Aw-Log-Ref Log Message Reference PDF
Aw-Log-Ref Log Message Reference PDF
TM
Allied Telesis
Routers and
Managed Layer 3
Switches
About This Reference
Introduction This Reference provides explanations and recommendations for many of the
events logged by Allied Telesis routers and layer 3 switches running AlliedWare
software.
Models and Software This Reference applies to the following Allied Telesis routers and managed layer 3
switches, running the AlliedWare OS:
AR300, AR400, and AR700 series routers
AT-8600, AT-8700XL, AT-8800, Rapier, and Rapier i series switches
AT-9800 series switches
AT-8900, AT-9900, and AT-9900s series switches
x900 series switches
SwitchBlade 4000 series switches
USA Headquarters | 19800 North Creek Parkway | Suite 100 | Bothell | WA 98011 | USA | T: +1 800 424 4284 | F: +1 425 481 3895
European Headquarters | Via Motta 24 | 6830 Chiasso | Switzerland | T: +41 91 69769.00 | F: +41 91 69769.11
Asia-Pacific Headquarters | 11 Tai Seng Link | Singapore | 534182 | T: +65 6383 3832 | F: +65 6383 3830
www.alliedtelesis.com
2008 Allied Telesis, Inc. All rights reserved. Information in this document is subject to change without notice. Allied Telesis is a trademark or registered trademark of Allied Telesis, Inc. in the United States and other countries.
All company names, logos, and product designs that are trademarks or registered trademarks are the property of their respective owners.
2
Safety Before installing the switch or router and any expansion options, read the
important safety information in the Safety and Statutory Information booklet.
Installation Follow the Quick Install Guides step-by-step instructions for physically installing
the device and any expansion options.
Hardware Reference The Hardware References gives detailed information about the equipment
hardware.
Getting Started For some models a User Guide or a Quick Start Guide gives help for getting
started configuring your device.
Software Reference Once you are familiar with the basic operations of the device, use the Software
Reference for full descriptions of switching or routing features and command
syntax.
To enable and configure logging options see the Logging Facility chapter in
the Software Reference.
For information about console messages, see the Messages appendix in the
Software Reference.
How To Notes Individual How To Notes describe specific solutions, including configuration
examples, and overviews of some areas of functionality. They are available from
www.alliedtelesis.com/resources/literature/howto.aspx
GUI Help The context-sensitive online GUI help gives descriptions of each page and element
of the GUI (Graphical User Interface).
Online Technical For online support for your switch or router, see our online support page at
Support www.alliedtelesis.com . If you require further assistance, contact your authorised
Allied Telesis distributor or reseller.
This section describes the most efficient ways to find a log message within this
Reference.
For information about how to view and interpret log messages, see Using the
Log on page 9.
Searching for the For many messages, you can simply search the PDF for part of the message text.
message text
However, note that many log messages include information specific to your
systeminterface names, port numbers, policy names, etc. In this Reference, we
have replaced that information with placeholders. For example, in the following
message, the port number is system-specific:
In the Reference, this message has a title of Port: interface is down and text of:
Port <port-number>: interface is DOWN
Finding a message in Some messages are almost completely made up of system-specific information,
the Reference and some text strings are repeated in multiple messages. For such messages, the
most efficient approach is to use the message Module and Type.
To do this:
1. Identify the Module name and Type from the message. The Module name is
the letters in the 4th column of the message (or occasionally it is a number
instead). The Type is the 5th column. For example, the Module name is SWIT
and the Type is PINT:
03 11:42:40 6 SWIT PINT DOWN Port46: interface is DOWN
2. Use Contents on page 3 to find the chapter that has messages for that
Module. Within that chapter, messages are sorted by Type. This lets you find
your specific message. Note that a few Modules share the same 4-letter name
in log messages (e.g. SWIT and DHCP) There are multiple chapters for these.
This Reference is This Reference does not contain all messages. It is a work in progress, which we
incomplete are gradually expanding. If you cannot find your message, it may not be there.
Using the Log
Configuring Logging
The log records events on your Allied Telesis Layer 3 switch or router. Logging is
enabled by default and a log message filter matches all log messages of severity 3
or greater.
You can change, or create, new log output definitions to log the log message
types, subtypes, or the severity levels you require.
See the Logging Facility chapter in the Software Reference for more information.
10
Display log To display the contents of the log file, simply use the command:
show log
This displays a standard log output. For other log display options, see the Logging
Facility chapter in the Software Reference.
Parameter Meaning
Date/Time The date and time the log message was generated. The date is
displayed as just the day number (131).
