> failed.

<crypto module name> self test invoked by <user-name> failed.

<module name> self test invoked by <user-name> failed.


Notification (00030)

Admin user <user-name> has <enabled or disabled> FIPS self-test after-key-generation.

FIPS test for <module name> invoked by <user-name> passed.

FIPS test for <module name> invoked by <user-name> started after key generation.

FIPS test for <module name> invoked by <user-name> started.

<user-name> changed the self test interval from <original value> hour to <new value> hour.

<user-name> executed an on-demand self test.

<user-name> executed self test for <crypto module name> after key generation.

The FIPS test invoked by <user-name> started.

The FIPS test invoked by <user-name> successfully completed.


Flow
----------------------------------------


Alert (00800)

Shared to fair transition forced.


Alert (00801)

Shared to fair transition: utilization <utilization> >= threshold <threshold>.


Critical (00026)

Encryption failure exceed the threshold <threshold>

Decryption failure exceed the threshold <threshold>

Failed to perform decryption with tunnel ID <tunnel-id> 's symmetric key

Failed to perform encryption tunnel ID <tunnel-id> 's symmetric key

IPSEC tunnel with ID <tunnel-id> fails to authenticate the packet.


Critical (00802)

Fair to shared transition forced.


Critical (00803)

Fair to shared transition: time limit exceeded.


Critical (00804)

Fair to shared transition: utilization <utilization> < threshold <threshold>.


Critical (00805)

Potential violation destination table fills up <counter> times in <period> seconds.

Potential violation service table fills up <counter> times in <period> seconds.

Potential violation source table fills up <counter> times in <period> seconds.


Critical (00806)

Session cache miss rate for vsys <vsys-name> is over 90<number>or an hour.


Error (00805)

Potential violation from <src-ip> occurred <counter> times (exceeded threshold <threshold>) in <period> seconds.

Potential violation to <dst-ip> occurred <counter> times (exceeded threshold <threshold>) in <period> seconds.

Potential violation with policy group <name> occurred <counter> times (exceeded threshold <threshold>) in <period> seconds.

Potential violation with protocol <protocol> to destination port <dst-port> occurred <counter> times (exceeded threshold <threshold>) in <period> seconds.


Notification (00002)

(<user-name>/<vsys-name>) assign vlan group <vlan-grp> to vsd id <vsd-id>.

(<user-name>/<vsys-name>) <none> vlan group name <vlan-grp>.

(<user-name>/<vsys-name>) <none> vlan group <vlan-grp> <none> <none>.

(<user-name>/<vsys-name>) <none> vlan import <none> <none>.

(<user-name>/<vsys-name>) <none> vlan retag name <vlan-retag>.

(<user-name>/<vsys-name>) set vlan port <interface-name> group <vlan-grp> zone <zone-name>.

(<user-name>/<vsys-name>) unassign vlan group <vlan-grp> from vsd id <vsd-id>.

(<user-name>/<vsys-name>) unset vlan port <interface-name> group <vlan-grp>.

Strict TCP SYN check is <none>.

Transparent virtual wire mode has been <none>.


Notification (00040)

Aggressive age-out value has been changed from <none> to <none>.

High watermark for early aging has been changed from <none> to <none>.

High watermark for early aging has been changed to the default (<none>).

Low watermark for early aging has been changed from <none> to <none>.

Low watermark for early aging has been changed to the default (<none>).

The aggressive age-out value has been changed to the default (<none>).


Notification (00079)

CPU limit <none>.

Desired fair mode changed from <none> to <none>.

Fair to shared hold-down time changed from <none> to <none>.

Fair to shared threshold changed from <none> to <none>.

Fair to shared time changed from <none> to <none>.

Shared to fair hold-down time changed from <none> to <none>.

Shared to fair threshold changed from <threshold> to <threshold>.


Notification (00085)

Flow <none> reverse-route changed from <none> to <none>.


Notification (00573)

Running in Infranet Test mode: Allow packet on Infranet authentication policy. Infranet Controller timeout occurred, time-out action was 'open'. Source IP <src-ip>, Destination IP <dst-ip>, Policy ID <policy-id>.

Running in Infranet Test mode: Allow packet. In Regular mode, would drop packet on Infranet authentication policy because Infranet auth table denied it. Source IP <src-ip>, Destination IP <dst-ip>, Policy ID <policy-id>.

Running in Infranet Test mode: Allow packet. In Regular mode, would drop packet on Infranet authentication policy because Infranet Controller timeout occurred and time-out action was 'close'. Source IP <src-ip>, Destination IP <dst-ip>, Policy ID <policy-id>.

Running in Infranet Test mode: Allow packet. In Regular mode, would drop packet on Infranet authentication policy because there is no Infranet auth table entry. Source IP <src-ip>, Destination IP <dst-ip>, Policy ID <policy-id>.

Running in Infranet Test mode: Infranet authentication succeeded, let the packet through. Source IP <src-ip>, Destination IP <dst-ip>, Policy ID <policy-id>.


Notification (00601)

IP action detected attack attempt <none>.


Notification (00624)

Fail to reassemble packet fragments for <src-ip>-><dst-ip> id:0x<none> due to <none>.

Fail to reassemble packet fragments for <src-ip>-><dst-ip> id:0x<none> due to <none>.


Notification (00767)

snoop has been turned off <none>.

snoop has been turned on <none>.


Frame Relay
----------------------------------------


Alert (00085)

[mlfr/lip]: <interface-name> detected loop <times> times.

[mlfr/lip]: the bid <lrxbid> in the ADD_LINK packet from link <interface-name> is inconsistent with the received bid <brxbid> on the bundle <interface-name>.


Notification (00074)

[fr/cfg]: <interface-name> LMI: set <param_name> to <value>.

[fr/cfg]: <interface-name> LMI: set to <proc>.

[fr/cfg]: <interface-name>: <config>

[fr/cfg]: <interface-name>: <config>


Notification (00075)

[mlfr/cfg]: add link <interface-name> to bundle <interface-name>.

[mlfr/cfg]: delete link <interface-name> from bundle <interface-name>.

[mlfr/cfg]: set interface <interface-name> encap as mlfr-uni-nni.

[mlfr/cfg]: set lip acknowledge-retries as <ackretries> for bundle link <interface-name>.

[mlfr/cfg]: set lip acknowledge-timer as <acktimer>(s) for bundle link <interface-name>.

[mlfr/cfg]: set lip fragment-threshold as <frag> for bundle link <interface-name>.

[mlfr/cfg]: set lip hello-timer as <hello-timer>(s) for bundle link <interface-name>.

[mlfr/cfg]: set MLFR bundle-id as <bundle-id> for multilink interface <interface-name>.

[mlfr/cfg]: set MLFR drop-timeout as <droptime> for multilink interface <interface-name>.

[mlfr/cfg]: set MLFR minimum-links as <links> for multilink interface <interface-name>.

[mlfr/cfg]: unset bundle link <interface-name> lip fragment-threshold to <frag>.

[mlfr/cfg]: unset interface <interface-name> encap from mlfr-uni-nni.

[mlfr/cfg]: unset lip acknowledge-retries to default <ackretries> for bundle link <interface-name>.

[mlfr/cfg]: unset lip acknowledge-timer to default <acktimer>(s) for bundle link <interface-name>.

[mlfr/cfg]: unset lip hello-timer to default <hello-timer>(s) for bundle link <interface-name>.

[mlfr/cfg]: unset MLFR bundle-id as the name of multilink interface <interface-name>.

[mlfr/cfg]: unset MLFR drop-timeout to 0 (disable) for multilink interface <interface-name>.

[mlfr/cfg]: unset MLFR minimum-links to default (1) for multilink interface <interface-name>.


Notification (00086)

[fr/lmi]: <interface-name>: LMI link is down due to errors over threshhold (n392).


Notification (00569)

[fr/lmi]: <interface-name> dlci(<dlci>) status changed to <state>.

[fr/lmi]: <interface-name> LMI status changed to <state>.


Notification (00570)

[mlfr/lip]: change bundle <interface-name> physical status to down.

[mlfr/lip]: changed bundle <interface-name> physical status to up.

[mlfr/lip]: link interface <interface-name> LIP is down at bundle <interface-name>.

[mlfr/lip]: link interface <interface-name> LIP is up at bundle <interface-name>.

[mlfr/lip]: <interface-name> LIP FSM: (<oldstate> -> <newstate>) by event (<event>).


GTP
----------------------------------------


Notification (00065)

GTP <none> <none>; <none>

GTP <none>; <none>

GTP sets <none> <none>; <none>


Notification (00567)

GTP <none>

GTP <none>; <none>

<none>


Notification (00568)

<none>

Trace <none>: <none>


H.323
----------------------------------------


Alert (00089)

The number of RAS request messages sent to the GK, <gk-ip>, exceeds the threshold, <ras-flooding-msg-threshold>.


Notification (00619)

Failed to allocate memory for H.323 call context objects. Call dropped

Concurrent H.323 calls exceeding maximum limit: <max-h323-call-num>.

Failed to get NAT cookie. Too many concurrent H.323 calls: <active-h323-call-num>. Call dropped.


HDLC
----------------------------------------


Notification (00539)

Dialup HDLC PPP failed to establish a session. No IP address assigned.

Dialup HDLC PPP failed to establish a session: <none>.

Dialup HDLC PPP session has been successfully established.


High Availability
----------------------------------------


Critical (00015)

NSRP: <nsrp> <nsrp>.

NSRP: <nsrp>.

Peer device <device-id> disappeared.

Peer device <device-id> was discovered.

Peer device <device-id> in the Virtual Security Device group <group-id> changed state from <state-old> to <state-new>.

RTO mirror group <group-id> with direction <direction> on local device <device-id>, detected a duplicate direction on the peer device <device-id>.

The NSRP configuration is out of synchronization between the local device and the peer device.


Critical (00060)

RTO mirror group <group-id> with direction <direction> changed on the local device from <state-old> to <state-new> state, it had peer device <device-id>.


Critical (00061)

RTO mirror group <group-id> with direction <direction> on peer device <device-id> changed from <state-old> to <state-new> state, <state-string>.


Critical (00066)

Device cannot create Track IP list.

Device cannot create Track IP object list.

No interface/route enables the Track IP IP address <is-ipv6> to be transmitted.

Track IP failure reached threshold.

Track IP IP address <is-ipv6> failed.

Track IP IP address <is-ipv6> succeeded.


Critical (00070)

The local device <device-id> in the Virtual Security Device group <group-id> changed state from <state-old> to <state-new>, <state-string>.

The local device <device-id> in the Virtual Security Device group <group-id> changed state from <state-old> to <state-new>.


Critical (00071)

The local device <device-id> in the Virtual Security Device group (<group-id>) changed state from <state-old> to <state-new>, <state-string>.


Critical (00072)

The local device <device-id> in the Virtual Security Device group (<group-id>) changed state from <state-old> to <state-new>, <state-string>.


Critical (00073)

The local device <device-id> in the Virtual Security Device group (<group-id>) changed state from <state-old> to <state-new>, <state-string>.


Critical (00074)

The local device <device-id> in the Virtual Security Device group <group-id> changed state from <state-old> to <state-new>, <state-string>.


Critical (00075)

The local device <device-id> in the Virtual Security Device group <group-id> changed state from <state-old> to <state-new>.


Critical (00076)

The local device <device-id> in the Virtual Security Device group <group-id> sent a 2nd path request to the peer device <device-id>.


Critical (00077)

The local device <device-id> in the Virtual Security Device group <group-id> received a 2nd path request from peer device <device-id> to device <device-id>.


Notification (00007)

Message <message> was dropped because it contained an invalid encryption password.

NSRP black hole prevention disabled. Master(s) of Virtual Security Device groups might not exist.

NSRP black hole prevention enabled. Master(s) of Virtual Security Device groups always exists.

NSRP cluster authentication password changed.

NSRP cluster encryption password changed.

NSRP Run Time Object synchronization between devices was disabled.

NSRP Run Time Object synchronization between devices was enabled.

NSRP transparent Active-Active mode was disabled.

NSRP transparent Active-Active mode was enabled.

NSRP: <nsrp>.

The HA channel changed to interface <interface-name>.

The heartbeat interval of all Virtual Security Device groups changed from <time> (milliseconds) to <time> (milliseconds).

Virtual Security Device group <vsd-id> changed to non-preempt mode.

Virtual Security Device group <vsd-id> changed to preempt mode.

A request by device <device-id> for session synchronization(s) was accepted.

Interface <interface-name> was removed from the monitoring list for <group-id>.

Interface <interface-name> with weight <weight> was added to or updated on the monitoring list for <group-id>.

NSRP data forwarding was disabled.

NSRP data forwarding was enabled.

RTO mirror group <group-id> was unset.

Run Time Object mirror group <group-id> direction was set to <none>.

Run Time Object mirror group <group-id> was set.

Run Time Object mirror group <group-id> with direction <direction> was unset.

The current session synchronization by device <device-id> completed.

The interface <interface-name> with ifnum <interface-id> was removed from the secondary HA path of the devices.

The interval of the probe detecting the status of High Availability link <link> was set to <time> seconds.

The probe that detects the status of High Availability link <link> was disabled.

The secondary HA path of the devices changed from <state-old> to <state-new>.

The secondary HA path of the devices was set to interface <interface-name>, with ifnum <interface-id>.

The threshold of the probe detecting the status of High Availability link <link> was set to <time>.

Virtual Security Device group <group-id> was created. The total number of members in the group is <group-count>.

Virtual Security Device group <group-id> was deleted. The total number of members in the group was <group-count>.

Zone <zone-name> was removed from the monitoring list for <none>.

Zone <zone-name> with weight <weight> was added to or updated on the monitoring list for <none>.

The NSRP encryption key was changed.

Device <device-id> has joined NSRP cluster <cluster-id> <name>.

Device <device-id> quit current NSRP cluster <cluster-id> <name>.

The monitoring threshold was modified to <none> for <none>.

Virtual Security Device group <group-id> priority changed from <state-old> to <state-new>.


Notification (00050)

Track IP <enable-or-disable>

Track default gateway disabled.

Track IP default gateway enabled.

Track IP default gateway updated.

Track IP IP address <is-ipv6> added with an interval of <dst-ip> seconds, a threshold of <interval>, a weight of <threshold>, a timeout of <weight> on interface <timeout> using method <interface-name>.

Track IP IP address <is-ipv6> removed.

Track IP object <object-name> weight value set to <weight>.

Track IP object <object-name> weight value set to default.

Track IP <is-ipv6> interface changed from <dst-ip> to <interface-name>.

Track IP <is-ipv6> interval changed from <dst-ip> to <old-interval>.

Track IP <is-ipv6> method changed from method name <dst-ip> to <old-method>

Track IP <is-ipv6> threshold value changed from <dst-ip> to <old-threshold>.

Track IP <is-ipv6> weight changed from <dst-ip> to <old-weight>.

Track IP threshold set to <threshold>.

Track IP threshold set to default.

Track IP <is-ipv6> gateway was changed from gateway IP address <dst-ip> to <is-ipv6>.

Track IP <is-ipv6> gateway was changed from gateway IP address <dst-ip> to the interface default gateway.

Track IP <is-ipv6> gateway was changed from the interface default gateway to gateway IP address <dst-ip>.

Track IP <IP address> timeout changed from <protocol value> to <old timeout value>.


Notification (00084)

RTSYNC: NSRP route synchronization is disabled.

RTSYNC: NSRP route synchronization is enabled.


Notification (00620)

RTSYNC: Event posted to purge backup routes in all vrouters.

RTSYNC: Event posted to send all the DRP routes to backup device.

RTSYNC: Recieved coldstart request for route synchronization from NSRP peer.

RTSYNC: Serviced coldstart request for route synchronization from NSRP peer.

