ELS Messages for Internet Key Exchange Server (IKE)

IKE.001

Level:
P-TRACE
Short Syntax:
IKE.001 rcvd src bytes from dest on len , net networkId
Long Syntax:
IKE.001 received src bytes from dest on len , net networkId
Description:
An ISAKMP packet of the specified length was received on the specified interface.

IKE.002

Level:
P-TRACE
Short Syntax:
IKE.002 send len bytes to dest on src
Long Syntax:
IKE.002 send len bytes to dest on src
Description:
An ISAKMP packet of the specified length was sent to the specified destination.

IKE.003

Level:
UE-ERROR
Short Syntax:
IKE.003 too short pkt from source , len pktSize bytes
Long Syntax:
IKE.003 too short packet from source , len pktSize bytes
Description:
The received packet's header length is shorter than the ISAKMP header size.

IKE.004

Level:
UE-ERROR
Short Syntax:
IKE.004 invalid payload from source
Long Syntax:
IKE.004 invalid payload from source
Description:
The received payload is invalid, possible overrun attack.

IKE.005

Level:
C-INFO
Short Syntax:
IKE.005 begin main/aggressive/quick mode responder
Long Syntax:
IKE.005 begin main/aggressive/quick mode responder
Description:
Begin oakley main/aggressive/quick mode exchange as the responder

IKE.006

Level:
CE-ERROR
Short Syntax:
IKE.006 fld to proc payloadType payld from sourceIPAddr , noSA/invalidHeader
Long Syntax:
IKE.006 failed to process payloadType payload from sourceIPAddr , noSA/invalidHeader
Description:
IKE failed to process the specified payload in the packet received either because the SA may not exist or the header is invalid.

IKE.007

Level:
CE-ERROR
Short Syntax:
IKE.007 rcvd encryptd pkt while crypto inactive from srcIPAddr
Long Syntax:
IKE.007 rcvd encrypted pkt while crypto inactive from srcIPAddr
Description:
IKE received an encrypted packet while crypto is not active.

IKE.008

Level:
CE-ERROR
Short Syntax:
IKE.008 rcvd unencryptd pkt while crypto active from srcIPAddr
Long Syntax:
IKE.008 rcvd unencrypted pkt while crypto active from srcIPAddr
Description:
IKE received an unencrypted packet while crypto is active.

IKE.009

Level:
CI-ERROR
Short Syntax:
IKE.009 alloc fld, routineOrBlockName , size size
Long Syntax:
IKE.009 alloc failed, routineOrBlockName , size size
Description:
IKE failed to allocate memory of the specified size for the specified data structure or in the specified routine.

IKE.010

Level:
CE-ERROR
Short Syntax:
IKE.010 payld len ( payLoadLen ) from srcIPAddr > pkt ( pktLen ) itself, possible misconfig
Long Syntax:
IKE.010 payload len ( payLoadLen ) from srcIPAddr greater than pkt ( pktLen ) itself, possible misconfig
Description:
IKE received a packet with the payload length greater than the packet itself. It could be because either the packet is not formatted right or both peers are out of sync or there is a mismatch of pre-shared keys between the peers.

IKE.011

Level:
CE-ERROR
Short Syntax:
IKE.011 ISAKMP hdr len ( hdrLen ) from srcIPAddr too big
Long Syntax:
IKE.011 ISAKMP header len ( hdrLen ) from srcIPAddr too big
Description:
IKE received a packet with the header too big to handle.

IKE.012

Level:
CE-ERROR
Short Syntax:
IKE.012 unknown exch type exchType from srcIPAddr
Long Syntax:
IKE.012 unknown exchange type exchType from srcIPAddr
Description:
IKE received a packet with an unknown exchange type.

IKE.013

Level:
CI-ERROR
Short Syntax:
IKE.013 failed to proc exchType mode from srcIPAddr
Long Syntax:
IKE.013 failed to process exchType mode from srcIPAddr
Description:
IKE failed to process the packet received from the specified source in the specified mode. Earlier events should specify the exact reason. If none, it could be due to misconfiguration in IKE transforms or SA proposals.