S The severity of the log message. See Log Message Severity
Levels on page 11 for a the meaning of each severity level.
Mod The name of the module that generated the log message (see
Module Identifiers and Names on page 12 for a complete list).
Type The message type (see Log Message Types and Subtypes on
page 17 for a complete list).
SType The message subtype (see Log Message Types and Subtypes on
page 17 for a complete list).
Message The contents of the Message field in the log message. For log
messages of type IPFILT/PASS, the format of the message text is
filter-number/entry-number Pass|Fail src-ipadd>dest-ipadd
protocol src-port>dest-port packet-size:data-size. For log
messages of type IPFILT/DUMP, the message text contains the first
32 octets of the packet.
Command parameters that require a module identifier as a value accept either the
module identification number or the module name.
The following table lists module identification strings. When you enter the module
name in a command, you can abbreviate it, and the shortest valid name for each
module is shown by capital letters in the Module Name column. Some modules
have more than one name (synonyms), in which case the Module Name column
lists the synonyms as a comma-separated list.
This chapter contains messages that have the module code PPP, sorted into the
following Types:
DLINK: Data-Link Layer on page 31
VINT: Virtual Interfaces on page 36
CIRC: Circuits on page 41
ATT: Module Attachment on page 43
AUTH: Authentication on page 45
INTERR: Internal Errors on page 47
LIMIT: System Limits on page 54
PPPOE: PPP over Ethernet on page 55
For more information about PPP, see the Point-to-Point Protocol (PPP) chapter in
the Software Reference.
Module: PPP; Type: DLINK 31
Type: DLINK
Data-Link Layer
Explanation Three PPP LCP Echo Requests have not been replied to, so the PPP link is being
reset.
Recommended Action Investigate why the peer is not replying to Echo Requests.
Explanation A demand link over the lower layer interface has been activated due to a
Bandwidth Allocation Protocol (BAP) request from the peer.
Explanation A demand link has been deactivated due to a Bandwidth Allocation Protocol (BAP)
request from the peer.
Explanation The link's charge limit has been exceeded, so the link has been taken down to
avoid further charges.
Recommended Action If this is the intended behaviour, no action is required. To enable the PPP interface
to be reopened, either reset or increase the charge limit which has been exceeded.
Explanation A dynamic PPP interface has had too many links dynamically added to the
interface, exceeding the configured maximum number of links.
Recommended Action If this is the intended behaviour, no action is required. To enable the link to be
added to the bundle on the PPP interface, increase the maximum number of links.
Explanation Loopback mode has been detected on the PPP link, so the link is being reset.
Recommended Action If this is intended behaviour, no action is required. If not, remove the loopback.
Explanation A Link Quality Report (LQR) timeout has occurred on a PPP link and the link has
been reset.
Recommended Action Investigate why the PPP peer is not replying to Link Quality Monitoring (LQM)
messages.
Explanation There is no callback number stored in the user database for the user requesting a
callback, so the PPP link is taken down.
Recommended Action If required, add a callback number to the user database for the user requesting a
callback.
Type: VINT
Virtual Interfaces
Explanation The accumulated charge on the PPP over ISDN interface has been reset by a user
command. The value of the charge before the reset is included in the log
message.
or
<ipx-protocol> s=<IPX-source-address:socket>
d=<ipx-destination-address:socket>
or
<dial-on-demand-interface-data>
The first message specifies that a dial-on-demand interface has been activated by
data traffic from the user module specified.
A dial-on-demand interface has been activated by IPX data traffic. The IPX
protocol name or number, and the destination and source addresses and
sockets, are included.
A dial-on-demand interface has been activated by non-IPX or IP data traffic.
Up to 64 characters of the data is given.
Recommended Action If this is the intended behaviour, no action is required. If this is an unexpected and
unwelcome event, then investigate why this user module is sending data over the
PPP interface.
Explanation A Dynamic PPP interface has been created using a specified PPP template.
Recommended Action If this is an unexpected and unwelcome event, investigate why the dynamic
interface has been destroyed.
Explanation The PPP interface has gone down due to a configured limit being exceeded.
Recommended Action If this is the intended behaviour, no action is required. To enable the PPP interface
to be reopened, either reset or increase the link limit which has been exceeded.
Explanation The PPP interface has come up and is now able to send and receive data.
Explanation A PPP interface has gone down and is unable to send or receive data.
Recommended Action If this is the intended behaviour, no action is required. If this is an unexpected and
unwelcome event, then investigate why the interface has gone down.
Explanation A PPP interface configured for dial-on-demand has gone down and is unable to
send or receive data.
Recommended Action If this is the intended behaviour, no action is required. If this is an unexpected and
unwelcome event, then investigate why the interface as gone down.