RTSYNC: Started timer to purge all the DRP backup routes - <purge-time> seconds.

RTSYNC: Timer to purge the DRP backup routes is stopped.


Information (00767)

HA: Synchronization file(s) <filename> sent to backup device in cluster.


IGMP
----------------------------------------


Notification (00055)

IGMP all groups static flag was removed on interface <interface-name>.

IGMP function was disabled on interface <interface-name>.

IGMP function was enabled on interface <interface-name>.

IGMP group <none> static flag was added on interface <interface-name>.

IGMP group <none> static flag was removed on interface <interface-name>.

IGMP groups accept list ID was changed to <none> on interface <interface-name>.

IGMP host instance was created on interface <interface-name>.

IGMP host instance was deleted on interface <interface-name>.

IGMP hosts accept list ID was changed to <none> on interface <interface-name>.

IGMP last member query interval was changed to <none> seconds on interface <interface-name>.

IGMP leave interval was changed to <none> seconds on interface <interface-name>.

IGMP proxy always is disabled on interface <interface-name>.

IGMP proxy always is enabled on interface <interface-name>.

IGMP proxy was disabled on interface <interface-name>.

IGMP proxy was enabled on interface <interface-name>.

IGMP query interval was changed to <none> seconds on interface <interface-name>.

IGMP query max response time was changed to <none> seconds on interface <interface-name>.

IGMP router instance was created on interface <interface-name>.

IGMP router instance was deleted on interface <interface-name>.

IGMP routers accept list ID was changed to <none> on interface <interface-name>.

IGMP static group <none> was added on interface <interface-name>.

IGMP version was changed to V<none> on interface <interface-name>.

IGMP will do router alert IP option check on interface <interface-name>.

IGMP will do same subnet check on interface <interface-name>.

IGMP will not do router alert IP option check on interface <interface-name>.

IGMP will not do same subnet check on interface <interface-name>.


IKE
----------------------------------------


Alert (00026)

IKE <none>: Policy Manager's default CA is used by peer to establish an IPSec VPN.

IPSec tunnel on interface <interface-name> with tunnel ID 0x<sa_tid_hex> received a packet with a bad SPI. <none>-><src-ip>/<none>, <dst-ip>, SPI 0x<pak-len>, SEQ 0x<esp_or_ah>.

IKE <none> <dst-ip> Failed to generate the symmetric key.


Alert (00048)

Number of IAS crossed configured upper threshold <ias-upper>.


Alert (00049)

Number of IAS crossed configured lower threshold <ias-lower>.


Critical (000026)

Failed to generate random.

Error detected with <key-name> key for gateway <none> with parity check.


Critical (00026)

IKE <none> <dst-ip>: The system fails to verify the Diffie-Hellman (DH) public key of the peer using the DH public key validation procedure.

IKE P1 negotiation failure exceeded the threshold <threshold>.

IKE P2 NEGOTIATION failure exceeded the threshold <threshold>.


Critical (00042)

Replay packet detected on IPSec tunnel on <interface-name> with tunnel ID 0x<sa_tid_hex>! From <none> to <src-ip>/<none>, <dst-ip>, SPI 0x<pak-len>, SEQ 0x<esp_or_ah>.


Critical (00111)

Attack alarm: IKE ID enumeration attack on interface <interface-name> from src_ip <none>.


Critical (00113)

Attack alarm: IKE first message DoS attack on interface <interface-name> from source IP <none>.


Critical (00114)

ACVPN: Error in received profile from hub in vr <vr-name>: <outcome>.


Error (00047)

The number of IAS exceeds the configured maximum <ias-max>.


Error (00050)

IAS for peer <none> has IKE error: <dst-ip>.


Error (00110)

IAS for peer <none> has IKE error: <dst-ip>.


Error (00536)

IAS for peer <none> and XAUTH user <dst-ip> activated.

IAS for peer <none> and XAUTH user <dst-ip> terminated by <user-name>.


Notification (00017)

Gateway <gateway-name> at <none> in <dst-ip> mode with ID <ike-mode> <peer-id> <action>.

P1 proposal <prop-name> with <auth-method>, DH group <DH-group>, ESP <enc-mode>, auth <auth-mode>, and lifetime <lifetime> <action> <user-name>.

P2 proposal <prop-name> with DH group <DH-group>, <ah-or-esp>, enc <enc-mode>, auth <auth-mode>, and lifetime (<lifetime> sec/<lifesize> KB) <action> <user-name>.


Information (000536)

IKE <version> <dst-ip>:The symmetric crypto key has been generated successfully.


Information (00536)

IAS for peer <none> and XAUTH user <dst-ip> activated.

IAS for peer <none> and XAUTH user <dst-ip> terminated by <user-name>.

IKE gateway <peer-name> has been disabled because the peer IP address <none> is already in use by another IKE gateway on interface <dst-ip>.

IKE gateway <peer-name> has been disabled. The peer address <addr-name> cannot be resolved to an IP address.

IKE gateway <peer-name> has been enabled. The peer address <addr-name> has been resolved to <none>.

IKE <none> Phase 1: Aborted negotiations because the time limit has elapsed. (<dst-ip>x/<p1_state_mask>)

IKE <none> Phase 1: Aggressive mode negotiations have failed.

IKE <none> Phase 1: Cannot use a preshared key because the peer gateway <dst-ip> has a dynamic IP address and negotiations are in Main mode.

IKE <none> Phase 1: Cannot verify DSA signature.

IKE <none> Phase 1: Cert received has a different FQDN SubAltName than expected.

IKE <none> Phase 1: Cert received has a different IP address SubAltName than expected.

IKE <none> Phase 1: Cert received has a different UFQDN SubAltName than expected.

IKE <none> Phase 1: Cert received has a subject name that does not match the ID payload.

IKE <version> Phase 1: Completed Aggressive mode negotiations with a <dst-ip>-second lifetime.

IKE <version> Phase 1: Completed for user <dst-ip>.

IKE <version> Phase 1: Completed Main mode negotiations with a <dst-ip>-second lifetime.

IKE <version> Phase 1: Discarded a second initial packet, which arrived within 5 seconds after the first.

IKE <version> Phase 1: Discarded peer's P1 request because there are currently <dst-ip> sessions--max is <ongoing-sess>.

IKE <none> Phase 1: Main mode negotiations have failed.

IKE <none> Phase 1: No private key exists to sign packets.

IKE <none> Phase 1: Received an incorrect public key authentication method.

IKE <version> Phase 1: Responder starts <dst-ip> mode negotiations.

IKE <none> Phase 1: Retransmission limit has been reached.

IKE <version> Phase 2 msg ID <dst-ip>x: Completed negotiations with SPI <message-id>x, tunnel ID <spi>, and lifetime <tunnel-id> seconds/<lifetime> KB.

IKE <none> Phase 2 msg ID <dst-ip>x: Negotiations have failed for user <msg-id>.

IKE <none> Phase 2 msg ID <dst-ip>x: Negotiations have failed.

IKE <version> Phase 2 msg ID <dst-ip>x: Responded to the peer's first message from user <message-id>.

IKE <version> Phase 2 msg ID <dst-ip>x: Responded to the peer's first message.

IKE <version> Phase 2 msg-id <dst-ip>x: Completed for user <message-id>.

IKE <none> Phase 2: Aborted negotiations because the time limit has elapsed. (<dst-ip>x/<p1-state-mask>, session ID <p1-state>x)

IKE <version> Phase 2: Initiated negotiations.

IKE <none> Phase 2: Negotiations have failed. Policy-checking has been disabled but multiple VPN policies to the peer exist.

IKE <none> Phase 2: No policy exists for the proxy ID received: local ID (<dst-ip>/<none>, <src-ip>, <none>) remote ID (<src-mask>/<protocol>, <src-port>, <none>).

IKE <none> Phase 2: Received a message but did not check a policy because id-mode was set to IP or policy-checking was disabled.

IKE <none> Phase 2: Received DH group <dst-ip> instead of expected group <dh-actual> for PFS.

IKE <version>: Added Phase 2 session tasks to the task list.

IKE <version>: Added the initial contact task to the task list.

IKE <none>: An SA (ID <dst-ip>) with a higher weight replaced the SA (ID <tunnel-id>) in policy ID <policy-id>.

IKE <none>: Changed heartbeat interval to <dst-ip>.

IKE <none>: Dropped a packet from the peer because no policy permits it.

IKE <none>: Heartbeats have been disabled because the peer is not sending them.

IKE <none>: Heartbeats have been lost <dst-ip> times.

IKE <none>: Missing heartbeats have exceeded the threshold. All Phase 1 and 2 SAs have been removed.

IKE <none>: New SA (ID <dst-ip>) is up. Switch policy ID <tunnel-id> from SA <policy-id>.

IKE <none>: Phase 1 SA (my cookie:<dst-ip>x) was removed due to a simultaneous rekey.

IKE <none>: Phase 2 msg ID <dst-ip>x: Received responder lifetime notification. (<message_id> sec/<lifetime> KB)

IKE <version>: Phase 2 negotiation request is already in the task list.

IKE <none>: Received a notification message for DOI <dst-ip> <doi_number> <message_type>.

IKE <version>: Received a TRNXTN_XCHG payload with type <dst-ip>.

IKE <none>: Received initial contact notification and removed Phase 1 SAs.

IKE <none>: Received initial contact notification and removed Phase 2 SAs.

IKE <none>: Sent an initial contact notification message because of a bad SPI.

IKE <none>: Sent initial contact notification to peer to use a new SA.

IKE <version>: The initial contact task is already in the task list.

IKE <none>: User <dst-ip> has exceeded the configured share-limit of <user-name>.

IKE <none>: XAuth login expired and was terminated for username <dst-ip> at <user-name>/<none>.

IKE <none>: XAuth login failed for gateway <dst-ip>, username <peer-name>, retry: <user-name>, timeout: <retry-count>.

IKE <none>: XAuth login was aborted for gateway <dst-ip>, username <peer-name>, retry: <user-name>.

IKE <none>: XAuth login was passed for gateway <dst-ip>, username <peer-name>, retry: <user-name>, Client IP Addr <retry-count>, IPPool name: <none>, Session-Timeout: <dst-ip>s, Idle-Timeout: <ippool-name>s.

IKE <none>: XAuth login was refreshed for username <dst-ip> at <user-name>/<none>.

IKE: Removed Phase 2 SAs after receiving a notification message.

IKE: User <user-name> with ID <user-id> requested a connection.

IKE: XAuth assign DNS <dst-ip>.

IKE: XAuth assign dns1 <dst-ip> dns2 <dst-ip> wins1 <dst-ip> wins2 <dst-ip>.

IKE: XAuth assign prefix <dst-ip>/<prefix-len> to interface <interface-name> failed.

IKE: XAuth assign prefix <dst-ip>/<prefix-len> to interface <interface-name>.

IKE: XAuth IP pool <pool-name> not configured.

IKE: XAuth no more IP addresses in IP pool <pool-name>.

IKE<<none>> Phase 1: IKE initiator has detected NAT in front of the local device.

IKE<<none>> Phase 1: IKE initiator has detected NAT in front of the remote device.

IKE<<none>> Phase 1: IKE responder has detected NAT in front of the local device.

IKE<<none>> Phase 1: IKE responder has detected NAT in front of the remote device.

IKE<none> Phase 1: Cannot verify ECDSA signature.

IKE<none> Phase 1: Cannot verify RSA signature.

IKE<none> Phase 1: Negotiations have failed for user <dst-ip>.

IKE<version> <src-ip> Phase 1: Initiated negotiations in <version> mode.

IKE<none>: XAuth login was terminated because the user logged in again. Previous gateway: <dst-ip>. Username: <none> at <dst-ip>/<user-name>.

Received an IKE packet on <interface-name> from <none>:<src-ip> to <dst-port>:<none>/<dst-ip>. Cookies: <dst-port>, <pak-len>.

Rejected an IKE packet on <interface-name> from <none>:<src-ip> to <dst-port>:<none> with cookies <dst-ip> and <dst-port> because <init-cookie><resp-cookie><reason>.

A Phase 2 packet arrived while XAuth was still pending

A required payload was missing

an initial Phase 1 packet arrived from an unrecognized peer gateway

An unencrypted packet unexpectedly arrived

An unexpected encrypted packet arrived

IKE DPD configuration changed, <item-name>

IKE DPD found peer at <none> not responding.

IKE Heartbeat configuration <peer-name>

No VPN tunnel references the gateway

Phase 1 negotiations failed. (The preshared keys might not match.)

Phase-1: no user configuration was found for the received IKE ID type:

ScreenOS does not support the ID payload type:

The exchange modes (main or aggressive) do not match

The format used did not match the exchange mode indicated:

The IKE INFO exchange mode hash payload was invalid

The IKE packet length was inconsistent

The IKE packet unexpectedly had a floated port number

The IKE packet unexpectedly had a port number that was not floated.

The IKE QM exchange mode hash payload was invalid

The IKE Transaction exchange mode hash payload was invalid

The notify message was in clear text:

The peer did not send a proxy ID

The peer sent a duplicate message

The peer sent a malformed payload:

The peer sent a nonexistent cookie pair:

The peer sent a packet with a message ID before Phase 1 authentication was done

The peer sent a proxy ID that did not match the one in the SA config

The peer sent the incorrect IKE ID payload type:

The peer sent the incorrect IKE ID payload:

The peer used an invalid IKE header format.

The peer used an unsupported exchange mode:

The specified responder cookie does not exist

The VPN does not have an application SA configured

There was a preexisting session from the same peer

There was an error when processing the payload

There was an error when sending a reply to the socket

There was no KE payload for PFS

There were no acceptable Phase 1 proposals

There were no acceptable Phase 2 proposals.


IKEv2
----------------------------------------


Critical (00113)

Attack alarm: IKE first message DoS attack on interface <interface-name> from source IP <none>.


Notification (00017)

Gateway <gateway-name> at <none> in IKE V2 with ID <dst-ip> <peer-id> <action>.


Information (00536)

IKE <version> IKESA: Completed for user <dst-ip>.

IKE <version> child sa with <dst-ip>: Completed negotiations with SPI <exch_type>x, tunnel ID <spi>, and lifetime <tunnel-id> seconds/<lifetime> KB.

IKE <version> CHILD SA with <dst-ip>: Initiated negotiations.

IKE <version> IKESA : Completed IKESA negotiations with <dst-ip>.

IKE <version> IKESA: Responder starts negotiations.

IKE <none> IKEV2 packet: Retransmission limit has been reached.

IKE <none> <dst-ip>: Received DH group <sa_type> instead of expected group <dh-actual>.

IKE <none>: IKE SA (my cookie:<dst-ip>x) was removed due to a simultaneous rekey.

IKE <none>: EAP login failed for user <dst-ip> in <user-name>.

IKE <none>: EAP login was aborted for user <dst-ip> in <user-name>.

IKE <none>: EAP login was passed for user <dst-ip> in <user-name>.

IKE <none>: Received initial contact notification, so removed other IKESAs and all their CHILD SAs.

IKE V2 <none> : Cannot verify RSA signature.

IKE V2 <none> : Cannot verify DSA signature.

IKE V2 <none> : No private key exists to sign packets.

IKE V2 <none> : Received an incorrect public key authentication method.

IKE V2 <none> IKESA: Cert received has a different FQDN SubAltName than expected.

IKE V2 <none> IKESA: Cert received has a different IP address SubAltName than expected.

IKE V2 <none> IKESA: Cert received has a different UFQDN SubAltName than expected.

IKE V2 <none> IKESA: Cert received has a subject name that does not match the ID payload.

IKE V2 <none>: Negotiations have failed for user <dst-ip>.

IKE V2 <none>: Received a notification message for <dst-ip> <message_type>.

IKE V2 <version>:negotiating <dst-ip> packet in status <exch_type> has failed with <status>.