IKE.014

Level:
CI-ERROR
Short Syntax:
IKE.014 attempted/failed to send size bytes to peerIPAddr
Long Syntax:
IKE.014 attempted/failed to send size bytes to peerIPAddr
Description:
Either IKE attempted to send a zero len packet or failed to allocate an I/O buffer to send the packet.

IKE.015

Level:
CE-ERROR
Short Syntax:
IKE.015 unknown protocol/algorithm/payLoadType , protocolID/algNum
Long Syntax:
IKE.015 unknown protocol/algorithm/payLoadType , protocolID/algNum
Description:
IKE received an unknown protocol or payload type, or an unknown cipher/hash/AH/ESP algorithm. Hence the packet will not be processed.

IKE.016

Level:
CI-ERROR
Short Syntax:
IKE.016 faild to encrypt/decrypt payld, srcIPAddr
Long Syntax:
IKE.016 failed to encrypt/decrypt payload, srcIPAddr
Description:
IKE was unable to decrypt/encrypt the payload from/to the specified peer address.

IKE.017

Level:
CI-ERROR
Short Syntax:
IKE.017 too many SAs ( numSA ) waitng to be active
Long Syntax:
IKE.017 too many SAs ( numSA ) waiting to be crypto active
Description:
There are more SAs waiting to be crypto active than the space allocated for them. Contact OpenROUTE customer service.

IKE.018

Level:
UI-ERROR
Short Syntax:
IKE.018 sending null pkt to dstAddr
Long Syntax:
IKE.018 sending null packet to dstAddr
Description:
IKE is trying to send a null packet to the specified destination. Must be software error. Contact OpenROUTE customer service.

IKE.019

Level:
CI-ERROR
Short Syntax:
IKE.019 retrnsmts exceed max maxRxts , del SA to dstAddr
Long Syntax:
IKE.019 retransmits exceed the limit maxRxts , delete SA to dstAddr
Description:
IKE has exceeded the maximum retransmission limit, hence SA to the specified destination is deleted. This indicates that the peer may be down or unreachable.

IKE.020

Level:
CI-ERROR
Short Syntax:
IKE.020 already have phase2 IV
Long Syntax:
IKE.020 already have phase2 initialization vector
Description:
IKE has already generated an initialization vector for phase2. Looks like there is some race condition going on. The current request is rejected, which results in the connection entry associated with it being deleted.

IKE.021

Level:
CI-ERROR
Short Syntax:
IKE.021 no pre-shared key for host IPAddr
Long Syntax:
IKE.021 no pre-shared key for host IPAddr
Description:
Pre-shared key is not configured for the specified host.

IKE.022

Level:
CI-ERROR
Short Syntax:
IKE.022 need requiredKeyLen byte key, have only generatedKeyLen
Long Syntax:
IKE.022 need requiredKeyLen byte key, have only generatedKeyLen
Description:
The generated key length is less than the required key length.

IKE.023

Level:
CI-ERROR
Short Syntax:
IKE.023 no offer for protocol protocol
Long Syntax:
IKE.023 no offer for protocol protocol
Description:
IKE cannot find an offer for the specified protocol in SA database.

IKE.024

Level:
CI-ERROR
Short Syntax:
IKE.024 attr list too big ( natts ) for proto protocol
Long Syntax:
IKE.024 attr list too big ( natts ) for protocol protocol
Description:
The number of attributes for the specified protocol is greater than what is expected.

IKE.025

Level:
CE-ERROR
Short Syntax:
IKE.025 invalid sigType signature from peerIPAddr
Long Syntax:
IKE.025 invalid sigType signature from peerIPAddr
Description:
The specified signature (RSA or DSA) is invalid.

IKE.026

Level:
CI-ERROR
Short Syntax:
IKE.026 unable to sign hash ( sigType )
Long Syntax:
IKE.026 unable to sign hash ( sigType )
Description:
IKE was unable to sign the computed hash digest with the specified algorithm.

IKE.027

Level:
UI-ERROR
Short Syntax:
IKE.027 db entry not found for SA SAaddr h
Long Syntax:
IKE.027 db entry not found for SA SAaddr h
Description:
IKE failed to look up the specified SA in the database. Must be some internal error.

IKE.028

Level:
UI-ERROR
Short Syntax:
IKE.028 no conn entry with msgid msgId h extraInfoIfAny
Long Syntax:
IKE.028 no connection entry with message id msgId h extraInfoIfAny
Description:
IKE failed to look up a connection entry with the specified message ID.