Explanation An attempt to send data over a PPP interface failed because a PPP link limit has
been exceeded.
Recommended Action If you want to reopen the PPP interface, either reset or increase the link limit
which has been exceeded.
Explanation A dynamic PPP interface has been created over an L2TP virtual call using a
template which specifies that compression should be enabled. Compression is not
allowed over L2TP calls, so it has not been enabled.
Type: CIRC
Circuits
Explanation The specified control protocol has left the OPEN state and is now in the down
state.
If ECP is now in the down state and encryption is still enabled on the interface,
close all NCPs.
Recommended Action If this is the intended behaviour, no action is required. If this is an unexpected and
unwelcome event, then investigate why the control protocol has left the open
state.
Explanation The specified control protocol has successfully negotiated into the OPEN state.
Explanation The specified PPP interface has just left the Network Control Protocol (NCP) phase
for the specified user module.
Type: ATT
Module Attachment
Explanation The specified feature has failed to attach to a PPP interface because an interface
number that is too big has been passed down.
Explanation The specified feature has successfully detached from a PPP interface.
Type: AUTH
Authentication
Recommended Action Check the user-name and password configured for the PPP interface to ensure
that they are correct. Check with the system administrator of the PPP peer to see
that the configured user-name and password match the user-name and password
held by the peer.
Recommended Action Check the user-name and password configured for the PPP interface to ensure
that they are correct. Check with the system administrator of the PPP peer to see
that the configured user-name and password match the user-name and password
held by the peer.
Type: INTERR
Internal Errors
Explanation PPP has failed to attach to DS3 (a bad attachment). The user has reset a PPP
instance on a swapped-out DS3 interface.
0 SUCCESS
1 INST_BAD
2 ALREADY_LOOPED
3 ILLEGAL_FORMAT
4 ILLEGAL_DISCRIM
5 BAD_RECONFIG
6 TOO_MANY_PROTOS
7 ALREADY_CONFIG
8 LPBK_NOT_SUPPORTED
Recommended Action Check that the PPP interface is configured over a valid DS3 interface. Check that
the DS3 interface is not being used by another feature. Check that there are not
two PPP interfaces over the same DS3 interface.
Contact your authorised Allied Telesis distributor or reseller if you require further
assistance.
Explanation An internal error occurred when PPP attempted to attach to the specified ethernet
interface in PPPoE Access Concentrator mode for the session stage. Access
Concentrator services will not be available over this interface.
0 SUCCESS
1 INST_BAD
2 ALREADY_LOOPED
3 ILLEGAL_FORMAT
4 ILLEGAL_DISCRIM
5 BAD_RECONFIG
6 TOO_MANY_PROTOS
7 ALREADY_CONFIG
8 LPBK_NOT_SUPPORTED
Recommended Action Check that the PPP interface is configured over a valid ETH interface. Check that
the ETH interface is installed.
Contact your authorised Allied Telesis distributor or reseller if you require further
assistance.
Explanation An internal error occurred when PPP attempted to attach to the specified ethernet
interface in PPPoE Access Concentrator mode for the discovery stage. Access
Concentrator services will not be available over this interface.
0 SUCCESS
1 INST_BAD
2 ALREADY_LOOPED
3 ILLEGAL_FORMAT
4 ILLEGAL_DISCRIM
5 BAD_RECONFIG
6 TOO_MANY_PROTOS
7 ALREADY_CONFIG
8 LPBK_NOT_SUPPORTED
Contact your authorised Allied Telesis distributor or reseller if you require further
assistance.
0 SUCCESS
1 INST_BAD
2 ALREADY_LOOPED
3 ILLEGAL_FORMAT
4 ILLEGAL_DISCRIM
5 BAD_RECONFIG
6 TOO_MANY_PROTOS
7 ALREADY_CONFIG
8 LPBK_NOT_SUPPORTED
Recommended Action Check that the PPP is configured over a valid SYN interface. Check that the SYN
interface is installed. Check that the SYN interface is not being used by another
feature. Check that there are not two PPP interfaces over the same SYN interface.
Check that the CRC type required is correct.
Contact your authorised Allied Telesis distributor or reseller if you require further
assistance.
Explanation An internal error occurred when PPP attempted to attach to the specified VLAN
interface in PPPoE Access Concentrator mode for the session stage. The specified
service name will not be available over this interface.
0 SUCCESS
1 INST_BAD
2 ALREADY_LOOPED
3 ILLEGAL_FORMAT
4 ILLEGAL_DISCRIM
5 BAD_RECONFIG
6 TOO_MANY_PROTOS
7 ALREADY_CONFIG
8 LPBK_NOT_SUPPORTED
Recommended Action Contact your authorised Allied Telesis distributor or reseller if you require further
assistance.