IKE: Removed child SAs after receiving a notification message: <notify_type>.

IKE<version> <src-ip> IKESA: Initiated negotiations.

IKESA negotiations failed. (The preshared keys might not match.)

An initial packet arrived from an unrecognized peer gateway

ID MATCH: no user configuration was found for the received IKE ID type:

The exchange type does not match

The peer sent a nonexistent cookie pair:

The peer sent a packet with ETV2_CREATE_CHILD_SA before IKESA authentication was done

The peer sent a TS that did not match the one in the SA config

The peer sent an unsupported or unexpected exchange type after IKESA negotiation finished :


Interface
----------------------------------------


Critical (00091)

L3 backup failover from interface <interface-name> to interface <interface-name>.

L3 backup recover from interface <interface-name> to interface <interface-name>.


Critical (00094)

Failover to secondary untrust interface occurred.

Recovery to primary untrust interface occurred.


Notification (00009)

802.1Q VLAN tag <tag> has been created.

802.1Q VLAN tag <tag> has been removed.

Activation delay for interface <interface-name> has been changed to <activation_delay>.

Admin status for interface <interface-name> has been changed to <value>.

Auto-failover for interface <interface-name> has been changed to <auto_state>.

Deactivation delay for interface <interface-name> has been changed to <deactivation_delay>.

DNS proxy was <new_status> on interface <interface-name>.

Interface <interface-name> 802.1Q tag has been changed to <tag> <user-name>.

Interface <interface-name> 802.1Q tag has been removed <user-name>.

Interface <interface-name> 802.1Q VLAN trunking has been turned OFF <user-name>.

Interface <interface-name> 802.1Q VLAN trunking has been turned ON <user-name>.

Interface <interface-name> bandwidth has been changed to <bandwidth> Kbps.

Interface <interface-name> gateway IP has been changed from <ip> to <ip> <user-name>.

Interface <interface-name> has been added to aggregate interface <interface-name>.

Interface <interface-name> has been added to redundant interface <interface-name>.

Interface <interface-name> has been added to shared interface <interface-name>.

Interface <interface-name> has been changed from local to VSI.

Interface <interface-name> has been changed from VSI to local.

Interface <interface-name> has been removed from aggregate interface <interface-name>.

Interface <interface-name> has been removed from redundant interface <interface-name>.

Interface <interface-name> has been removed from shared interface <interface-name>.

Interface <interface-name> holddown time interval has been set to <holddown_time>.

Interface <interface-name> in <vsys_name> was removed <user-name>.

Interface <interface-name> in <vsys_name> with IP <ip> mask <netmask> tag <tag> was created <user-name>.

Interface <interface-name> in <vsys_name> with IP <ip> mask <netmask> was created <user-name>.

Interface <interface-name> IP address can be used to manage the device.

Interface <interface-name> IP address cannot be used to manage the device.

Interface <interface-name> IP has been changed from <ip> to <ip> <user-name>.

Interface <interface-name> management IP has been changed from <ip> to <ip> <user-name>.

Interface <interface-name> netmask has been changed from <netmask> to <netmask> <user-name>.

Interface <interface-name> operational mode has been changed to <operational_mode> <user-name>.

Interface <interface-name> physical setting has been changed: <command>

Interface <interface-name> switching to annexL del test mode.

Interface <interface-name> switching to annexL mode.

Interface <interface-name> switching to ANSI T1.413 Issue 2 mode.

Interface <interface-name> switching to auto-negotiating mode.

Interface <interface-name> switching to G.Lite mode.

Interface <interface-name> switching to ITU G.992.1 mode.

Interface <interface-name> switching to ITU G.992.3 annexM mode.

Interface <interface-name> switching to ITU G.992.3 del test mode.

Interface <interface-name> switching to ITU G.992.3 mode.

Interface <interface-name> switching to ITU G.992.5 annexM mode.

Interface <interface-name> switching to ITU G.992.5 del test mode.

Interface <interface-name> switching to ITU G.992.5 mode.

Interface <interface-name> switching to loopback mode.

Interface <interface-name> was bound to zone <zone_name> <user-name>.

Interface <interface-name> was removed from the monitoring list of <interface-name>.

Interface <interface-name> was unbound from zone <zone_name> <user-name>.

Interface <interface-name> with weight <weight> was added to the monitoring list of <interface-name>.

IPv4 Path-MTU has been <new_status> on interface <interface-name> <user-name>.

IPv6 Path-MTU has been <new_status> on interface <interface-name> <user-name>.

Maximum bandwidth <maximum_bandwidth> Kbps on interface <interface-name> is less than total guaranteed bandwidth <guaranteed_bandwidth> Kbps.

Monitoring threshold was modified to <threshold> of <interface-name>.

Mtrace has been <state> on interface <interface-name> <user-name>.

MTU for interface <interface-name> has been changed to <mtu>.

Primary interface <interface-name> set backup interface <interface-name>, type is <type>.

Primary interface <interface-name> unset backup interface <interface-name>.

Route between secondary IP addresses on interface <interface-name> has been disabled.

Route between secondary IP addresses on interface <interface-name> has been enabled.

<phy_name> for interface <interface-name> has been changed to <value>.

Secondary IP address <ip> has been deleted from interface <interface-name>.

Secondary IP address <ip>/<netmask> has been added to interface <interface-name>.

Zone <zone_name> was removed from the monitoring list of <interface-name>.

Zone <zone_name> with weight <weight> was added to the monitoring list of <interface-name>.


Notification (00078)

A dialer CLI is configured: <cli_string>.


Notification (00513)

The physical state of interface <interface-name> has changed to <new_state>.


Notification (00613)

Interface <interface-name> dialed out at channel <channel>.

Interface <interface-name> disconnects at channel <channel>.

Interface <interface-name> idle timer expired.

Interface <interface-name> is connected at channel <channel>.

Interface <interface-name> is disconnecting at channel <channel>.

Interface <interface-name> traffic (<traffic> bps) decreased (less than load-threshold).

Interface <interface-name> traffic (<traffic> bps) increased (greater than load-threshold).


Notification (00626)

Egress traffic notifies interface <interface-name> to start dial-up.

The interface <interface-name> starts auto dial-up after <seconds>s.

The interface <interface-name> starts to hang-up after idle time <seconds>s.


Information (00009)

packet distribution mode has changed to <hashing_mode> in slot <slot_id>.

GARP has been <state> on interface <interface-name> <user-name>.

Global-PRO has been <new_status> on interface <interface-name> <user-name>.

Ident-reset has been <new_status> on interface <interface-name> <user-name>.

Interface <interface-name> has switched to <mode-name> mode.

NSGP <enforcing_IPSec> has been <new_status> on interface <interface-name> <user-name>.

Ping has been <state> on interface <interface-name> <user-name>.

SCS has been <new_status> on interface <interface-name> <user-name>.

set <hashing_mode> on slot<slot_id> chip<chip_id> of 8G2.

SNMP has been <new_status> on interface <interface-name> <user-name>.

SSL has been <new_status> on interface <interface-name> <user-name>.

Telnet has been <new_status> on interface <interface-name> <user-name>.

Web has been <new_status> on interface <interface-name> <user-name>.


Interface6
----------------------------------------


Critical (00101)

DAD detected duplicates for IPv6 address <ip> on interface <interface-name>


Notification (00009)

<new_status> IPv6 function on the interface <interface-name>.

Setting interface <interface-name> IPv6 mode to <mode>.

Unsetting IPv6 mode on interface <interface-name>.


Notification (00071)

DAD completed for IPv6 address <ip> on interface <interface-name>

Initialized IPv6 address <ip> on interface <interface-name>


Notification (00072)

IPv6 Router advertisement reception disabled on interface <interface-name>

IPv6 Router advertisement reception enabled on interface <interface-name>

IPv6 Router advertisement transmission disabled on interface <interface-name>

IPv6 Router advertisement transmission enabled on interface <interface-name>


ISDN
----------------------------------------


Notification (00083)

[isdn] Interface <interface-name> is configured for leased-line <none>.

[isdn] Interface <interface-name> is configured to work with switch type <none> (after reboot).

[isdn] Interface <interface-name> is set for TEI negotiation at <none>.

[isdn] Interface <interface-name> will not send Sending Complete in SETUP message.

[isdn] Interface <interface-name> will send Sending Complete in SETUP message.

[isdn] Leased-line is removed for interface <interface-name>.

[isdn] SPID1 for interface <interface-name> is set to <none>.

[isdn] SPID2 for interface <interface-name> is set to <none>.

[isdn] The calling number for interface <interface-name> is set to <none>.

[isdn] The T310 value for interface <interface-name> is changed from <none> to <none>.


Notification (00618)

[isdn] Interface <interface-id> connected on B channel <none>.

[isdn] Interface <interface-id> disconnected on B channel <none>.

[isdn] Layer2 is <none> on D channel <none>.


L2TP
----------------------------------------


Alert (00043)

Receive StopCCN_msg, remove l2tp tunnel (<src-ip>-<dst-ip>), Result code <outcome> (<result_code_str>).


Alert (00044)

Receive StopCCN_msg, remove l2tp tunnel (<src-ip>-<dst-ip>), Result code <outcome> (<result_code_str>), Error code <error_code> (<error_code_str>).


Alert (00045)

Receive CDN_msg, remove l2tp call, id = <call_id>, user = <user-name>, assigned ip = <dst-ip>, Result code <outcome> (<result_code_str>).


Alert (00046)

Receive CDN_msg, remove l2tp call, id = <call_id>, user = <user-name>, assigned ip = <dst-ip>, Result code <outcome> (<result_code_str>), Error code <error_code> (<error_code_str>).


Notification (00017)

L2TP <l2tp_name>, all-L2TP-users secret <secret> keepalive <keepalive> <action> <user-name>.

L2TP <l2tp_name>, <user-name> ID <user-id> secret <secret> keepalive <keepalive> <action> <user-name>.

L2TP default auth type changed to <auth_type>.

L2TP default ippool changed from <old_ippool_name> to <new_ippool_name>.

L2TP default PPP auth type changed to <ppp_auth_type>.

L2TP default primary DNS server changed from <dst-ip> to <dst-ip>.

L2TP default primary WINS server changed from <dst-ip> to <dst-ip>.

L2TP default RADIUS port changed to <dst-port>.

L2TP default RADIUS secret changed to <radius_secret>.

L2TP default RADIUS server changed to <radius_server>.

L2TP default secondary DNS server changed from <dst-ip> to <dst-ip>.

L2TP default secondary WINS server changed from <dst-ip> to <dst-ip>.

L2TP ippool is unset to default.

L2TP primary DNS server is unset to default.

L2TP primary WINS server is unset to default.

L2TP RADIUS port changed to <dst-port>.

L2TP RADIUS secret is unset to default.

L2TP RADIUS server is unset to default.

L2TP secondary DNS server is unset to default.

L2TP secondary WINS server is unset to default.


Information (00536)

Incorrect L2TP secret in tunnel authentication for L2TP (<dst-ip>).

L2TP at <dst-ip> PPP failed, Failure in <failure_str>.

L2TP tunnel <l2tp_name> created between <src-ip>:<src-port> and <dst-ip>:<dst-port>.

l2tp(<src-ip>/<src-port>-><dst-ip>/<dst-port>), user authentication passed. IP address <dst-ip> assigned to user.

Retry time-out interval expired. L2TP call (peer at <dst-ip>, local at <src-ip>) removed, tunnel ID <tunnel_id>, call ID <call_id>.

Retry time-out interval expired. L2TP tunnel removed (peer at <dst-ip>, local at <src-ip>), tunnel ID <tunnel_id>.


Logging
----------------------------------------


Warning (00002)

Cannot connect to e-mail server <server_name>.

Mail recipients were not configured.

Mail server is not configured.

Unexpected error from e-mail server(state=<state>): <error>.


Notification (00002)

E-mail address 1 has been changed.

E-mail address 2 has been changed.

E-mail notification has been disabled.

E-mail notification has been enabled.

Inclusion of traffic logs with e-mail notification of event alarms has been disabled.

Inclusion of traffic logs with e-mail notification of event alarms has been enabled.

Mail server domain name has been changed.

Mail server IP address has been changed.


MGCP
----------------------------------------


Alert (00063)

MGCP ALG configured to drop unidentified message in NAT mode.

MGCP ALG configured to drop unidentified message in route mode.

MGCP ALG configured to pass unidentified message in NAT mode.

MGCP ALG configured to pass unidentified message in route mode.

MGCP ALG configured to screen high connection rate.

MGCP ALG connection flood rate threshold set to default.

MGCP ALG connection flood rate threshold value set to <num-of-connections-per-second> connections per second.

MGCP ALG disabled on the device.

MGCP ALG enabled on the device.

MGCP ALG inactive media timeout value set to default.

MGCP ALG inactive media timeout value set to <inactive-media-timeout> seconds.

MGCP ALG maximum call duration value set to default.

MGCP ALG maximum call duration value set to <max-call-duration> minutes.

MGCP ALG message flood rate threshold value set to default.

MGCP ALG message flood rate threshold value set to <num-of-messages-per-second> messages per second.

MGCP ALG removed the check for message flood rate.

MGCP ALG transaction timeout value set to default.

MGCP ALG transaction timeout value set to <transaction-timeout> seconds.

The MGCP ALG is configured to screen high message rate.

The MGCP ALG removed the check for connection rate.


Alert (00084)

The device cannot delete MGCP CA Port.

The device cannot delete MGCP UA ALG Port.

The device cannot initialize memory for MGCP.

The device cannot register MGCP CA Port.

The device cannot register MGCP UA Port.

The device cannot unregister MGCP ALG handler.


Notification (00084)

Device failure handling MGCP call because the number of calls exceeded the system limit.

The device cannot register the MGCP ALG request to RM.

The device cannot register the Network Address Translation vector for the MGCP ALG request.

The device does not have MGCP ALG client id with RM.

The device failed in unregistering MGCP client with RM.


Notification (00565)

MGCP decoder error <msg>.

The device cannot allocate sufficient memory for the MGCP ALG request.


Multicast
----------------------------------------


Alert (00601)

Error in initializing multicast.

Failure in initializing multicast data handler task.

Failure in initializing multicast route task.

Failure in registering for multicast data packet.

Failure in shutting down multicast route task.

System-wide multicast cachemiss node limit reached, <vr-nodes> nodes not added since limit exceeded.


Critical (00601)

Failure adding output interface to multicast route list due to exceeding system max. <max-interfac> interfaces not added since limit exceeded.

<vr-name>: virtual router multicast route limit exceeded, mroute addition failed.

<vr-name>: virtual router multicast route maximum, routes not added since limit exceeded - <number>.

System wide multicast route limit exceeded, mroute add failed.

System wide multicast route limit reached, routes not added since limit exceeded - <number>.


Notification (00056)

<logstring>.

<logstring>.


Notification (00057)

<vr-name>: maximum multicast routes limit configured to <number>.

<vr-name>: maximum multicast routes limit removed.

<vr-name>: multicast negative cache routes feature configured.

<vr-name>: multicast negative cache routes feature removed.

<vr-name>: multicast negative cache routes timer configured to default.

<vr-name>: multicast negative cache routes timer configured to <seconds> seconds.

<vr-name>: static multicast route src=<src-ip>, grp=<group-ip> ifp = <interface-name> deleted.

<vr-name>: static multicast route src=<src-ip>, grp=<group-ip> input ifp = <interface-name> output ifp = <interface-name> added.


Notification (00087)

MLD function was disabled on interface <inteface-name>.

MLD function was enabled on interface <inteface-name>.

MLD instance was created on interface <inteface-name>.

MLD instance was deleted on interface <inteface-name>.

MLD query interval was changed to <interval value> seconds on interface <inteface-name>.

MLD static group <group ip> was added on interface <interval value>.