IKE.029

Level:
CI-ERROR
Short Syntax:
IKE.029 no SA for proto protocol and msgid msgID h from ipAddr
Long Syntax:
IKE.029 no SA for protocol protocol and message ID msgID h from ipAddr
Description:
IKE cannot find the SA associated with the specified protocol and the message ID from the specified host.

IKE.030

Level:
CI-ERROR
Short Syntax:
IKE.030 funcName failed; null DH
Long Syntax:
IKE.030 funcName failed; null DH
Description:
IKE failed to complete the specified function because there is no Diffie-Hellman group information.

IKE.031

Level:
CI-ERROR
Short Syntax:
IKE.031 errorMsg , peerAddr
Long Syntax:
IKE.031 errorMsg , peerAddr
Description:
Specified error occured while processing a packet from the specified peer.

IKE.032

Level:
CI-ERROR
Short Syntax:
IKE.032 errorMsg
Long Syntax:
IKE.032 errorMsg
Description:
Specified error occured.

IKE.033

Level:
CI-ERROR
Short Syntax:
IKE.033 function, : SA in bad state SAstate
Long Syntax:
IKE.033 function, : SA in bad state SAstate
Description:
The specified function could not be performed because the SA is not in appropriate state.

IKE.034

Level:
CE-ERROR
Short Syntax:
IKE.034 can't handle ID type IDType
Long Syntax:
IKE.034 can't handle ID type IDType
Description:
The specified ID type is either not recognized, or cannot be handled.

IKE.035

Level:
CI-ERROR
Short Syntax:
IKE.035 can't decrypt ID payld from peerAddr
Long Syntax:
IKE.035 can't decrypt ID payload from peerAddr
Description:
IKE could not decrypt the ID payload received from the specified peer.

IKE.036

Level:
CI-ERROR
Short Syntax:
IKE.036 can't get my ID for alias rootAlias
Long Syntax:
IKE.036 can't get my ID for alias rootAlias
Description:
IKE failed to get the router ID based on the specified root aliasname.

IKE.037

Level:
CI-ERROR
Short Syntax:
IKE.037 failed to generate DH keyPair/sharedSecret
Long Syntax:
IKE.037 failed to generate DH keyPair/sharedSecret
Description:
IKE failed to generate either the DH key pair or the shared key. The earlier errors should explain why.

IKE.038

Level:
UE-ERROR
Short Syntax:
IKE.038 inv DOI invDoi in msgType payload from peerIPAddr
Long Syntax:
IKE.038 invalid DOI invDoi in msgType payload from peerIPAddr
Description:
An SA/notify/delete payload with invalid Domain Of Interpretation (DOI) was received from the specified peer.

IKE.039

Level:
C-INFO
Short Syntax:
IKE.039 rcvd notify msg ' notifyMsg ' from peerIPAddr
Long Syntax:
IKE.039 received notify message ' notifyMsg ' from peerIPAddr
Description:
A notify message of the specified type was received from the specified peer.

IKE.040

Level:
C-INFO
Short Syntax:
IKE.040 rcvd 'invalid SPI' notify msg, spi , from peerAddr
Long Syntax:
IKE.040 received 'invalid SPI' notify message, spi , from peerAddr
Description:
The specified peer has sent us a notify message for invalid SPI.

IKE.041

Level:
U-TRACE
Short Syntax:
IKE.041 rcv SA del msg from IPaddr , msgid msgid h, proto protid
Long Syntax:
IKE.041 received SA delete message from IPaddr , msgid msgid h, protocol protid
Description:
Received an SA delete message from the specified peer with the specified message ID and protocol.

IKE.042

Level:
UE-ERROR
Short Syntax:
IKE.042 ISAKMP SA del msg for a diff SA from peerAddr
Long Syntax:
IKE.042 ISAKMP SA del msg for a diff SA from peerAddr
Description:
A delete message with invalid cookies was received, for which IKE cannot locate the SA.