0 SUCCESS
1 INST_BAD
2 ALREADY_LOOPED
3 ILLEGAL_FORMAT
4 ILLEGAL_DISCRIM
5 BAD_RECONFIG
6 TOO_MANY_PROTOS
7 ALREADY_CONFIG
8 LPBK_NOT_SUPPORTED
Recommended Action Check that the PPP interface is configured over a valid VLAN. Check that it is not a
dynamic VLAN, as only GARP can attach to dynamic VLANs.
Contact your authorised Allied Telesis distributor or reseller if you require further
assistance.
Explanation A packet passed to the lower layer confirm handler has not passed the validity
checks. A confirm means a link of a PPP interface has been requested to be
destroyed and that PPP is waiting for confirmation that the last packet has been
transmitted before carrying out the request. Because the validity checks have
failed, the link can not be destroyed until a valid packet is received by the confirm
handler.
Recommended Action Contact your authorised Allied Telesis distributor or reseller for assistance.
Explanation Either:
the maximum number of PPPoE PADI packets have been sent by the device
without an acceptable response from an Access Concentrator, or
the PPPoE active discovery process has been attempted three times without
success,
and the PPPoE active discovery process has been aborted.
Recommended Action Check that the Eth or VLAN interface specified by the OVER parameter in the
CREATE PPP command is correctly connected. Check that the service name
specified by the OVER parameter is correct. Contact the service personnel
responsible for the Access Concentrator.
Explanation The maximum number of PPPoE PADR packets have been sent by the device
without an acceptable response from the Access Concentrator. The active
discovery process will be restarted.
Type: LIMIT
System Limits
Explanation The PPP interface is negotiating history values for the Compression Control
Protocol (CCP). There is insufficient resource available to provide the requested
compression histories, so data on PPP interface pppn cannot be compressed or
decompressed because there are no history structures available.
Recommended Action For hardware compression, check that the correct compression hardware (MAC or
PAC) is present. For software compression, check that the command:
set enco sw [predchannels=0..4] [stacchannels=0..4]
[stacspeed=0..3]
is in the boot configuration script and that this script has been run at boot time.
Type: PPPOE
PPP over Ethernet
Explanation A PPPoE PADI packet was received, requesting a service that currently has the
maximum allowable number of active sessions.
Recommended Action No action is required. Optionally, increase the maximum allowable number of
sessions for the service using the command:
set ppp acservice
Explanation A PPPoE PADI packet has been received requesting a service name that is not
configured on this device.
Recommended Action If PPPoE requests for the specified service name are not supposed to be accepted
by the device, no action is required. If such requests should be accepted, configure
the service using the command:
add ppp acservice
This chapter contains messages belonging to the module APPL, sorted into the
following Types:
CONFIG: Configuration on page 57
ATKFILT: AppleTalk Filters on page 58
For more information about Appletalk, see the Appletalk chapter in the Software
Reference.
Module: APPL; Type: CONFIG 57
Type: CONFIG
Configuration
Explanation ZIP detects that there has been an attempt to assign a different default zone to a
network already assigned with a specific default zone. All devices on the same
physical network must agree on the default zone name for the network.
Recommended Action Make sure that all interfaces of devices in the same physical network have the
same default zone assigned to the network.
Net-range conflict
Message Net-range conflict, net=<start-of-network-range>-
<end-of-network-range>; <network-number> set on port
<port-number> <mac-address-of-RMTP-source>
Explanation RTMP detects that another device on the same physical network (with the
specified MAC address) is assigned and advertises different network range.
Recommended Action Make sure that all interfaces of devices in the same physical network have the
same network range assigned to them.
Type: ATKFILT
AppleTalk Filters
Explanation A RTMP data packet has matched one of the AppleTalk filters.
Explanation A ZONE data packet has matched one of the AppleTalk filters.
This chapter contains messages belonging to the module IPG, sorted into the
following Types:
VINT: Virtual Interfaces on page 62
CIRC: Circuits on page 63
MSG: General Messages on page 66
IPFILT: IP Filters on page 67
IPDNS: Domain Name Server on page 72
ARP: Address Resolution Protocol on page 73
For more information about IP, IP filters, DNS and ARP, see the Internet Protocol
(IP) chapter in the Software Reference.
For more information about PPP, see the Point-to-Point Protocol (PPP) chapter in
the Software Reference.