NAT IPsec
----------------------------------------


Information (00536)

The IKE packet from <none> to <src-ip> is dropped since pinhole with id <none> have existed.


NSM
----------------------------------------


Notification (00033)

CA certificate field of NACN policy manager <manager_id> has been set to <ca>.

CA certificate field of NACN policy manager <manager_id> has been unset.

Cert-Subject field of NACN policy manager <manager_id> has been set to <cert_sub>.

Cert-Subject field of NACN policy manager <manager_id> has been unset.

Host field of NACN policy manager <manager_id> has been set to <host>.

Host field of NACN policy manager <manager_id> has been unset.

NSM Device ID was set to <id>.

NSM Device ID was unset.

NSM installer name (<name>) and password were set.

NSM installer name and password were unset.

NSM keys were deleted.

NSM one-time-password was set.

NSM one-time-password was unset.

NSM primary server with name <name> was set: addr <ip_addr>, port <port>

NSM primary server with name <name> was set: addr <ip_addr>, port <port>

NSM primary server with name <name> was unset.

NSM secondary server with name <name> was set: addr <ip_addr>, port <port>

NSM secondary server with name <name> was set: addr <ip_addr>, port <port>

NSM secondary server with name <name> was unset.

Outgoing interface of NACN policy manager <manager_id> has been set to <interface>.

Outgoing interface of NACN policy manager <manager_id> has been unset.

Password field of NACN policy manager <manager_id> has been <string>.

Policy-domain field of NACN policy manager <manager_id> has been set to <domain>.

Policy-domain field of NACN policy manager <manager_id> has been unset.

Port field of NACN policy manager <manager_id> has been reset to the default value.

Port field of NACN policy manager <manager_id> has been set to <port_field>.

Reporting of attack alarms to <sme_name> has been disabled.

Reporting of attack alarms to <sme_name> has been enabled.

Reporting of attack statistics table to <sme_name> has been disabled.

Reporting of attack statistics table to <sme_name> has been enabled.

Reporting of configuration logs to <sme_name> has been disabled.

Reporting of configuration logs to <sme_name> has been enabled.

Reporting of deep inspection alarms to <sme_name> has been disabled

Reporting of deep inspection alarms to <sme_name> has been enabled

Reporting of ethernet statistics table to <sme_name> has been disabled.

Reporting of ethernet statistics table to <sme_name> has been enabled.

Reporting of flow statistics table to <sme_name> has been disabled.

Reporting of flow statistics table to <sme_name> has been enabled.

Reporting of information logs to <sme_name> has been disabled.

Reporting of information logs to <sme_name> has been enabled.

Reporting of miscellaneous alarms to <sme_name> has been disabled.

Reporting of miscellaneous alarms to <sme_name> has been enabled.

Reporting of policy table to <sme_name> has been disabled.

Reporting of policy table to <sme_name> has been enabled.

Reporting of protocol distribution table to <sme_name> has been disabled.

Reporting of protocol distribution table to <sme_name> has been enabled.

Reporting of self management logs to <sme_name> has been disabled.

Reporting of self management logs to <sme_name> has been enabled.

Reporting of traffic alarms to <sme_name> has been disabled.

Reporting of traffic alarms to <sme_name> has been enabled.

Reporting of traffic logs to <sme_name> has been disabled.

Reporting of traffic logs to <sme_name> has been enabled.

<sme_name> has been disabled.

<sme_name> has been enabled.

<sme_name> <which> host has been disabled.

<sme_name> <which> host has been set to <host_ip>.

<sme_name> <which> host has been set to <host>.

<sme_name> VPN management tunnel has been disabled.

<sme_name> VPN management tunnel has been enabled.

The NACN protocol has been <status>

Timeout value of <name> has been set to <second> seconds (default)

Timeout value of <name> has been set to <second> seconds.

User-defined service <service_name> has been added to <sme_name> protocol distribution.

User-defined service <service_name> has been removed from <sme_name> protocol distribution.


Information (00538)

Connection to <host_name> data collector at <ip_addr> has timed out.

Device is not known to <host_name> data collector at <ip_addr>.

Lost socket connection to <host_name> data collector at <ip_addr>.

NACN failed to register to policy manager <host_name> because of <reason>.

NACN successfully registered to policy manager <host_name>: <string>.

NSM request may fail due to low memory (malloc failed)

NSM: Cannot connect to NSM server at <ip_addr>. Reason: <err_id>, <reason> (<count> connect attempt(s))

NSM: Cannot connect to NSM server at <ip_addr>. Reason: <err_id>, <reason> (<count> connect attempt(s))

NSM: Connected to NSM server at <ip_addr> (<count> connect attempt(s))

NSM: Connected to NSM server at <ip_addr> (<count> connect attempt(s))

NSM: Connection to NSM server at <nsm_server> is down. Reason: <err_id>, <reason>

NSM: Connection to NSM server at <nsm_server> is down. Reason: <err_id>, <reason>

NSM: Sent <message> message

The NACN protocol has started for policy manager <manager_id> on hostname <host_name> IP address <ip_addr> port <port>


NSRD
----------------------------------------


Error (00551)

Error <error_no> occurred during configlet file processing.


Warning (00551)

Configlet file authentication failed.

Configlet file decryption failed.

Error <error_no> occurred, causing failure to establish secure management with Management System.


Information (00551)

Rapid Deployment cannot start because gateway has undergone configuration changes.

Secure management established successfully with remote server.


NTP
----------------------------------------


Notification (00531)

Administrator <user-name> changed the Network Time Protocol authentication mode to <auth_mode> (<none>)

Administrator <user-name> changed the Network Time Protocol maximum adjustment value from <old_adj> to <new_adj> seconds (<none>)

An acceptable time could not be obtained from <ntp_server_type> NTP server <ntp_server_name>

An administrator aborted the NTP time update.

An error occurred in setting the system clock.

Authentication failed for Network Time Protocol server <ntp_server_type> <ntp_server_name> because <fail_reason>

Network Time Protocol adjustment of <msec_adjustment> ms from NTP server <ntp_server_name> exceeds the allowed adjustment of <msec_adjustment_allowed> ms.

Network Time Protocol settings changed by <user-name>.

No acceptable time could be obtained from any NTP server.

No NTP server could be contacted.

NTP request cannot be sent. No key found for server <ntp_server_type> <ntp_server_name>

NTP request cannot be sent. No key id found for Network Time Protocol server <ntp_server_type> <ntp_server_name>

NTP server is disabled on interface <interface-name>

NTP server is enabled on interface <interface-name>, mode: <ntp_mode>

<ntp_server_type> NTP server <ntp_server_name> could not be contacted.

The system clock was updated from <ntp_server_type> NTP server type <ntp_server_name> with an adjustment of <msec_adjustment> ms. Authentication was <auth_mode>. Update mode was <update_mode>


Notification (00548)

The NetScreen device is attempting to contact the primary backup NTP server <ntp_server_name>

The NetScreen device is attempting to contact the primary NTP server <ntp_server_name>

The NetScreen device is attempting to contact the secondary backup NTP server <ntp_server_name>


OSPF
----------------------------------------


Critical (00206)

LSA flood in OSPF with router ID <self-router-id> on interface <interface-name> forced the interface to drop a packet.

LSA ID <lsa-id>, router ID <lsa-advertising-router-id>, type <lsa-type> cannot be deleted from the real-time database in area <lsa-area-id>

OSPF instance with router ID <self-router-id> received a Hello packet flood from neighbor (IP address <src-ip>, router ID <neighbor-router-id>) on interface <interface-name> forcing the interface to drop the packet.

Reject second OSPF neighbor (<src-ip>) on interface (<interface-name>) since it's configured as point-to-point interface

The total number of redistributed routes into OSPF in vrouter (<vrouter-name>) exceeded system limit (<system-limit>)


Notification (00038)

<configuation-command>

<set-or-unset> virtual router <vrouter-name> with the configuration command <configuation-command>

<set-or-unset> virtual router <vrouter-name> with the OSPF protocol <configuation-command>

OSPF virtual routing instance in virtual router <vrouter-name> created.

OSPF virtual routing instance in virtual router <vrouter-name> deleted.


Information (00541)

Killing of OSPF neighbor <neighbor-ip> delayed by <delay-seconds> seconds, last hello packet received time <flow-timestamp> ms and last processed hello packet occuring at <task-timestamp> ms.

LSA in following area aged out: LSA area ID <lsa-area-id>, LSA ID <lsa-id>, router ID <advertising-router-id>, type <lsa-type> in OSPF.

Neighbor router ID - <neighbor-router-id> IP address - <neighbor-ip> changed its state to <neighbor-state>.

The system killed OSPF neighbor because of elapsed Hello time <time-elapsed> sec (neighbor router ID <neighbor-router-id>, IP address <neighbor-ip>).

OSPF interface <interface-name> has become inactive, kill neighbor (IP address <neighbor-ip>, router ID <neighbor-router-id>) on this interface.

OSPF neighbor <neighbor-ip> timeout, with last hello packet received at time <flow-timestamp> ms, and last processed hello packet occurring at time <task-timestamp> ms, current elapsed time in seconds <time-elasped>.

OSPF packet retransmit counter exceeds limit, killing neighbor (IP address <neighbor-ip>, router ID <neighbor-router-id>).

The system killed OSPF neighbor because the current router could not see itself in the hello packet. Neighbor changed state from <neighbor-old-state> to Init state, (neighbor router-id <neighbor-router-id>, ip-address <neighbor-ip>).


OSPFv3
----------------------------------------


Critical (00231)

LSA ID <lsa-id>, router ID <lsa-advertisig-router-id>, type <lsa-type> cannot be added to the real-time database in area <lsa-area-id>

LSA ID <lsa-id>, router ID <lsa-advertisig-router-id>, type <lsa-type> cannot be deleted from the real-time database in area <lsa-area-id>

Reject second OSPFv3 neighbor (<neighbor-ip>) on interface (<interface name>) since it's configured as point-to-point interface

The number of OSPFv3 LSAs in vrouter <vrouter-name> exceeded system limit <system-limit>.

The number of OSPFv3 neighbors on interface <interface-name> exceeded system limit <system-limit>.

The number of OSPFv3 network LSAs in area <area-id> of vrouter <vrouter-name> exceeded system limit <system-limit>.

The number of OSPFv3 router LSAs in area <area-id> of vrouter <vrouter-name> exceeded system limit <system-limit>.

The total number of redistributed routes into OSPFv3 in vrouter (<vrouter-name>) exceeded system limit (<system-limit>)


Notification (00089)

<configuration_command>

<set_or_unset> virtual router <vrouter_name> with the configuration command <configuration_command>

<set_or_unset> virtual router <vrouter_name> with the OSPFv3 protocol <configuration_command>

OSPFv3 virtual routing instance in virtual router <vrouter_name> created.

OSPFv3 virtual routing instance in virtual router <vrouter_name> deleted.


Information (00629)

OSPFv3 interface <interface-name> changed its state to <interface-new-state>.

OSPFv3 neighbor <neighbor-router-id> changed its state to <neighbor-state>.

LSA in following area aged out: LSA area ID <lsa-area-id>, LSA ID <lsa-id>, router ID <advertising router id>, type <lsa type> in OSPFV3.

OSPFV3 packet retransmit counter exceeds limit, killing neighbor (IP address <neighbor ip address>, router ID <neighbor router-id>).


PIM
----------------------------------------


Alert (00602)

PIMSM Error in initializing access-list change handler.

PIMSM Error in initializing drp vsi elect change handler

PIMSM Error in initializing interface delete handler

PIMSM Error in initializing interface state change

PIMSM Error in initializing IP change handler

PIMSM Error in initializing MCAST policy change handler.

PIMSM Error in initializing nsrp state change handler.

PIMSM Error in initializing packet copy handler

PIMSM Error in initializing vrouter delete handler

PIMSM Error in initializing zone delete handler


Notification (00058)

PIMSM interface <interface-name> accept neighbors access list <acl-id> configured

PIMSM interface <interface-name> BSR border removed.

PIMSM interface <interface-name> configured as boot-strap border

PIMSM interface <interface-name> DR priority set to <dr-priority>

PIMSM interface <interface-name> hello holdtime set to <hello-hold-time> seconds

PIMSM interface <interface-name> Join-Prune Interval set to <join-prune-interval> seconds

PIMSM interface <interface-name> neighbor access list removed.

PIMSM interface <interface-name>'s Hello Interval set to <join-prune-interval> seconds

PIMSM protocol configured in vrouter <vrouter-name>

PIMSM protocol configured on interface <interface-name>

PIMSM protocol disabled in vrouter <vrouter-name>

PIMSM protocol disabled on interface <interface-name>

PIMSM protocol enabled in vrouter <vrouter-name>

PIMSM protocol enabled on interface <interface-name>

PIMSM protocol removed from vrouter <vrouter-name>

PIMSM protocol unconfigured on interface <interface-name>

Vrouter <vrouter-name> PIMSM multicast group access list removed

Vrouter <vrouter-name> PIMSM multicast group access-list <multicast-group-ip-address-access-list> has been configured

Vrouter <vrouter-name> PIMSM multicast group <multicast-group-ip-address> has been configured with RP access list <access-list>

Vrouter <vrouter-name> PIMSM multicast group <multicast-group-ip-address> has been configured with source access list <access-list>

Vrouter <vrouter-name> PIMSM Rendezvous point access list for multicast group <multicast-group-ip-address> removed

Vrouter <vrouter-name> PIMSM RP address <RP-ip-address> configured for multicast group access list <multicast-group-address-access-list> in zone <zone-name>

Vrouter <vrouter-name> PIMSM RP candidate on interface <interface-name> configured for multicast group access list <multicast-group-address-access-list> in zone <zone-name> with priority <RP-candidate-priority> and holdtime <RP-candidate-hold-time>

Vrouter <vrouter-name> PIMSM RP Candidate removed from zone <zone-name>

Vrouter <vrouter-name> PIMSM RP <rp-ip-address> removed from zone <zone-name>

Vrouter <vrouter-name> PIMSM RP Proxy removed from zone <zone-name>

Vrouter <vrouter-name> PIMSM source access list for multicast group <multicast-group-ip-address> removed

Vrouter <vrouter-name> PIMSM SPT threshold set to infinity

Vrouter <vrouter-name> PIMSM SPT threshold set to <packets-per-second> packets per second

Vrouter <vrouter-name> PIMSM zone <zone-name> configured as RP Proxy.


Notification (00555)

Vrouter <vrouter-name> PIMSM cannot process non-multicast address <ip-address>


PKI
----------------------------------------


Critical (00025)

PKI: Error detected with PKI private key referenced by object id <object_id> by parity check.

PKI: <public/private key signature/verify> fails.


Notification (00535)

PKI: A configurable item (<item>) has changed from (<old>) to (<new>).

PKI: A configurable item (<item>) has changed from (<old>) to (<new>).

PKI: Adjusted key-pair length from 0 to 1024 bits.

PKI: An incoming certificate is broken.

PKI: Auto-generated self-signed cert was deleted.

PKI: Cannot access OCSP server to get revocation status for cert with subject name <cert-sub-name>.

PKI: Cannot auto generate a self-signed cert.

PKI: Cannot build certificate chain for cert with subject name <cert-sub-name>.

PKI: Cannot compose HTTP packet to send to URL <url>.

PKI: Cannot connect to LDAP server <cert-sub-name>:<dst-port> through <interface-name>.

PKI: Cannot contact HTTP server at URL <url>.

PKI: Cannot create a socket to URL <url string>.

PKI: Cannot decode CRL data.

PKI: Cannot decrypt public key of cert with subject name <cert-sub-name>.

PKI: Cannot delete the key-pair object for cert with subject name <cert-sub-name>.

PKI: Cannot extract SCEP SUCCESS response. Error: <reason>, for cert request with subject name <cert-sub-name>.

