ZyXEL Communications Internet Security Gateway ZyWALL 100, User Manual

Page: 665 / 708

ZyWALL Series Internet Security Gateway
Log Descriptions S-9
Chart S-11 Attack Logs
LOG MESSAGE DESCRIPTION
vulnerability ICMP (type:%d,
code:%d) The firewall detected an ICMP vulnerability attack, see the
section on ICMP messages for type and code details.
traceroute ICMP (type:%d, code:%d)
The firewall detected an ICMP traceroute attack, see the
section on ICMP messages for type and code details.
Chart S-12 IPSec Logs
LOG MESSAGE DESCRIPTION
Discard REPLAY packet
The router received and discarded a packet with an
incorrect sequence number.
Inbound packet authentication failed
The router received a packet that has been altered. A third
party may have altered or tampered with the packet.
Receive IPSec packet, but no
corresponding tunnel exists The router dropped an inbound packet for which SPI could
not find a corresponding phase 2 SA.
Rule <%d> idle time out, disconnect
The router dropped a connection that had outbound traffic and no
inbound traffic for a certain time period. You can use the "ipsec
timer chk_conn" CI command to set the time period. The default
value is 2 minutes.
WAN IP changed to <IP>
The router dropped all connections with the “MyIP”
configured as “0.0.0.0” when the WAN IP address changed.
Chart S-13 IKE Logs
LOG MESSAGE DESCRIPTION
Active connection allowed
exceeded The IKE process for a new connection failed because the
limit of simultaneous phase 2 SAs has been reached.
Start Phase 2: Quick Mode Phase 2 Quick Mode has started.
Verifying Remote ID failed:
The connection failed during IKE phase 2 because the
router and the peer’s Local/Remote Addresses don’t match.