Module: IPG; Type: VINT 62
Type: VINT
Virtual Interfaces
Explanation Called to indicate that a dial on demand IP interface has come up.
Explanation This message displays output for NAT packet logging - part of a call to indicate
that a PPP interface has come up. The specific log string output depends on the
protocol type.
Type: CIRC
Circuits
Recommended Action Reset the PPP interface associated with the interface, or reset the IP interface if it is
a DHCP assignment.
Recommended Action Reset the PPP interface associated with the interface, or reset the IP interface if it is
a DHCP assignment.
Recommended Action Reset the PPP interface associated with the interface, or reset the IP interface if it is
a DHCP assignment.
Recommended Action Check the network interface configuration - DHCP server, PPP server, or device
configuration.
Type: MSG
General Messages
Explanation No IGMP general query message has been received on the interface within the
configured query timeout interval.
Recommended Action Check for connectivity between the device and the multicast router acting as a
Querier on the sub-network.
Explanation Memory corruption has damaged an IGMP filter entry. The filter entry has been
deleted.
Recommended Action Contact your authorised Allied Telesis distributor or reseller for further assistance.
Type: IPFILT
IP Filters
Deny SrcRouted
Message Deny SrcRouted <source-ip-
address>><destination-ip-address>
<ip-protocol-name-or-number>
Explanation The device has received a source-routed packet. If the device is not configured to
forward source-routed packets (by default, it is not) then the packet will be silently
discarded and this log is generated.
DirBcast Fail
Message DirBcast Fail <source-ip-address>><destination-ip-address>
Prot=<ip-protocol-number> Int=<ip-interface>
Explanation The IP forwarding engine has received a directed broadcast packet for one of its
egress interface, but the egress interface is configured not to forward directed
broadcast traffic.
Explanation The number of directed broadcasts that have failed in the last 10 seconds. A
directed broadcast fails when an interface does not allow it.
Fragment Fail
Message Fragment Fail <source-ip-address>><destination-ip-address>
Protocol <ip-protocol-number> D=<don't-fragment-flag>
M=<more-fragment-flag> ID=<ip-packet-id>
Ofs=<fragment-offset>
Explanation The IP forwarding engine has received tiny IP fragments from the specified source.
This is usually associated with an IP fragment security attack. These types of
packets are automatically dropped by the device if fragment filtering is enabled.
ipIntPt == NULL
Message ipIntPt == NULL
ipRouteIpIntIndex == <non-ip-interface-index-number>
Explanation Unable to forward because this interface is not valid - not in the route lookup
table.
<filter-number>/<pattern-number> <fail>
<source-ip-address>><destination-ip-address>
<ip-protocol-name-or-number>
Explanation This indicates that the specified IP packet filter has resulted in a match for a packet
with the specified IP addresses and protocol number. If 'Pass' is specified, it means
that the packet is allowed to be received by the interface. If 'Fail' is specified, it
means that the packet is not allowed to be received by the interface.
Explanation This is the packet dump of the packet matching a specific filter.
outLogIntPt == NULL
Message outLogIntPt == NULL
ipRouteLogIntIndex == <non-logical-interface-index-
number>
Explanation Unable to forward because this interface is not valid - not in the route lookup
table.
Record Route
Message Record Route <source-ip-address>><destination-ip-address>
<ip-protocol-name-or-number>
Explanation The device has received a packet with record route option.
SA Fail BlockMode
Message SA Fail BlockMode <packet-source>><packet-destination>
Protocol <packet-protocol>
Explanation Packet has been discarded due to not having an ESP header and the interface
being in block mode for non-SA traffic.
Recommended Action Check configuration, otherwise this could be unauthorised packet being received
and discarded. Source address should give some clues as to who is sending the
traffic.
SA Fail Spoof?
Message SA Fail Spoof?
<source-ip-address>><destination-ip-address> Protocol
<ip-protocol-number>
Explanation The IP forwarding engine configured with a security association has received a
packet from a source claiming to have the same address as one of the device
interface addresses. This is usually associated with an IP spoofing security attack.
These types of packets are automatically dropped by the device.
Recommended Action Check to make sure the SA peer device is configured correctly. Otherwise, this
might be a deliberate security attack by a malicious device. No further action is
required.
Explanation The IP forwarding engine has received packets from a source claiming to have the
same address as one of the device interface addresses. This is usually associated
with an IP spoofing security attack. These types of packets are automatically
dropped by the device.
Type: IPDNS
Domain Name Server
Explanation The maximum number of DNS cache entries has been reached. If new entries are
added, old entries will be aged out or deleted.
Explanation A DNS request was rejected by the DNS server. The possible error codes and
meanings are listed in the following table.