PKI: Cannot generate cert request. Reason: <reason> (subject name <cert-sub-name>).

PKI: Cannot generate PKCS #10 file for certificate request.

PKI: Cannot generate <key-type> key pair with subject name <cert-sub-name>.

PKI: Cannot generate SCEP data. Cmd: <command>, error: <reason>, for cert request with subject name <cert-sub-name>.

PKI: Cannot initiate SCEP request with subject name <cert-sub-name>.

PKI: Cannot load CRL for cert with subject name <cert-sub-name>.

PKI: Cannot load item from flash. Reason: <reason>, type: <type-object>, DN: <DN>.

PKI: Cannot load <file type> file.

PKI: Cannot locate config for CA with ID <id number of CA certificate>.

PKI: Cannot locate key pair with ID <key-id> for SCEP.

PKI: Cannot locate the key-pair object for cert with subject name <cert-sub-name>.

PKI: Cannot retrieve the <type of object> with subject name <cert-sub-name>.

PKI: Cannot return to the original certificate chain. Cookies: (<cert-chain-id>x)(<cert-chain-id>x)(<cert-chain-id>x)(<cert-chain-id>x).

PKI: Cannot save CA config (CA cert subject name <cert-sub-name>).

PKI: Cannot save CA configuration (CA cert subject name <cert-sub-name>).

PKI: Cannot save new item to flash. Max: (<max size allowed for flash>), item: (<got size to be saved to flash>).

PKI: Cannot save the key-pair object for cert with subject name <cert-sub-name>.

PKI: Cannot save the <object-type> with subject name <cert-sub-name>.

PKI: Cannot send HTTP packet through socket to URL <url string>.

PKI: Cannot send PKCS #10 cert request to e-mail address <email-address>.

PKI: Cannot store config for CA with cert subject name <cert-sub-name>.

PKI: Cannot sync data to NSRP peer. (command <command>).

PKI: Cannot sync <cert-sub-name> to NSRP peer. (command <command>).

PKI: Cannot verify cert for ScreenOS image authentication.

PKI: Cannot verify OCSP responder cert with subject name <cert-sub-name>.

PKI: Cannot verify signature on OCSP response for cert with subject name <cert-sub-name>.

PKI: Cannot wrap SCEP request. Error: <reason>, for cert request with subject name <cert-sub-name>.

PKI: Cert has expired (subject name <cert-sub-name>).

PKI: Cert is not yet valid (subject name <cert-sub-name>).

PKI: Cert requested already exists for subject name <cert-sub-name>.

PKI: Certificate chain is too long for cert with subject name <cert-sub-name>.

PKI: Certificate has been revoked (subject name <cert-sub-name>).

PKI: Completed NSRP cold start sync after <number of attempts> attempts.

PKI: Completed SCEP cert request.

PKI: CRL cannot be saved to flash, issuer (<cert-sub-name>).

PKI: CRL has a bad timestamp. (CA <cert-sub-name>).

PKI: CRL has bad signature for cert with subject name <cert-sub-name>.

PKI: CRL has expired for cert with subject name <cert-sub-name>.

PKI: CRL has expired. (CA <cert-sub-name>).

PKI: CRL is not issued by the CA that signed the cert with subject name <cert-sub-name>.

PKI: CRL is not yet valid for cert with subject name <cert-sub-name>.

PKI: CRL is too big (<size of CRL>) to load. Max: <max size allowed for flash>, CA: <cert-sub-name>.

PKI: CRL is too big (<size of CRL>) to save to flash. Max: <max size allowed for flash>, CA: <cert-sub-name>.

PKI: CRL server closed LDAP socket when verifying cert with subject name <cert-sub-name>.

PKI: CRL will be refreshed as configured on the interupdate refresh setting. (CA <cert-sub-name>).

PKI: Failed to obtain CRL for CA issuing cert with subject name <cert-sub-name>.

PKI: Failed to obtain object ID (<object-id>x)(<object-id>).

PKI: Format error in CRL lastUpdate field for cert with subject name <cert-sub-name>.

PKI: Format error in CRL nextUpdate field for cert with subject name <cert-sub-name>.

PKI: Format error in the notAfter field of cert with subject name <cert-sub-name>.

PKI: Format error in the notBefore field of cert with subject name <cert-sub-name>.

PKI: generate <key type string> key pair successfully with subject name <cert-sub-name>.

PKI: Incorrect fingerprint for CA cert with subject name <cert-sub-name>.

PKI: Internal configuration error. Cannot verify cert with subject name <cert-sub-name>.

PKI: Invalid certificate (subject name <cert-sub-name>).

PKI: item in flash file incorrect, type(<type>x) len(<len>).

PKI: LDAP bind operation timed out for cert with subject name <cert-sub-name>.

PKI: LDAP cannot search for DN (<DN>) using filter (<filter>).

PKI: LDAP modify add is not supported.

PKI: LDAP modify delete is not supported.

PKI: LDAP operation timed out for cert with subject name <cert-sub-name>.

PKI: Loaded a flash file with PKI data in an earlier format (version 0).

PKI: No response for status inquiry for cert with subject name <cert-sub-name>.

PKI: No revocation check, per config, for cert with subject name <cert-sub-name>.

PKI: NSRP cold start sync attempt <current attempt> failed.

PKI: NSRP cold start sync failed.

PKI: NSRP cold start sync for <number of items in this cold start sync session> items.

PKI: NSRP cold start sync session cannot locate item <index number of an item>.

PKI: NSRP cold start sync session interrupted by normal sync item.

PKI: NSRP cold start sync. Received item <number of currently received item> before first item.

PKI: NSRP cold start sync. Received item <number of currently received item> out of order, expecting <number of expected item> of <number of total item>.

PKI: Number of PKI objects exceeds storage maximum (<max-item>).

PKI: OCSP response was inconclusive for cert with subject name <cert-sub-name>.

PKI: Out of memory. Cannot process cert with subject name <cert-sub-name>.

PKI: Per config, accepted cert even though CRL has a bad signature. (subject name <cert-sub-name>).

PKI: Per config, accepted cert even though revocation check was inconclusive (subject name <cert-sub-name>).

PKI: PKI objects exceeded maximum capacity (<maximum number of item list>).

PKI: PKI storage file is empty.

PKI: Received a SCEP FAILURE message for cert request with subject name <cert-sub-name>.

PKI: Received a self-signed cert in a certificate chain for cert with subject name <cert-sub-name>.

PKI: Received a self-signed cert with subject name <cert-sub-name>.

PKI: Received bad LDAP response for cert with subject name <cert-sub-name>.

PKI: Received CA cert with bad fingerprint (CA cert subject name <cert-sub-name>).

PKI: Renewing cert through SCEP (subject name <name>).

PKI: request NSRP cold start sync at <number of attempts> seconds.

PKI: <object-type> has been deleted. (subject name <cert-sub-name>).

PKI: <object type string> has been deleted. (subject name <cert-sub-name>).

PKI: Saved CA config (CA cert subject name <cert-sub-name>).

PKI: Saved CA configuration (CA cert subject name <cert-sub-name>).

PKI: Saved PKI objects to flash.

PKI: Saved <object-type> with subject name <DN>.

PKI: SCEP error: <error>, for cert with subject name <name>.

PKI: Successfully loaded image signer's public key.

PKI: System auto generated a self-signed cert.

PKI: Top cert of chain for peer's cert was wrong. Config required <cert-sub-name>, but derived <cert-sub-name>.

PKI: Unable to authenticate cert with subject name <cert-sub-name>.

PKI: Unable to decode issuer's public key for cert with subject name <cert-sub-name>.

PKI: Unable to decrypt signature of cert with subject name <cert-sub-name>.

PKI: Unable to decrypt signature of CRL for cert with subject name <cert-sub-name>.

PKI: Unable to get issuer cert for cert with subject name <cert-sub-name>.

PKI: Unable to get local issuer cert for cert with subject name <cert-sub-name>.

PKI: Unable to verify first cert in a certificate chain (subject name <cert-sub-name>).

PKI: Unable to verify the validity of cert with subject name <cert-sub-name>.

PKI: Updated config for CA with ID <id number of CA certificate> from a global CA config.

PKI: Verified cert with subject name <cert-sub-name>.


Policy
----------------------------------------


Notification (00018)

Default policy of the device has been changed to <state> <user-name>.

In policy <policy-id>, the application was modified to <service-name> <user-name>.

In policy <policy-id>, the attack severity was modified <user-name>.

In policy <policy-id>, the DI attack component was modified <user-name>.

In policy <policy-id>, the option <opt-name> was <opt-status>.

Policy (<policy-id>, global, <addr-name>-><addr-name>,<service-name>, <action>) was added <user-name>.

Policy (<policy-id>, <zone-name>-><zone-name>, <addr-name>-><addr-name>,<service-name>, <nat> <action>) was added <user-name>.

Policy (<policy-id>, <zone-name>-><zone-name>, <addr-name>-><addr-name>,<service-name>, <action>) was deleted <user-name>.

Policy (<policy-id>, <zone-name>-><zone-name>, <addr-name>-><addr-name>,<service-name>, <action>) was modified <user-name>.

Policy (<policy-id>, <zone-name>-><zone-name>, <addr-name>-><addr-name>,<service-name>, <action>) was <state> <user-name>.

Policy <policy-id> has been moved after <dst_policy_id> <user-name>.

Policy <policy-id> has been moved before <dst_policy_id> <user-name>.

<cell-name> <cell-name> was <action> policy ID <policy-id> <user-name>.

The policy install hold-interval is set to <hold-interval> seconds <user-name>.


PPP
----------------------------------------


Alert (00095)

No IP pool has been assigned. You cannot allocate an IP address.


Alert (00096)

Cannot allocate IP address from pool <ip_pool_name> for user <user-name>.


Notification (00017)

IP address pool <ip_pool_name> was removed <user-name>.

IP address pool <ip_pool_name> with range <ip_address> - <ip_address> was created <user-name>.

IP address pool <ip_pool_name> with range <ip_address> - <ip_address> was removed <user-name>.

Range <ip_address> - <ip_address> was added to IP pool <ip_pool_name> <user-name>.

Range <ip_address> - <ip_address> was removed from IP pool <ip_pool_name> <user-name>.


Notification (00077)

PPP profile <profile-name> changes authentication type to <auth-type>.

PPP profile <profile-name> changes local-name to <local-name>.

PPP profile <profile-name> changes secret to <secret>.

PPP profile <profile-name> is <none>.

PPP profile <profile-name> <none> passive mode CHAP.

PPP profile <profile-name> sets ncp <ncp-type>.

PPP profile <profile-name> sets netmask <netmask>.

PPP profile <profile-name> sets <none> use static IP.

PPP <none> encapsulation <encap-type> for interface <interface-name>.

PPP <none> interface <interface-name> <none> bundle <interface-name>.

PPP <none> profile <profile-name> for interface <interface-name>.

PPP <none> short sequence number for interface <interface-name>.

PPP set MRRU <MRRU> for interface <interface-name>.


Notification (00088)

PPP control packet queue on <interface-name> takes on <none> packets.

PPP on <interface-name> detects loopback.


Notification (00572)

PPP authentication state on interface <interface-name>: <none>.

PPP bundle <interface-name> is <none> and then brings <none> bundle NCP.

PPP LCP on interface <interface-name> is <none>.

PPP member <interface-name> fails to join bundle <interface-name> for <reason>.

PPP member <interface-name> joins bundle <interface-name> successfully.

PPP on interface <interface-name> finds possible loopback.

PPP on interface <interface-name> is terminated by missing too many echo replies.

PPP on interface <interface-name> is terminated by receiving Terminate-Request.

PPP on <interface-name> resets LCP for <reason>.

PPP protocol on interface <interface-name> is <status>, local IP: <local-ip>, peer IP: <peer-ip> .

PPP protocol on interface <interface-name> is <none>, local IPv6: <ipv6_address>, peer IPv6: <ipv6_address> .

PPP updates interface <interface-name>'s IP to <ip_address> .

PPP updates interface <interface-name>'s IPv6 to <ipv6_address>.

PPP updates interface <interface-name>'s L3 MTU to <MTU>.


PPPoA
----------------------------------------


Notification (00060)

PPPoA is disabled on <interface-name> interface.

PPPoA is enabled on <interface-name> interface.


Notification (00558)

PPPoA <pppoa_name> connected successfully.

PPPoA <pppoa_name> connection attempt failed (<reason>).

PPPoA <pppoa_name> failed to modify the gateway for the interface.

PPPoA <pppoa_name> failed to modify the IP for the interface.

PPPoA <pppoa_name> failed to negotiate the IP for the interface.

PPPoA <pppoa_name> idle timeout.

PPPoA <pppoa_name> shutdown.

PPPoA <pppoa_name> started negotiation.


PPPoE
----------------------------------------


Notification (00034)

Point-to-Point Protocol over Ethernet (PPPoE) settings changed.

PPPoE is disabled on <interface-name> interface.

PPPoE is enabled on <interface-name> interface.


Notification (00537)

AC <access_concentrator> is advertising URL <url_string>

Failed to set PPPoE interface gateway.

Failed to set PPPoE interface IP address.

Failed to set PPPoE IPv6 interface gateway.

Message from AC <access_concentrator>: <message_from_ac>

Point-to-Point Protocol over Ethernet (PPPoE) connection failed to establish a session. No IP address assigned.

Point-to-Point Protocol over Ethernet (PPPoE) connection failed to establish a session. No IPv6 address assigned.

Point-to-Point Protocol over Ethernet (PPPoE) connection failed to establish a session. <pppoe_packet_received_type> received.

Point-to-Point Protocol over Ethernet (PPPoE) connection failed to establish a session. Timeout <timeout_reason>

PPPoE session closed by AC.

PPPoE session shut down by user.

PPPoE session shut down, PPPoE disabled.

PPPoE session shut down. Idle timeout.

PPPoE session shuts down for <pppoe_instance_name> instance due to system reset.

PPPoE session started negotiations.

PPPoE session termination or failure during: <ppp_fail_reason>

PPPoE session was successfully established.


RIP
----------------------------------------


Critical (00207)

RIP database size limit exceeded for <vrouter-name>, RIP route dropped.

System wide RIP route limit exceeded, RIP route dropped.

<route-drop-count> RIP routes dropped, RIP database size exceeded in vr <vrouter-name>.

<route-drop-count> RIP routes dropped, system wide RIP route limit exceeded.

Virtual router <vrouter-name> that received an update packet flood from neighbor <src-ip> on interface <interface-name> dropped a packet.

The total number of redistributed routes into RIP in vrouter (<vrouter-name>) exceeded system limit (<system-limit>).


Critical (00227)

RIPng database size limit exceeded for <vrouter-name>, RIPng route dropped.

System wide RIPng route limit exceeded, RIPng route dropped.

<route-drop-count> RIPng routes dropped, RIP database size exceeded in vr <vrouter-name>.

<route-drop-count> RIPng routes dropped, system wide RIPng route limit exceeded.

Virtual router <vrouter-name> that received an update packet flood from neighbor <src-ip> on interface <interface-name> dropped a packet.

The total number of redistributed routes into RIPng in vrouter (<vrouter-name>) exceeded system limit (<system-limit>).


Notification (00045)

RIP instance in virtual router <vrouter-name> was created.

RIP instance in virtual router <vrouter-name> was removed.

<configuration-command>

<set-or-unset> virtual router <vrouter-name> with the configuration command <configuration-command>.

<set-or-unset> vrouter <vrouter-name> protocol RIP received configuration command <configuration-command>.


Notification (00073)

RIPng instance in virtual router <vrouter-name> created.

RIPng instance in virtual router <vrouter-name> removed.

<configuration-command>

<set-or-unset> virtual router <vrouter-name> with the configuration command <configuration-command>.