IKE.043

Level:
UE-ERROR
Short Syntax:
IKE.043 inv spiSize spiSize and nSpi nSpi in SA del msg, from peerAddr
Long Syntax:
IKE.043 invalid spiSize spiSize and nSpi nSpi in SA del msg, from peerAddr
Description:
IKE received an SA delete message from a neighbor with invalid SPI size and number of SPIs. IKE cannot process the delete message.

IKE.044

Level:
UI-ERROR
Short Syntax:
IKE.044 failed to begin QM; reason
Long Syntax:
IKE.044 failed to begin QM; reason
Description:
IKE failed to begin Oakley quick mode for the specified reason.

IKE.045

Level:
UI-ERROR
Short Syntax:
IKE.045 failed to process QM; reason
Long Syntax:
IKE.045 failed to process QM; reason
Description:
IKE failed to process Oakley quick mode for the specified reason.

IKE.046

Level:
UE-ERROR
Short Syntax:
IKE.046 bad phase1 ID, del sess from neighborAddr
Long Syntax:
IKE.046 bad phase1 ID, deleting session from neighborAddr
Description:
IKE failed to validate phase1 ID, hence deleted the session.

IKE.047

Level:
UI-ERROR
Short Syntax:
IKE.047 failed to process SA - reason ; neighborAddr
Long Syntax:
IKE.047 failed to process SA - reason ; neighborAddr
Description:
IKE failed to process SA payload for the specified reason.

IKE.048

Level:
U-TRACE
Short Syntax:
IKE.048 SPI of size size in phase1, neighborAddr
Long Syntax:
IKE.048 SPI of size size in phase1, neighborAddr
Description:
IKE received a non-null SPI size in phase1, which IKE ignores. This is only an informational message.

IKE.049

Level:
CI-ERROR
Short Syntax:
IKE.049 failed to negotiate QM SA proposals
Long Syntax:
IKE.049 failed to negotiate QM SA proposals
Description:
IKE failed to get IPSec SA proposals for a connection. Perhaps they are not configured or the configured parameters do not match the received proposals. Check IPSec events for more information.

IKE.050

Level:
C-INFO
Short Syntax:
IKE.050 begin main/aggressive/quick mode as initiator
Long Syntax:
IKE.050 begin main/aggressive/quick mode as initiator
Description:
Begin Oakley main/aggressive/quick mode exchange as the initiator.

IKE.051

Level:
UI-ERROR
Short Syntax:
IKE.051 begin main/aggressive/quick mode as initiator failed
Long Syntax:
IKE.051 begin main/aggressive/quick mode as initiator failed
Description:
Oakley main/aggressive/quick mode exchange as the initiator failed to complete.

IKE.052

Level:
UI-ERROR
Short Syntax:
IKE.052 failed to add IPSec/IPComp SA, err errno
Long Syntax:
IKE.052 failed to add IPSec/IPComp SA, error errno
Description:
IKE failed to add the specified SA (IPCompression or IPSecurity).

IKE.053

Level:
UI-ERROR
Short Syntax:
IKE.053 need keyLen bytes for key, authKeyLen for HMAC, have only actualKeyLen
Long Syntax:
IKE.053 need keyLen bytes for key, authKeyLen for HMAC, have only actualKeyLen
Description:
Actual key material length is less than what is required for SA.

IKE.054

Level:
UI-ERROR
Short Syntax:
IKE.054 too many timers ( timersOutstanding )
Long Syntax:
IKE.054 too many timers ( timersOutstanding )
Description:
IKE did not start another timer as the number of timers outstanding exceeded the maximum. Internal software error, contact OpenROUTE customer service.

IKE.055

Level:
UI-ERROR
Short Syntax:
IKE.055 fld to cancel nonexistnt timer id timerId
Long Syntax:
IKE.055 failed to cancel nonexistent timer id timerId
Description:
Failed to cancel an outstanding timer request for a nonexistent ID. Internal software error, contact OpenROUTE customer service.

IKE.056

Level:
CE-ERROR
Short Syntax:
IKE.056 negotiated PFS grp negGrp doesn't match grp ourGrp
Long Syntax:
IKE.056 negotiated PFS group negGrp does not match group ourGrp
Description:
Negotiated Perfect Forward Secrecy group does not match the proposed group.