Recommended Action If the error code indicates a problem with the server, check the server
configuration. If the error code indicates a problem with the format of the DNS
request, contact your authorised Allied Telesis distributor or reseller.
Type: ARP
Address Resolution Protocol
Explanation An ARP binding for the IP address and the MAC address has been detected on the
specified port and VLAN.
Explanation An ARP binding for the IP address and the MAC address has been detected on the
specified IP interface.
Explanation An ARP entry was deleted for the specified IP address and the MAC address on
the specified port and VLAN. The host with that MAC address no longer uses that
IP address, and/or cannot be reached through that port and VLAN.
Explanation An ARP entry was deleted for the specified IP address and the MAC address on
the specified IP interface. The host with that MAC address no longer uses that IP
address, and/or cannot be reached through that IP interface.
This chapter contains messages belonging to the module IPX, sorted into the
following Types:
CONFIG: Configuration on page 76
LIMIT: System Limits on page 77
For more information about IPX, see the Novell IPX chapter in the Software
Reference.
Module: IPX; Type: CONFIG 76
Type: CONFIG
Configuration
Explanation The specified IPX circuit has detected that a device with the specified node
number advertises a different network number on the same physical IPX circuit.
Recommended Action Assign the same network number for all IPX circuits attached to the same physical
network.
Type: LIMIT
System Limits
Explanation An attempt to add a static IPX service entry on the device has failed because the
IPX service table is full.
Recommended Action Delete unnecessary entries in the table. To display the service table, use the
command show ipx service.
This chapter contains messages belonging to the module SYN, sorted into the
following Types:
PINT: Physical Layer Interfaces on page 79
For more information about SYN, see the Interfaces chapter in the Software
Reference.
Module: SYN; Type: PINT 79
Type: PINT
Physical Layer Interfaces
Explanation The specified SYN interface has gone down. There are a number of possible
reasons for this. Use recent command history and the surrounding log messages
to determine the cause. Possibilities include:
the test module has been activated for that interface
the attached layer 2 feature for that interface has been detached
a DISABLE SYN command was entered
a RESET SYN command was entered
the modem control signal that indicates link status has gone inactive
Recommended Action For most of these causes, no action is required, assuming that the cause was
intentional (for example, assuming that the layer 2 feature was intentionally
detached).
If an interface is being tested, the interface will come back up again when the test
completes.If a DISABLE SYN command was entered, the interface will be able to
come back up after an ENABLE SYN command is entered.If a RESET SYN
command was entered, the SYN interface will be able to come back up again
when the RESET SYN action completes.
However, if the SYN interface has gone down because the modem control signal
that indicates link status has gone inactive, then check the status of the cable and
modem attached to the specified interface. This message may indicate a problem
with the communications link or perhaps the modem. Contact your
telecommunications service provider for assistance.
SYN: interface is up
Message SYN<interface-number>: interface is UP
Explanation The specified modem control signal for the specified SYN interface has changed.
Recommended Action This modem control signal is not a link status input and so is not an indicator of
communications link status. However, if the change is unexpected then it may
indicate a communications problem. This message is also generated when modem
control outputs are changed by command or in response to a modem control
input signal change. If there appears to be a communication problem then
contact your telecommunications service provider for assistance.
Explanation The specified modem control signal for the specified SYN interface has changed
multiple times in the last 10 minutes.
Recommended Action This modem control signal is not a link status input and so is not an indicator of
communications link status. However, if the change is unexpected then it may
indicate a communications problem. This message is also generated when modem
control outputs are changed by command or in response to a modem control
input signal change. If there appears to be a communication problem then
contact your telecommunications service provider for assistance.
Explanation The modem control input that indicates the link status for the specified SYN
interface has changed.
Recommended Action If the link has been expected to become active or inactive then no action is
required, but an unexpected link status change may indicate a problem with the
communications link or perhaps the modem. Contact your telecommunications
service provider for assistance.
Explanation The modem control input that indicates the link status for the specified SYN
interface has changed state multiple times in the last 10 minutes.
Recommended Action This usually indicates a problem with the modem or the communications link
attached to the SYN interface. Contact your telecommunications service provider
for assistance.
This chapter contains messages belonging to the module X25, sorted into the
following Types:
CIRC: Circuits on page 83
For more information about X.25 DCE, see the X.25 chapter in the Software
Reference.