<set-or-unset> vrouter <vrouter-name> protocol RIP received configuration command <configuration-command>.


Information (00544)

RIP neighbor <neighbor-ip> in virtual router <vrouter-name> added.

RIP neighbor <neighbor-ip> in virtual router <vrouter-name> removed.


Information (00562)

RIPng neighbor <neighbor-ip> in virtual router <vrouter-name> added.

RIPng neighbor <neighbor-ip> in virtual router <vrouter-name> removed.


Route
----------------------------------------


Critical (00205)

A new route cannot be added to the device because the maximum number of system route entries (<max-routes>) has been exceeded.

A route <dst-ip>/<dst-mask> cannot be added to the virtual router <vrouter-name> because the number of route entries in the virtual router exceeds the maximum number of routes (<max-routes>) allowed.

A route <dst-ip>/<dst-mask> cannot be added to the virtual router <vrouter-name> because the number of route entries in the virtual router exceeds the maximum number of routes (<max-routes>) allowed

An error occurred on virtual router <vrouter-name> while removing route <dst-ip>/<dst-mask> from virtual router route table.

Error occurred while adding route <dst-ip>/<dst-mask> to virtual router <vrouter-name> route table because the db_insert function failed.

Error occurred while adding route <dst-ip>/<dst-mask> to virtual router <vrouter-name> route table because the prefix add function failed.

Error while adding IPv6 route <dst-ip>/<dst-mask> to vrouter <vrouter-name>, db_insert failed.

Error while adding route <dst-ip>/<dst-mask> to vrouter <vrouter-name>, prefix add failed.

IPv6 neighbor gateway <gateway> is reachable.

IPv6 neighbor gateway <gateway> is unreachable.

<vrouter-name> Error while deleting route <dst-ip>/<dst-mask> from route table.


Critical (00229)

Error in rebuilding the PBR policy lookup tree for <pbr-policy-name> in virtual router <vrouter-name>.

Unable to add PBR policy <pbr-policy-name> in virtual router <vrouter-name>. Exceeded maximum number of policies (<max-pbr-pol-num>).


Notification (00011)

An SIBR route in virtual router <vrouter-name> with an IP address <src-ip>/<src-mask> and next-hop as virtual router <next-hop-vrouter-name> created.

IPv6 route in virtual router <vrouter-name> that has IP address <dst-ip>/<dst-mask> through interface <interface-name> and gateway <gateway> with metric <route-metric> created.

IPv6 route in virtual router <vrouter-name> with an IP address <dst-ip>/<dst-mask> and next-hop as virtual router <next-hop-vrouter-name> created.

IPv6 Route(s) in virtual router <vrouter-name> with an IP address <dst-ip>/<dst-mask> and gateway <gateway> deleted.

Route in virtual router <vrouter-name> that has IP address <dst-ip>/<dst-mask> through interface <interface-name> and gateway <gateway> with metric <route-metric> created.

Route in virtual router <vrouter-name> with IP address <dst-ip>/<dst-mask> and next-hop as virtual router <next-hop-vrouter-name> created.

Route(s) in virtual router <vrouter-name> with an IP address <dst-ip>/<dst-mask> and gateway <gateway> deleted.

Source route in virtual router <vrouter-name> with an IP address <src-ip>/<src-mask> and next-hop as virtual router <next-hop-vrouter-name> created.

Source route(s) in virtual router <vrouter-name> with route addresses of <dst-ip>/<dst-mask> and a default gateway address of <next-hop-ip-addr> removed.

Source route(s) in virtual router <vrouter-name> with route addresses of <dst-ip>/<dst-mask> through interface <interface-name> and a default gateway address <next-hop-ip-addr> with metric <route-metric> created.

IPv4 default-router <dst-ip> learned from RA added.

IPv4 default-router <dst-ip> learned from RA deleted.

IPv6 default-router <dst-ip> learned from RA added.

IPv6 default-router <dst-ip> learned from RA deleted.

SIBR route in virtual router <vrouter-name> for interface <interface-name> that has IP address <src-ip>/<src-mask> through interface <interface-name2> and gateway <next-hop-ip-addr> with metric <route-metric> created.

SIBR Route(s) in virtual router <vrouter-name> for interface <interface-name> with an IP address <src-ip>/<src-mask> and gateway <next-hop-ip-addr> removed.


Notification (00048)

access list <access-list-id> sequence number <access-list-sequence-num> default-route with action <permit-or-deny> is created in vrouter <vrouter-name>

Access list entry <access-list-id> was removed from virtual router <vrouter-name>

Access list entry <access-list-id> was removed from virtual router <vrouter-name>

Access list entry <access-list-id> with a sequence number <access-list-sequence-num> that <permit-or-deny> IP address <ip-addr>/<ip-mask> is being deleted from virtual router <vrouter-name>

Access list entry <access-list-id> with sequence number <access-list-sequence-num> with an action of <permit-or-deny> with an IP address and subnetwork mask of <ip-addr>/<ip-mask> was created on virtual router <vrouter-name>

An <import-or-export-rule> rule applied to a connection between virtual router <source-vrouter-name> and virtual router <destination-vrouter-name> with IP prefix <ip-prefix>/<ip-mask> was <created-or-deleted>

An <import-or-export-rule> rule in virtual router <source-vrouter-name> to virtual router <destination-vrouter-name> with route map <route-map-name> and protocol <protocol-name> was <created-or-deleted>

Ipv6 access list <access-list-id> created in vrouter <vrouter-name>

Ipv6 access list <access-list-id> sequence number <access-list-sequence-num> <permit-or-deny> ip <ip-addr>/<ip-mask> created in vrouter <vrouter-name>

IPv6 access list <access-list-id> sequence number <access-list-sequence-num> <permit-or-deny> ip <ip-addr>/<ip-mask> is being deleted in vrouter <vrouter-name>

Route entry with sequence number <route-map-sequence-number> in route map <route-map-name>, virtual router <vrouter-name> was removed.

Route map entry with sequence number <route-map-sequence-number> in route map <route-map-name> in virtual router <vrouter-name> was created.

Route map <route-map-name> in virtual router <vrouter-name> was removed.

<configuration-command>


Notification (00080)

PBR policy <pbr-policy-name> added to virtual router <vrouter-name>. Total policies in vr: <num-pbr-pol-in-vrouter>.

PBR policy <pbr-policy-name> deleted from virtual router <vrouter-name>. Total policies in vr: <num-pbr-pol-in-vrouter>.


Notification (00615)

PBR policy <pbr-policy-name> lookup tree rebuilt successfully in virtual router <vrouter-name>.

PBR policy <pbr-policy-name> rebuilding lookup tree for virtual router <vrouter-name>.


SCCP
----------------------------------------


Alert (00062)

SCCP ALG call flood rate threshold set to default of <calls-per-minute> per minute.

SCCP ALG call flood rate threshold set to <calls-per-minute> calls per minute.

SCCP ALG inactive media timeout configured to default <inactive-media-timeout> seconds.

SCCP ALG inactive media timeout configured to <inactive-media-timeout> seconds.

SCCP ALG protection against call flood is disabled.

SCCP ALG protection against call flood is enabled.

SCCP ALG registered line break to <type-of-line-break-proxy-or-rsm>.

SCCP ALG strict parsing disabled on the device.

SCCP ALG strict parsing enabled on the device.

SCCP ALG will drop the unknown messages in NAT mode.

SCCP ALG will drop the unknown messages in route mode.

SCCP ALG will not drop the unknown messages in NAT mode.

SCCP ALG will not drop the unknown messages in route mode.


Alert (00083)

Can't allocate memory for SCCP call context.

Can't allocate NAT cookie (Cause is probably too many calls).

SCCP ALG maximum call environment value (<sccp-max-call-env-value>) invalid, maximum call number set to <sccp-max-call-value-set>.

SCCP call from <src-ip> dropped due to out-bound call rate exceed from that client.

The device cannot delete SCCP ALG Port.

The device cannot initialize memory for SCCP.

The device cannot register SCCP Port.

The device cannot register the Network Address Translation vector for the SCCP ALG request.

The device cannot register the SCCP ALG request to RM.

The device cannot unregister SCCP ALG handler.

The device does not have SCCP ALG client id with RM.

The device failed in handling SCCP call since number of calls exceeded the system limit.

The device failed in registering SCCP client with VSIP.

The device failed in unregistering SCCP client with RM.


Notification (00062)

SCCP ALG disabled on the device.

SCCP ALG enabled on the device.


Notification (00561)

SCCP decoder error <msg>.

The device cannot allocate sufficient memory for the SCCP ALG request.


Schedule
----------------------------------------


Notification (00020)

Schedule <sched_name> <action_added_modified_deleted> <config_changer>.


SCTP
----------------------------------------


Notification (00091)

SCTP <none> <none> <none>; <none>

SCTP <none> <none>; <none>


Notification (00630)

M3UA Data parameter SI check: <none> <none>, counter <none>

SCCP Global Title check: <none> <none>

SCTP Data chunk type check: <none> <none>, counter <none>

SCTP enter <none>: <none>

SCTP <none>; <none>


Service
----------------------------------------


Notification (00012)

Service group <service_group_name> <config_action_add_delete_modify> <member_name> <config_changer>.

Service group <service_group_name> <config_action_add_delete_modify> <config_changer>.

Service <service_name> <config_action_add_delete_modify> <config_changer>.


SFP
----------------------------------------


Critical (00620)

Sfp error: get <none> register (dev <none>, reg <none>) fail.

Sfp error: set <none> register (dev <none>, reg <none>, value 0x<none>) fail.


Critical (00752)

Sfp error: <none>.


Notification (00620)

Sfp event: <none>.

Sfp event: the status of sfp interface <interface-name> change to link <none>, duplex <none>, speed <none>.

Sfp init: <none>.

Sfp setting: set interface <interface-name> <none>.


SHDSL
----------------------------------------


Notification (00617)

interface <interface-name> link status change to up.

configure G.SHDSL interface <interface-name>: <none>.

G.SHDSL card on slot <none> is found.

G.SHDSL card on slot <none> set up completely.

interface <interface-name> error: <none>.

interface <interface-name> link status change to down.


SIP
----------------------------------------


Alert (00046)

An administrator disables SIP ALG.


Notification (00046)

An administrator enables SIP ALG.

An administrator enables SIP IP denial protection for all servers.

An administrator permits SIP unknown messages in NAT mode.

An administrator permits SIP unknown messages in route mode.

An administrator set SIP IP denial timeout to default.

An administrator set SIP unknown messages permission to default.

An administrator set the media inactivity timeout value to its default value of <timeout> seconds.

An administrator set the SIP invite timeout value to its default value of <timeout> seconds.

An administrator set the SIP invite timeout value to <timeout> seconds.

An administrator set the SIP media inactivity timeout value to <timeout> seconds.

An administrator set the SIP ringing timeout value to its default value of <timeout> seconds.

An administrator set the SIP ringing timeout value to <timeout> seconds.

An administrator set the SIP signaling inactivity timeout value to its default value of <timeout> seconds.

An administrator set the SIP signaling inactivity timeout value to <timeout> seconds.

An administrator set the SIP trying timeout value to its default value of <timeout> seconds.

An administrator set the SIP trying timeout value to <timeout> seconds.

An administrator sets SIP C timeout to default value.

An administrator sets SIP C timeout to <timeout> minutes.

An administrator sets SIP IP denial protection for IP <ip>.

An administrator sets SIP IP denial protection for IPv6 <ip>.

An administrator sets SIP IP denial timeout to <timeout>.

An administrator sets SIP T1 interval to default value.

An administrator sets SIP T1 interval to <timeout> msec.

An administrator sets SIP T4 interval to default value.

An administrator sets SIP T4 interval to <timeout> seconds.

An administrator sets SIP unknown messages permission to default.

An administrator unsets SIP IP denial protection for IP <ip>.

An administrator unsets SIP IP denial protection for IPv6 <ip>.

An administrator unsets SIP IP denial protection.


Notification (00767)

Cannot allocate SIP call because device is fielding too many calls.

Security devices do not support multicast IP addresses <ip-addr> in SIP <header-field>.

Security devices do not support multiple IP addresses <ip-addr> or ports <port> in SIP headers <header-field>.

SIP ALG is unregistered by RM.

SIP call information data is too long.

SIP parser error <msg>.

SIP structure is corrupted.

The device cannot allocate sufficient memory for the SIP ALG request.

The device cannot initialize memory pool.

The device cannot initialize SIP Endpoint listener.

The device cannot initialize SIP Endpoint.

The device cannot register SIP ALG port.

The device cannot register the NAT vector for the SIP ALG request.

The device cannot register the SIP ALG request to RM.

The device cannot remove SIP ALG port.

The device failed to remove NAT vector.

Too many call segments for response.

Too many call segments.

Transaction data is too long.

Transaction data too long for response.


SNMP
----------------------------------------


Notification (00002)

SNMP listen port has been changed from <src-port> to <dst-port>.


Notification (00031)

Host <host_address> is added into community <community>.

Host <host_address> is removed from community <community>.

SNMP engine ID has been changed from <engine_id_old> to <engine_id_new>.

SNMP system contact has been changed to <snmp_contact>.

SNMP system location has been changed to <snmp_location>.

SNMP system name has been changed to <snmp_name>.

SNMP USM user <user_name> state changed: action is <action to take>.


Information (00524)

SNMP request from an unknown SNMP community <snmp_community> at <src-ip>:<src-port> has been received.

SNMP request from <src-ip>:<src-port> has been received, but the SNMP version type is incorrect.

SNMP request has been received from an unknown host in SNMP community <snmp_community> at <src-ip>:<src-port>.

SNMP request has been received from host <src-ip>:<src-port> with read-only privileges.

SNMP request has been received from host <src-ip>:<src-port> without read privileges.

SNMP response to the SNMP request from <src-ip>:<src-port> has failed due to a coding error.

SNMP trap sending failed: <description>.

SNMP user/community <user/community> doesn't exist.

SNMP USM user <user> authentication failed

SNMP USM user <user> decryption error

SNMP: The security device has responded successfully to the SNMP request from <src-ip>:<src-port>.


SSHv1
----------------------------------------


Critical (00034)

SSH: FIPS self test failed.

SSH: Security device failed to generate a PKA RSA challenge for SSH admin <admin_name> at <ip_addr> (Key ID <key_id>).

SSH: Unable to perform FIPS self test.


Error (00034)

SSH: Maximum number of SSH sessions (<max_count>) exceeded. Connection request from SSH user <user-name> at <client_ip> denied.

SSH: Unable to validate cookie from the SSH client at <ip_addr>.


Error (00528)

SSH: Failed to send identification string to client host at <ip_addr>.

SSH: Incompatible SSH version string has been received from SSH client at <ip_addr>.

SSH: Security device failed to identify itself to the SSH client at <client_ip>.


Warning (00528)

SSH: Disabled for <vsys_name>. Attempted connection failed from <ip_addr>:<port>.

SSH: Host client has requested NO cipher from <ip_addr>.

SSH: SSH client at <remote_addr> tried unsuccessfully to establish an SSH connection to interface <interface_name> with IP <local_addr> SSH disabled on that interface.

SSH: SSH client at <remote_addr> tried unsuccessfully to make an SSH connection to interface <interface_name> with IP <local_addr> SSH not enabled on that interface.

SSH: SSH client <ip_addr> unsuccessfully attempted to make an SSH connection to <vsys_name> SSH was not completely initialized for that system.

SSH: SSH user <user-name> at <ip_addr> tried unsuccessfully to log in to <vsys_name> using the shared untrusted interface. SSH disabled on that interface.

SSH: Unsupported cipher type '<cipher_name>' requested from <ip_addr>.


Information (00026)

SSH: SSH disabled for <vsys_name>.

SSH: SSH enabled for <vsys_name>.


Information (00528)

SSH: Connection has been terminated for admin user <user-name> at <src-ip>.