IKE.057

Level:
CE-ERROR
Short Syntax:
IKE.057 unexpected DH key len rcvdKeyLen , must be expectedKeyLen
Long Syntax:
IKE.057 unexpected DH key len rcvdKeyLen , must be expectedKeyLen
Description:
The DH key exchange length in the received packet is not equal to the expected length. The key exchange payload will not be processed.

IKE.058

Level:
CE-ERROR
Short Syntax:
IKE.058 invalid SPI size spi
Long Syntax:
IKE.058 invalid SPI size spi
Description:
Proposed SPI size is invalid.

IKE.059

Level:
CE-ERROR
Short Syntax:
IKE.059 rcvd ' p/g ' for DH group group
Long Syntax:
IKE.059 received ' p/g ' for DH group group
Description:
IKE received 'p' or 'g' for the specified Diffie-Hellman group.

IKE.060

Level:
CE-ERROR
Short Syntax:
IKE.060 fld to set ' p/g '
Long Syntax:
IKE.060 failed to set ' p/g '
Description:
IKE failed to set 'p' & 'g' values for DH MODP private group. This is used for private groups received for an ISAKMP session when this router is the responder. These values are received either as phase 1 SA attributes or in new group mode.

IKE.061

Level:
CE-ERROR
Short Syntax:
IKE.061 unsup oakley attr attr
Long Syntax:
IKE.061 unsupported oakley attr attribute
Description:
IKE received an Oakley attribute that it does not support.

IKE.062

Level:
C-INFO
Short Syntax:
IKE.062 del SA to peer peerAddr
Long Syntax:
IKE.062 delete SA to peer peerAddr
Description:
IKE SA to the specified peer is being deleted.

IKE.063

Level:
CE-ERROR
Short Syntax:
IKE.063 err processing payLoadType payld from peerAddr
Long Syntax:
IKE.063 error processing payLoadType payload from peerAddr
Description:
IKE failed to process the specified payload. Earlier events should specify the exact reason.

IKE.064

Level:
CE-ERROR
Short Syntax:
IKE.064 drop pkt from peerAddr , reason
Long Syntax:
IKE.064 drop packet from peerAddr , reason
Description:
IKE dropped the packet from the specified peer because the peer is not configured and there is no default peer configured. Or, because the packet did not arrive on a physical interface. Check the peer address.

IKE.065

Level:
C-INFO
Short Syntax:
IKE.065 drop pkt from src , IPSec not enabled on dst , net networkId
Long Syntax:
IKE.065 drop packet from src , IPSec not enabled on dst , net networkId
Description:
IKE dropped the packet from the specified source because IPSec is not enabled on the specified IP interface on the specified net.

IKE.066

Level:
C-INFO
Short Syntax:
IKE.066 drop phase phase1or2 pkt rxmt from peerAddr
Long Syntax:
IKE.066 drop phase phase1or2 packet retransmit from peerAddr
Description:
IKE dropped a packet from the specified peer because it may be a retransmitted (or replayed) packet. This may happen if the retransmission time is smaller on the peer.

IKE.067

Level:
P-TRACE
Short Syntax:
IKE.067 rcvd ' pktType ' from peerAddr
Long Syntax:
IKE.067 received ' pktType ' from peerAddr
Description:
An ISAKMP packet of the specified type was received from the specified peer. The '*' next to the header indicates that the packet is encrypted. If the SAs between the peers are not in sync, it's possible to receive an encrypted packet that IKE fails to decrypt. The encrypted payloads are displayed as '.....'.

IKE.068

Level:
P-TRACE
Short Syntax:
IKE.068 send ' pktType ' to peerAddr
Long Syntax:
IKE.068 send ' pktType ' to peerAddr
Description:
An ISAKMP packet of the specified type was sent to the specified peer.

IKE.069

Level:
C-INFO
Short Syntax:
IKE.069 ignore sess key acquire req frm localAddr to peerAddr , rsn ' reason '
Long Syntax:
IKE.069 ignore session key acquire request from localAddr to peerAddr , reason ' reason '
Description:
IKE is ignoring IPSec request to acquire session keys for the specified reason. This may happen due to memory allocation failure or if IKE transform is not configured or if a session is already is progress (to serialize sessions so we don't overwhelm the router). IPSec will backoff and retry after some time - approximately 10 seconds.