Module: X25C; Type: CIRC 83
Type: CIRC
Circuits
X.25 call UP
Message x25c<interface-number>:LC=<logical-channel-group-number>/
<logical-channel-number> incoming call UP,
loc=<DTE-address>,rem=<DTE-address>
x25c<interface-number>:LC=<logical-channel-group-number>/
<logical-channel-number> outgoing call UP,
loc=<DTE-address>,rem=<DTE-address>
x25c<interface-number>:LC=<logical-channel-group-number>/
<logical-channel-number> DOWN from <location>(c=<cause>,
d=<diagnostic>),loc=<DTE-address>,rem=<DTE-address>
Recommended Action A call going down can be routine or part of a network problem. Try to establish
cause of the call going down and rectify the issue.
x25c<interface-number>:LC=<logical-channel-group-number>/
<logical-channel-number> RESET from <location>(c=<cause>,
d=<diagnostic>),loc=<DTE-address>,rem=<DTE-address>
Recommended Action A call reset can be routine or part of a network problem. Try to establish cause of
the call reset and rectify the issue.
X.25 RESTART
Message x25c<interface-number>: RESTART from <location>(c=<cause>)
Explanation An X.25 interface has been restarted, which clears all active calls.
Recommended Action Investigate using cause and diagnostic information specified in the message.
This chapter contains messages belonging to the module LAPB, sorted into the
following Types:
NULL (000): General Messages on page 86
DLINK: Data-Link Layer on page 87
For more information about LAPB, see the X.25 chapter in the Software
Reference.
Module: LAPB; Type: NULL (000) 86
Explanation A LAPB packet has been received which contained an error. This log message is
output from the generic error logging routine called to log bad packets.
Recommended Action If the LAPB interface is working correctly, and this message is seen in isolation,
ignore this message. If the message is associated with a LAPB outage, or if there
are many occurrences of the message, inform your authorised Allied Telesis
distributor or reseller.
Recommended Action If the LAPB interface is working correctly, and this message is seen in isolation,
ignore this message. If the message is associated with a LAPB outage, or if there
are many occurrences of the message, inform your authorised Allied Telesis
distributor or reseller.
Type: DLINK
Data-Link Layer
Explanation The specified LAPB interface has just gone down. This can be the result of either a
command handler disabling the SYN interface over which this LAPB interface is
operating, a change in control signal status on the SYN interface, or the ISDN call
terminating over which the LAPB interface is operating.
Recommended Action Investigate to determine the cause of the log message and inform the relevant
ISDN or X.25 network provider if required.
Explanation The specified LAPB interface has just entered REMOTE_BUSY state.
Recommended Action If repeated occurrences are logged, check with your service provider whether
there is any type of fault or outage with the service. If the service provider does
not have any problem with the service, then request support from your
authorised Allied Telesis distributor or reseller.
Explanation The specified LAPB interface has just been reset due to receiving a SABM frame in
the REMOTE_BUSY state, thereby only requiring a partial reset.
Recommended Action Reset has already occurred. If repeated occurrences are logged, check with your
service provider whether there is any type of fault or outage with the service. If the
service provider does not have any problem with the service, then request support
from your authorised Allied Telesis distributor or reseller.
LAPB: interface is up
Message LAPB<instance-number>: interface is UP
Explanation The specified LAPB interface has just exited REMOTE_BUSY state.
Recommended Action If repeated occurrences are logged, check with your service provider whether
there is any type of fault or outage with the service. If the service provider does
not have any problem with the service, then request support from your
authorised Allied Telesis distributor or reseller.
This chapter contains messages belonging to the module SWIT (module ID 32),
sorted into the following Types:
PINT: Physical Layer Interfaces on page 90
This module is one of several that are concerned with switching functionality on
various products. The other switching modules are:
SWIT: Switching on page 91 (module ID 87)
SWK: Switching on page 95 (module ID 102)
SWCX: Switching on page 98 (module ID 115)
For more information about switching and switch ports, see the Switching chapter
in the Software Reference.
Module: SWIT, SWTH; Type: PINT 90
Type: PINT
Physical Layer Interfaces
Explanation The port has received an interrupt indicating that the remote end has an error.
This is usually due to the removal of the plug at the remote end.
Recommended Action Check the port at the remote end and rectify the problem. Usually this means
plugging the plug back in.
Explanation The port at the remote end has recovered from the fault.
Recommended Action No action is required. This message indicates that the error has been fixed.
Explanation The device has been warm restarted due to a switch chip malfunction.
Recommended Action This could indicate a hardware problem. Contact your authorised Allied Telesis
distributor or reseller for assistance.
This chapter contains messages belonging to the module SWIT (module ID 87),
sorted into the following Types:
PINT: Physical Layer Interfaces on page 92
INTERR: Internal Errors on page 93
SWI: Switching on page 94
This module is one of several that are concerned with switching functionality on
various products. The other switching modules are:
SWIT, SWTH: Switching on page 89 (module ID 32)
SWK: Switching on page 95 (module ID 102)
SWCX: Switching on page 98 (module ID 115)
For more information about switching and switch ports, see the Switching chapter
in the Software Reference.