SSH: Key regeneration interval has been changed from <old_interval> to <new_interval>.

SSH: SSH has been disabled for <vsys_name> with <key_count> existing PKA key(s) bound to <user_count> SSH user(s).

SSH: SSH has been enabled for <vsys_name> with <key_count> existing PKA key(s) bound to <user_count> SSH user(s).

SSH: SSH user <user-name> at <ip_addr> failed the PKA RSA challenge. (Key ID <key_id>).

SSH: SSH user <user-name> at <ip_addr> has requested password authentication, which is not enabled for that user.

SSH: SSH user <user-name> at <ip_addr> has requested PKA RSA authentication which is not supported for that user.

SSH: SSH user <user-name> has been authenticated using password from <src-ip>.

SSH: SSH user <user-name> has been authenticated using PKA RSA from <ip_addr> (Key ID <key_id>).


SSHv2
----------------------------------------


Alert (00034)

Potential replay attack detected on SSH connection initiated from <src-ip>:<src-port>


Critical (00034)

SCP: Admin user '<user-name>' attempted to transfer file '<direction>' <file_name> the device with insufficient privilege.

SSH: Error processing packet from host <ip_addr> (Code <code_id>).

SSH: Failed to retrieve PKA key bound to SSH user <user-name> (Key ID <key_id>).


Error (00026)

SSH: Attempt to bind duplicate PKA key to admin user '<user-name>' (Key ID <key_id>).

SSH: Failed to bind PKA key to SSH admin user '<user-name>'. (Key ID <key_id>).

SSH: Failed to unbind PKA key from admin user '<user-name>' (Key ID <key_id>).

SSH: Maximum number of PKA keys (<max_key_count>) has been bound to user '<user-name>' Key not bound. (Key ID <key_id>).


Error (00034)

SSH: Device failed to send initialization string to client at <ip_addr>.


Error (00528)

SSH: Client at <ip_addr> attempted to connect with invalid version string.

SSH: Failed to negotiate encryption algorithm with host <ip_addr>.

SSH: Failed to negotiate host key algorithm with host <ip_addr>.

SSH: Failed to negotiate key exchange algorithm with host <ip_addr>.

SSH: Failed to negotiate MAC algorithm with host <ip_addr>.


Warning (00528)

SCP: Admin user '<user-name>' requested unknown file '<file_name>'.

SCP: Admin '<user-name>' at host <ip_addr> executed invalid scp command: '<command>'.

SCP: Disabled for '<vsys_name>'. Attempted file transfer failed from host <ip_addr>.

SSH: Admin '<user-name>' at host <src-ip> attempted to be authenticated with no authentication methods enabled.

SSH: Admin user '<user-name>' at host <ip_addr> requested unsupported PKA algorithm <pka_alg_name>.

SSH: Admin user <user-name> at host <ip_addr> requested unsupported authentication method <auth_method_name>.

SSH: Disabled for '<vsys_name>'. Attempted connection failed from <ip_addr>:<port>.

SSH: Password authentication failed for admin user '<user-name>' at host <src-ip>.

SSH: Password authentication successful for admin user '<user-name>' at host <src-ip>.

SSH: PKA authentication failed for admin user '<user-name>' at host <src-ip>.

SSH: PKA authentication successful for admin user '<user-name>' at host <src-ip>.


Notification (00026)

SCP: Admin user '<user-name>' transferred file '<file_name>' from device to host <ip_addr>.

SCP: Admin user '<user-name>' transferred file '<file_name>' to device from host <ip_addr>.


Information (00026)

SSH: Host certificate bound to server (Cert-ID <cert_id>).

SSH: Host certificate unbound from server (Cert-ID <cert_id>).

SSH: Host key deleted for <vsys_name>.

SSH: PKA certificate bound to admin '<user-name>' (Cert-ID <cert_id>).

SSH: PKA certificate unbound from admin '<user-name>' (Cert-ID <cert_id>).

SSH: PKA key has been bound to admin user '<user-name>' (Key ID <key_id>).

SSH: PKA key has been unbound from admin user '<user-name>' (Key ID <key_id>).

SSH: SCP disabled for <vsys_name>.

SSH: SCP enabled for <vsys_name>.

SSH: SSH disabled for <vsys_name>.

SSH: SSH enabled for <vsys_name>.

SSH: Upgrade performed (to version <version>).


SSL
----------------------------------------


Warning (00515)

Admin user <user-name> logged out for Web(<protocol>) management (port <dst-port>) from <src-ip>:<src-port>


Warning (00518)

Admin user <user-name> login attempt for Web(<protocol>) management (port <dst-port>) from <src-ip>:<src-port> failed due to an incorrect client ID.

Admin user <user-name> login attempt for Web(<protocol>) management (port <dst-port>) from <src-ip>:<src-port> failed.


Warning (00519)

Admin user <user-name> logged in for Web(<protocol>) management (port <dst-port>) from <src-ip>:<src-port>


Notification (00035)

<name> SSL CA is changed to none <config_changer>.

<name> SSL certificate authority is changed to none <config_changer>.

<name> SSL certificate authority name is changed to <cert_name>.

<name> SSL certificate is changed to <cert>.

<name> SSL cipher name is changed from <old_cipher> to <new_cipher> <string>.


Information (00002)

PKI: The device failed to generate the certificate request file in PKCS #10 format.

User <admin_user> clicked Get Tech on WebUI

User <admin_user> clicked Get Tech on WebUI, but response may not complete due to resource problem

Web SSL port changed from <src-port> to <dst-port> <config_changer>

Web SSL <status> <config_changer>


Information (00540)

Firewall-only system does not allow <name> SSL cipher type <cipher_type>.

No context exists for the SSL connection. The device is not ready for an SSL connection.

The subject field of the SSL certificate reports a mismatch with the subject name (<rev_data> received while expecting subject name <expect_data>).


Information (00545)

The MD5 hash value generated from the configuration file does not match the MD5 hash value provided!


Syslog and Webtrends
----------------------------------------


Critical (00019)

SECURITY ALARM is disabled by <user-name>.

SECURITY ALARM is enabled by <user-name>.


Critical (00020)

<none>System memory is low (<none> allocated out of <none>) <none> times in 1 minute


Critical (00030)

<none> CPU utilization is high (<none> > alarm threshold:<none>) <none> times in 1 minute


Critical (00035)

<audit-storage-name> audit trail has reached the storage capacity <capacity>. Traffic and Cryptographic admin action will be stopped.

<audit-storage-name> audit trail has reached the threshold of storage capacity <threshold> (records: <record-number> capacity: <capacity>).


Warning (00019)

Syslog cannot connect to the TCP server <server-ip>; the connection is closed.

WebTrends cannot connect to the TCP server <server-ip>; the connection is closed.


Notification (00019)

Attempt to enable WebTrends has failed because WebTrends settings have not yet been configured.

Admin user <user-name> disable the feature that display alarm on local console regardless of whether an administrator is logged in.

Admin user <user-name> enable the feature that display alarm on local console regardless of whether an administrator is logged in.

Admin user <user-name> set the refresh interval to <interval> seconds for security alarm.

Admin user <user-name> turn off the audible feature for security alarm.

Admin user <user-name> turn on the audible feature for security alarm.

Admin user <user-name> unset the refresh interval.

Admin user <user-name> set exclude rule id <exclude-id>

Admin user <user-name> set the percentage threshold <threshold> for audit storage

Admin user <user-name> unset exclude rule id <exclude-id>

Admin user <user-name> unset the percentage threshold for audit storage

All logging for webtrends server <server-ip> has been disabled.

All logging for webtrends server <server-ip> has been enabled.

All syslog message levels have been cleared.

All syslog servers were removed.

All webtrends servers were removed.

CLI log file size has been set to <size> bytes by admin '<user-name>'.

CLI logging has been disabled by admin '<user-name>'.

CLI logging has been enabled by admin '<user-name>'.

Event logging for syslog server <server-ip> has been disabled.

Event logging for syslog server <server-ip> has been enabled.

Event logging for webtrends server <server-ip> has been disabled.

Event logging for webtrends server <server-ip> has been enabled.

IDP logging for syslog server <server-ip> has been disabled.

IDP logging for syslog server <server-ip> has been enabled.

IDP logging for webtrends server <server-ip> has been disabled.

IDP logging for webtrends server <server-ip> has been enabled.

<VPN-name> VPN management tunnel has been enabled.

Socket cannot be assigned for syslog.

Socket cannot be assigned for WebTrends

Syslog facility for <facility> has been changed to <facility>

Syslog has been disabled.

Syslog has been enabled.

Syslog security facility for <facility> has been changed to <facility>

Syslog server <server-ip> host port number has been changed to <dst-port>

Syslog server <server-ip> hostname has been changed to <host-name>

Syslog server <server-ip> was added.

Syslog server <server-ip> was removed.

Syslog source interface has been changed to <interface-name>

Syslog source interface was removed.

Syslog VPN encryption has been disabled.

Syslog VPN encryption has been enabled.

The feature that device serial number is included in log messages has been disabled <user-name>

The feature that device serial number is included in log messages has been enabled <user-name>

The traffic/IDP syslog is disabled on backup device <user-name>.

The traffic/IDP syslog is enabled on backup device <user-name>.

The traffic/IDP webtrends log is disabled on backup device <user-name>.

The traffic/IDP webtrends log is enabled on backup device <user-name>.

Traffic logging for syslog server <server-ip> has been disabled.

Traffic logging for syslog server <server-ip> has been enabled.

Traffic logging for webtrends server <server-ip> has been disabled.

Traffic logging for webtrends server <server-ip> has been enabled.

Transport protocol for syslog server <server-ip> was changed to <server-ip>

Transport protocol for webtrends server <server-ip> was changed to <protocol>

WebTrends has been disabled <user-name>

WebTrends has been enabled <user-name>

WebTrends host domain name <server-ip> has been changed to <server-ip>

WebTrends server <server-ip> port number has been changed to <dst-port>

WebTrends server <server-ip> was added.

WebTrends server <server-ip> was removed.

WebTrends source interface has been changed to <interface-name>

WebTrends source interface was removed.

WebTrends VPN encryption has been disabled

WebTrends VPN encryption has been enabled


Notification (00022)

<VPN-name> VPN management tunnel has been disabled.


Notification (00628)

Admin user <user-name> add policy group <group-name>.

Admin user <user-name> add policy id <policy-id> into policy group <group-name>.

Admin user <user-name> clear the statistics of policy violation <table-name> table.

Admin user <user-name> delete policy group <group-name>.

Admin user <user-name> delete policy id <policy-id> from policy group <group-name>.

Admin user <user-name> disable overwrite configuration for security alarm

Admin user <user-name> disable the policy violation analysis mechanisms.

Admin user <user-name> disable the potential security violation analysis mechanisms for <violation-name>

Admin user <user-name> enable overwrite configuration for security alarm

Admin user <user-name> enable the policy violation analysis mechanisms

Admin user <user-name> enable the potential security violation analysis mechanisms for <violation-name>

Admin user <user-name> <action> audit trail config

Admin user <user-name> set configure by CLI [<cli-string>]

Admin user <user-name> set policy violation duration <duration>.

Admin user <user-name> set policy violation threshold <threshold>.

Admin user <user-name> set <action> when audit storage is full for audit loss mitigation

Admin user <user-name> set the size of policy violation <table-name> table to <table-size>

Admin user <user-name> unset policy violation duration.

Admin user <user-name> unset policy violation threshold.

Admin user <user-name> unset the size of policy violation <table-name> table.

Admin user <user-name> view the audit trail

All security alarms are acknowledged by <user-name>.

audit log queue <ostor-name> is overwritten

Audit trail event storage failure

event log entry for set log exclude-id testing user-id <user-name>, src-ip <none>, dst-ip <src-ip>, dst-port <none>, rule-id <dst-ip>, outcome <dst-port>

EVENT Log <user-name> is excluded by exclude rule <rule-id>.

SECURITY ALARM ACK ID <ack-id> is auto acked

SECURITY ALARM ACK ID <ack-id> is overwritten

Security alarm <ack-id> is acknowledged by <user-name>.


Notification (00631)

The webtrends server <server-name> is not resolved.


Notification (00632)

The syslog server <server-name> is not resolved.


Notification (00767)

Admin user <user-name> set the detail level of traffic log to <detail-level>

Admin user <user-name> viewed the detail level of traffic log

Alarm log was reviewed <user-name>.

All logged events or alarms were cleared <user-name>

All self logs were cleared <user-name>

All traffic logs were cleared <user-name>

Asset-recovery log was reviewed <user-name>.

Event log was reviewed <user-name>.

Log setting was modified to disable <level> level <user-name>

Log setting was modified to enable <none> level <user-name>

Self log was reviewed <user-name>.

System log was reviewed <user-name>.

The following change was made <user-name> in VSYS <vsys>: <cli-string>

Traffic log was reviewed <user-name>.


Information (00767)

Log buffer was full and remaining messages were sent to external destination. <packet-count> packets were dropped.


System Authentication
----------------------------------------


Notification (00105)

[1X] 802.1X session run out of memory.

[1X] 802.1X interface <interface> link status changed to down.

[1X] 802.1X interface <interface> link status changed to up.


Notification (00614)

[1X] host <host_mac> started authentication on interface <interface> with 802.1X session id <id>.

[1X] host <host_mac> failed authentication on interface <interface> with 802.1X session id <id>.

[1X] host <host_mac> logged off interface <interface> with 802.1X session id <id>.

[1X] host <host_mac> passed authentication on interface <interface> with 802.1X session id <id>.

[1X] host <host_mac> started re-authentication on interface <interface> with 802.1X session id <id>.


Telnet
----------------------------------------


Information (00623)

Telnet client connection to <ip_addr>, port <port> closed.

Telnet client connection to <ip_addr>, port <port> fails.

Telnet client connection to <ip_addr>, port <port> success.


Traffic Shaping
----------------------------------------


Notification (00002)

Traffic shaping clearing DSCP selector is turned <shaping-mode>.

Traffic shaping is turned <shaping-mode>.


User
----------------------------------------


Notification (00014)

The user group <user_group_name> <action> <by_whom>.

The user <user-name> <action> <by_whom>.


Virtual Router
----------------------------------------


Critical (00082)

VRRP group <vrrp-group> on interface <interface-name> gives up mastership.

VRRP group <vrrp-group> on interface <interface-name> is now the master.


Critical (00230)

NHRP : The total number of nhrp cache exceeded.system limit(<max-nhrp-cache-num>).

NHRP : VR(<vrouter-name>) Drop pending registration-request to NHS <dst-ip>: outgoing ifp(<interface-name>) NHRP disabled.

NHRP : VR(<vrouter-name>) Drop purge-reply from <src-ip>: failed to match NHRP entry from client information element <prot-address>/<cie-nc-prot> -><NMBA-address>.

NHRP : VR(<vrouter-name>) Drop resolution-ack from <src-ip>: failed to find NHRP entry inclient information exchange <prot-address>/<cie-nc-prot> -><NMBA-address>.

NHRP : VR(<vrouter-name>) drop <nhrp-type> who has <src-ip> : fail make fix/mandatory hdr.


Notification (00049)

A <optional-sharable> virtual router using name <vrouter-name> and id <vrouter-id> has been created

A virtual router with name <vrouter-name> and ID <vrouter-id> has been removed

Fast route lookup was disabled in virtual router <vrouter-name>

Fast route lookup was enabled in virtual router <vrouter-name>

Route-lookup preference changed to <router-lookup-method-name>(<preference-value>) => <router-lookup-method-name>(<preference-value>) => <router-lookup-method-name>(<preference-value>) in virtual router (<vrouter-name>).