IKE.070

Level:
C-INFO
Short Syntax:
IKE.070 init req outstanding to peerAddr , assume initiator/responder role
Long Syntax:
IKE.070 init req outstanding to peerAddr , assume initiator/responder role
Description:
There is already a session init outstanding, either an init request or cookie for the specified peer. This can happen for two reasons: either we are too slow, for which increase the retransmission period at the peer, or both peers have started off as initiators at the same time. The initiator that has the highest IP address will continue to be the initiator and the other will assume the responder role.

IKE.071

Level:
C-INFO
Short Syntax:
IKE.071 drop pkt, phase2 sess in prog to peerAddr
Long Syntax:
IKE.071 drop packet, phase2 session in progress to peerAddr
Description:
IKE is in the middle of negotiating a phase2 session with the specified peer. IKE drops phase2 session initiation requests until it completes the current session being negotiated.

IKE.072

Level:
C-INFO
Short Syntax:
IKE.072 inv lifetime notify msg from peerAddr
Long Syntax:
IKE.072 invalid lifetime notify msg from peerAddr
Description:
IKE received a lifetime notify message from a neighbor. IKE cannot process the message for it may have an invalid SPI field.

IKE.073

Level:
C-INFO
Short Syntax:
IKE.073 inv peer addr peerAddr in IPSec key acquire request
Long Syntax:
IKE.073 invalid peer address peerAddr in IPSec key acquire request
Description:
IPSec has specified an invalid peer address in the key acquire request. It could be because of misconfiguration.

IKE.074

Level:
C-INFO
Short Syntax:
IKE.074 id_type= IKE-ID-type id_value= IKE-ID-value rcvd from peerAddr matched with peer: peerConfigName
Long Syntax:
IKE.074 id_type= IKE-ID-type id_value= IKE-ID-value received from peerAddr matched with peer: peerConfigName
Description:
Specified peer is initiating an IKE connection to this router using the displayed IKE-ID. The IKE-ID successfully matched the IKE-ID of a peer definition in the configuration.

IKE.075

Level:
UI-ERROR
Short Syntax:
IKE.075 id_type= IKE-ID-type id_value= IKE-ID-value rcvd from peerAddr matched with peer: peerConfigName
Long Syntax:
IKE.075 id_type= IKE-ID-type id_value= IKE-ID-value received from peerAddr matched with peer: peerConfigName
Description:
Same as IKE_74, but a different number for unsuccessful. Specified peer is initiating an IKE connection to this router using the displayed IKE-ID. The IKE-ID did not match any existing peer definition in the configuration.

IKE.076

Level:
UI_ERROR
Short Syntax:
IKE.076 UDP port udpPort unavailable
Long Syntax:
IKE.076 UDP port udpPort is unavailable
Description:
Another application may have already registered with UDP to listen on the same port that IKE is requesting for, or IP may not be enabled yet.

IKE.077

Level:
UI-ERROR
Short Syntax:
IKE.077 peer ID (type= peerIDType , value= peerIDValue ) from peerAddr does not match cert subalt name (type= certIDType , value= certIDValue )
Long Syntax:
IKE.077 peer ID (type= peerIDType , value= peerIDValue ) from peerAddr does not match cert subalt name (type= certIDType , value= certIDValue )
Description:
The ID payload that we received from the peer does not match the subject alternate name in peer certificate. Hence IKE terminates negotiation by sending a notify message to peer.

IKE.078

Level:
CE-ERROR
Short Syntax:
IKE.078 inv hash from peerAddr , possible misconfig of peer ID or pre-shared key
Long Syntax:
IKE.078 invalid hash from peerAddr , possible misconfig of peer ID or pre-shared key
Description:
IKE received a hash payload from the specified peer that it has failed to validate. There may be a potential misconfiguration of ID or pre-shared key between the peers.

IKE.079

Level:
UE-ERROR
Short Syntax:
IKE.079 fld to send len bytes to dest on src ; pkt size > I/O buf size IObufsize
Long Syntax:
IKE.079 failed to send len bytes to dest on src ; packet size greater than I/O buf size IObufsize
Description:
IKE failed to send a packet of the specified length to the specified destination for the packet length is greater than the I/O buffer size. Use "set PACKET-SIZE" config command to increase the I/O buffer size to a value larger than the value that we are attempting to transmit.