Routes defined on inactive interfaces will be exported into other virtual routers, protocols in virtual router (<vrouter-name>)

Routes defined on inactive interfaces will not be exported into other vrouters, protocols in vrouter (<vrouter-name>)

SIBR routing disabled in virtual router <vrouter-name>

SIBR routing enabled in virtual router <vrouter-name>

SNMP trap made private in virtual router <vrouter-name>

SNMP trap made public in vrouter (<vrouter-name>)

Source-based routing disabled in vrouter (<vrouter-name>)

Source-based routing enabled in virtual router <vrouter-name>

Subnetwork conflict checking for interfaces in virtual router (<vrouter-name>) has been enabled.

The auto-route-export feature in virtual router <vrouter-name> has been disabled.

The auto-route-export feature in virtual router <vrouter-name> has been enabled

The maximum number of routes that can be created in virtual router <vrouter-name> is <max-routes>

The maximum routes limit in virtual router <vrouter-name> has been removed.

The router-id of virtual router <vrouter-name> used by OSPF, BGP routing instances id has been uninitialized.

The router-id that can be used by OSPF, BGP routing instances in virtual router <vrouter-name> has been set to <vrouter-id>

The routing preference for protocol <protocol-name> in virtual router <vrouter-name> has been reset.

The routing preference for protocol <protocol-name> in virtual router <vrouter-name> has been set to <preference-value>

The subnetwork conflict checking feature for interfaces in virtual router <vrouter-name> was removed.

The system default-route in virtual router (<vrouter-name>) has been removed.

The system default-route through virtual router <vrouter-name> has been added in virtual router <next-hop-vrouter-name>

The virtual router <vrouter-name> has been made default virtual router for virtual system (<vsys-name>)

The virtual router <vrouter-name> has been made sharable

The virtual router <vrouter-name> has been made unsharable.


Notification (00061)

Configuration of VRRP on interface <interface-name> is removed.

VRRP group <vrrp-group> created on interface <interface-name>.

VRRP group <vrrp-group> on interface <interface-name> changed advertisement interval to <interval> seconds.

VRRP group <vrrp-group> on interface <interface-name> changed preempt hold on time to <time> seconds.

VRRP group <vrrp-group> on interface <interface-name> changed preempt to <none>.

VRRP group <vrrp-group> on interface <interface-name> changed priority to <priority>.

VRRP group <vrrp-group> removed from interface <interface-name>.

VRRP on interface <interface-name> is configured.

VRRP on interface <interface-name> is disabled.

VRRP on interface <interface-name> is enabled.


Information (00622)

NHRP : NHRP instance in virtual router (<NHRP-vr>) is created.

NHRP : NHRP instance in virtual router (<NHRP-vr>) is deleted.

NHRP : recieved a valid <NHRP-mesg-type> from <src-ip> via <interface-name>.

NHRP : sending a valid <NHRP-mesg-type> to <dst-ip> via <interface-name>.

NHRP : VR(<vrouter-name>) construct <NHRP-mesg-type> to NHS <dst-ip>.

NHRP : VR(<NHRP-vr>) Dynamic tunnel establishment between <spoke1> and <spoke2> for packets between <src-ip> and <dst-ip>, not initiated as both gateways are behind NAT.

NHRP : VR(<NHRP-vr>) purge-reply ID(<NHRP-mesg-id>) from <src-ip>.

NHRP : VR(<NHRP-vr>) resolution-ack ID(<NHRP-mesg-id>) from <src-ip>.

NHRP : VR(<NHRP-vr>) resolution-Query (<NHRP-mesg-type>) ID (<NHRP-mesg-id>) to NHS from <src-ip> via <interface-name>.

NHRP : VR(<NHRP-vr>) resolution-reply ID(<NHRP-mesg-id>) from <src-ip>, state: <NHRP-RSI-state>.

NHRP : VR(<NHRP-vr>) resolution-reply ID(<NHRP-mesg-id>) from <src-ip>, state: <NHRP-RSI-state>.

NHRP : VR(<NHRP-vr>) Rx purge-request ID(<NHRP-mesg-id>) from <src-ip>: <nhrp-cie-code-string> ; CIE <nhrp-prot-ip>/<nhrp-prot-mask>-><nhrp-nbma-ip>.

NHRP : VR(<NHRP-vr>) Rx resolution-<NHRP-reply-or-set-mesg> ID(<NHRP-mesg-id>) from <src-ip>: <nhrp-cie-code-string> ; CIE <nhrp-prot-ip>/<nhrp-prot-mask>-><nhrp-nbma-ip>; trigger <trigger-vpn>.

NHRP : VR(<NHRP-vr>) Tx mesg : <NHRP-reply-mesg> ID(<NHRP-mesg-id>) to <dst-ip>.

NHRP : VR(<NHRP-vr>) Tx res mesg : <NHRP-reply-mesg> ID(<NHRP-mesg-id>) to <dst-ip>.

NHRP : VR(<NHRP-vr>) validate registration-reply from <src-ip> via <interface-name>

NHRP : VR(<NHRP-vr>) add ne <src-ip>/<NHRP-ne-mask>-><dst-ip>(<NHRP-nexthop-address>) <interface-name> TTL(<NHRP-ne-ttl>) to FIB <NHRP-ne-in-fib>.

NHRP : VR(<NHRP-vr>) del ne <src-ip>/<NHRP-ne-mask>-><dst-ip>(<NHRP-nexthop-address>) <interface-name>.

NHRP : VR(<NHRP-vr>) construct <NHRP-mesg-type> ID(<NHRP-mesg-id>) this <NMBA-address> has <src-ip>/<src-mask>.

NHRP : VR(<NHRP-vr>) construct <NHRP-mesg-type> ID(<NHRP-mesg-id>) this <NMBA-address> no longer has <src-ip>/<src-mask>.

NHRP : VR(<NHRP-vr>) construct <NHRP-mesg-type> to <dst-ip> over <interface-name> with ID(<NHRP-mesg-id>).


VPNs
----------------------------------------


Critical (000026)

Error detected with VPN manual <key_type> key for VPN <vpn_name> with parity check.


Critical (00040)

VPN '<vpn_name>' <user-name>from <none> is up.


Critical (00041)

VPN '<vpn_name>' <user-name>from <none> is down.


Critical (00112)

VPN PROXY ID LIMIT (<max_vpn_num>) REACHED. NO MORE PROXY ID CAN BE ADDED.

VPN TUNNEL LIMIT (<max_vpn_num>) REACHED. No more VPN tunnels can be created.


Notification (00017)

IPSec NAT-T for VPN <vpn_name> has been disabled.

IPSec NAT-T for VPN <vpn_name> has been enabled.

The DF-BIT for VPN <vpn_name> has been set to <action>.

VPN monitoring for VPN <vpn_name> has been disabled.

VPN monitoring for VPN <vpn_name> has been enabled (src int <interface-name>, dst IP <dst-ip>, rekeying <rekeying_or_not>, scalability optimization <optimized_or_not>).

VPN monitoring interval has been set to <vpnmon_interval> seconds.

VPN monitoring interval has been unset.

VPN monitoring threshold has been set to <vpnmon_threshold>.

VPN monitoring threshold has been unset.

VPN <vpn_name> with gateway <none> and SPI <dst-ip>/<local_spi> <remote_spi> <action>.

VPN <vpn_name> with gateway <dst-ip> and P2 proposal <p2-proposal> <action> <user-name>.

VPN tunnel limit (<max_vpn_num>) reached. No more VPN tunnels can be created.

VPN <vpn_name> has been bound to tunnel interface <interface-name>.

VPN <vpn_name> has been bound to tunnel zone <zone-name>.

VPN <vpn_name> has been unbound from tunnel zone <zone-name>.


Information (00536)

FIPS error: AES encryption using key sizes greater than 128 may not be configured via SSH.

IKE<<none>>: IP address of local interface has been changed from 0.0.0.0 to <dst-ip>.

IKE<<none>>: IP address of local interface has been changed to 0.0.0.0, and VPNs cannot terminate at it.

IKE<<none>>: Policy ID <dst-ip> failed over from SA <policy-id> to SA <sa-id>.

IKE<<none>>: VPN ID number cannot be assigned.

Phase 2 SA for tunnel ID <tunnel-id> has been idle too long. Deactivated P2 SA and sent a Delete msg to peer.

VPN monitoring for VPN <vpn_name> has deactivated the SA with ID 0x<tunnel-id>x.


Vsys
----------------------------------------


Alert (00046)

An administrator disables SIP ALG.


Notification (00032)

Assign shared-DMZ zone <zone-name> to vsys <vsys-name>.

Assign shared-DMZ zone <zone-name> to vsys-profile <vsys-profile-name>.

ID for vsys <vsys-name> has been changed from <old-id> to <new-id> <config-changer>.

NSRP VSD group ID for vsys <vsys-name> has been changed from <old-id> to <new-id> <config-changer>.

Reassign shared-DMZ zone <zone-name> from vsys <vsys-name>.

Reassign shared-DMZ zone <zone-name> from vsys-profile <vsys-profile-name>.

Vsys <old-vsys-name> has been changed to <new-vsys-name> <config-changer>.

Vsys <vsys-name> has been removed <config-changer>

Vsys <vsys-name> profile has been changed from <old_vsys_profile_name> to <new_vsys_profile_name>.

Vsys <vsys-name> with profile <vsys-profile-name> has been created <config-changer>.

Vsys profile <vsys_profile_name> created with default vsys limits.

Vsys profile <vsys_profile_name> deleted(<config-changer>).

Vsys profile <vsys_profile_name> limit <vsys_profile_limit_name> has been set to <vsys_profile_limit_max> <vsys_profile_limit_max_value> <vsys_profile_limit_reserved> <vsys_profile_limit_reserved_value>(<config-changer>).


Notification (00043)

IP classification for not classified traffic has been changed to <policy-name>.

IP classification has been <state> on zone <zone-name>.

IP classification mode has been changed to <ip-class-mode-name>.

IP classification object <string_subnet_or_range> has been added on zone <zone-name>.

IP classification object <string_subnet_or_range> has been deleted on zone <zone-name>.


Notification (00046)

An administrator enables SIP ALG.

An administrator set the media inactivity time-out value to its default value of <timeout> seconds.

An administrator set the SIP invite time-out value to its default value of <timeout> seconds.

An administrator set the SIP invite time-out value to <timeout> seconds.

An administrator set the SIP media inactivity time-out value to <timeout> seconds.

An administrator set the SIP ringing time-out value to its default value of <timeout> seconds.

An administrator set the SIP ringing time-out value to <timeout> seconds.

An administrator set the SIP signaling inactivity time-out value to its default value of <timeout> seconds.

An administrator set the SIP signaling inactivity time-out value to <timeout> seconds.

An administrator set the SIP trying time-out value to its default value of <timeout> seconds.

An administrator set the SIP trying time-out value to <timeout> seconds.


Notification (00515)

Vsys admin user <user-name> logged on via Telnet from remote IP address <remote-ip> using port <remote-port>.

Vsys admin user <user-name> logged on via the console.


Notification (00767)

Cannot allocate SIP call because device is fielding too many calls.

Security devices do not support multicast IP addresses <ip-addr> in SIP <header-field>.

Security devices do not support multiple IP addresses <ip-addr> or ports <port> in SIP headers <header-field>.

SIP ALG is unregistered by RM.

SIP call information data is too long.

SIP parser error <msg>.

SIP structure is corrupted.

The device cannot allocate sufficient memory for the SIP ALG request.

The device cannot register the Network Address Translation vector for the SIP ALG request.

The device cannot register the SIP ALG request to RM.

Too many call segments for response.

Too many call segments.

Transaction data is too long.

Transaction data too long for response.


Web Filtering
----------------------------------------


Alert (00014)

Communication error with <url-server-vendor-name> server[<url-server-ip-address>]: SrvErr(<url-server-error-code>), SockErr(<url-server-socket-error>), Valid(<url-server-sockets-valid>), Connected(<url-server-sockets-connected>)


Error (00556)

UF-MGR: Failed to abort a transaction. Reason: <reason>.

UF-MGR: Failed to disable cache.

UF-MGR: Failed to enable cache.

UF-MGR: Failed to process a request. Reason: <reason>.

UF-MGR: Internal error: <error>.

UF-MGR: Web filtering license is expired (expiration date: <expiration-date>2; current date: <current-date>2).


Warning (00556)

UF-MGR: URL FILTER ERR: <src-ip>(<src-port>)-><dst-ip>(<dst-port>), host:<host> page:<page> code:<code> reason: <reason>.


Warning (00769)

UF-MGR: URL BLOCKED: <user-info>(<src-ip>)-><src-port>(<dst-ip>) <dst-port> CATEGORY: <url> REASON: <category> PROFILE: <reason>


Notification (00013)

<url-filter-state>

Web filtering socket count is changed to <url-server-timeout>.

Web filtering source interface is changed to <interface-name>.

Web-filtering fail mode is changed to <fail-mode-string>.

Web-filtering message is changed.

Web-filtering message type is changed to <mesage-type-string>.

Web-filtering server account name is changed to <url-server-account-name>.

Web-filtering server name is changed to <url-server-name>.

Web-filtering server port is changed to <url-server-port-number>.

Web-filtering timeout is changed to <url-server-timeout>.


Notification (00523)

Web filtering received an error from <url-server-vendor-name> (error 0x<url-server-socket-error>).

Web filtering received an error from <url-server-vendor-name> (error 0x<url-server-socket-error>, flag 0x<url-server-error-flag>, cmd 0x<url-server-failing-cmd>).

Web filtering successfully connected <url-server-vendor-name> server (connections <url-server-connection-count>).


Notification (00556)

UF-MGR: The action for other in profile <profile> is set to <action>.

UF-MGR: The action for <category> in profile <profile> is changed to <action>.

UF-MGR: The category list from the CPA server is updated on the device.

UF-MGR: The category <category> is added into profile <profile> with action <action>.

UF-MGR: The category <category> is created.

UF-MGR: The category <category> is removed from profile <profile> with action <action>.

UF-MGR: The category <category> is removed.

UF-MGR: The category <category> is set in profile <profile> as the black list.

UF-MGR: The category <category> is set in profile <profile> as the white list.

UF-MGR: The profile <profile> black list is removed.

UF-MGR: The profile <profile> is created.

UF-MGR: The profile <profile> is removed.

UF-MGR: The profile <profile> white list is removed.

UF-MGR: The URL filtering deny message is set as <deny-message>.

UF-MGR: The URL filtering deny message is unset and changed to the default deny message.

UF-MGR: The url <url> is removed from category <category>.

UF-MGR: The URL <url> was added to category <category>.

UF-MGR: Cache disabled.

UF-MGR: Cache enabled.

UF-MGR: Cache size is changed to <cache-size>(K).

UF-MGR: Cache timeout is changed to <cache-timeout> (hours).

UF-MGR: Category update interval is changed to <category-update-interval> (weeks).

UF-MGR: Group-based web filtering <group-based-filtering>.

UF-MGR: Primay CPA server changed to <primay-CPA-server>.

UF-MGR: <CPA-server-host> CPA server host changed to <CPA-server-host>.

UF-MGR: <CPA-server-port> CPA server port changed to <CPA-server-port>.

UF-MGR: SurfControl Web filtering disabled.

UF-MGR: SurfControl Web filtering enabled.


Information (00769)

UF-MGR: URL PERMITTED: <user-info>(<src-ip>)-><src-port>(<dst-ip>) <dst-port> CATEGORY: <url> REASON: <category> PROFILE: <reason>


WLAN
----------------------------------------


Alert (00564)

Wireless AP re-initiated: <none>


Error (00564)

Wireless AP re-activated with error: \n<none>\nError index: <none>\nError code: <none>

> Wireless warning: <none>. >


Notification (00564)

Wireless AP in <none> mode.

Wireless CLI updated: <none>

Wireless RADIUS event: <none>.

Wireless station event: <none>.