Module: SWIT; Type: PINT 92
Type: PINT
Physical Layer Interfaces
Recommended Action No action is required. However, if port is not supposed to be down, check the
device at other end and the cabling.
Port: interface is up
Message Port <port-number>: interface is UP
Recommended Action No action is required. However, you may need to investigate why the port was
down previously.
Explanation The specified switch chip has generated the specifed error code.
Recommended Action This could indicate a hardware problem. Contact your authorised Allied Telesis
distributor or reseller for assistance.
Type: INTERR
Internal Errors
Recommended Action Output the contents of CAM and the CAM segments using the commands:
show switch table=cam
show switch table=cams
Output a snapshot of the state of the device immediately before the management
fault, using the command:
show debug
Contact your authorised Allied Telesis distributor or reseller and send them the
output of these commands, along with the log message.
Explanation The SwitchBlades internal ports have been in a link down state for approximately
one minute, when they should be link up.
Recommended Action Check that the blades which relate to the ports in the log message are inserted
fully. The blades may require hot swapping out, then back in again. If this does
not resolve the problem, the control card and/or linecard may need to be replaced
or checked for required modifications.
Type: SWI
Switching
PP memory check
Message PP memory check
Recommended Action The switch will automatically restart in an attempt to resolve the problem. If the
problem persists, contact your authorised Allied Telesis distributor or reseller.
Recommended Action Investigate the physical connections in the network and the STP configuration to
find the cause of the loop.
Recommended Action Investigate the physical connections in the network and the STP configuration to
find the cause of the loop. The port will automatically be re-enabled after a
timeout period (300 seconds by default).
This chapter contains messages belonging to the module SWK, sorted into the
following Types:
REST: Restart on page 96
INTERR: Internal Errors on page 97
This module is one of several that are concerned with switching functionality on
various products. The other switching modules are:
SWIT, SWTH: Switching on page 89 (module ID 32)
SWIT: Switching on page 91 (module ID 87)
SWCX: Switching on page 98 (module ID 115)
For more information about switching and switch ports, see the Switching chapter
in the Software Reference.
Module: SWK; Type: REST 96
Type: REST
Restart
Explanation During startup the device performs a self-test to confirm that the port LEDs are
operating correctly. If this test fails, the device will automatically attempt to
recover from the error. If the device is unable to recover from the error, this log
message is generated.
Recommended Action Power cycle the device and check the device log. If this message appears again
after the power cycle, contact your authorised Allied Telesis distributor or reseller.
Explanation An problem with the operation of LEDs was detected during startup and was
successfully corrected. The message shows the number of attempts required to
correct the problem.
Type: INTERR
Internal Errors
Explanation An error occurred while trying to read the ARL table inside the switch. This may be
due to heavy load on the device or a lookup failure inside the switch due to the
ARL being full.
This chapter contains messages belonging to the module SWCX, sorted into the
following Types:
SWI: Switching on page 99
This module is one of several that are concerned with switching functionality on
various products. The other switching modules are:
SWIT, SWTH: Switching on page 89 (module ID 32)
SWIT: Switching on page 91 (module ID 87)
SWK: Switching on page 95 (module ID 102)
For more information about switching and switch ports, see the Switching chapter
in the Software Reference.
Module: SWCX; Type: SWI 99
Type: SWI
Switching
This chapter contains messages belonging to the module SYS, sorted into the
following Types:
REST: Restart on page 101
EXCEP: Exceptions on page 104
LIC: Licencing on page 105
MSG: General Messages on page 106
CONFIG: Configuration on page 107
SYSINFO: System Status and Alarms on page 109
For more information about the system, see the Configuring and Monitoring the
System chapter in the Software Reference.
For more information about release and feature licences, see the Managing
Configuration Files and Software Versions chapter in the Software Reference.
For more information about security mode, see the User Authentication chapter in
the Software Reference.
Module: SYS; Type: REST 101
Type: REST
Restart
Explanation BBR voltage has been measured at reboot and found to be low. This is a
potentially serious hardware failing.
Explanation When the device was rebooting the downloading of code from the EPROM had to
be retried.
Recommended Action Contact your authorised Allied Telesis distributor or reseller. However, in an
isolated case this is probably not an issue.
Explanation When the device was rebooting the downloading of interrupt vectors from the
EPROM had to be retried.
Recommended Action Contact your authorised Allied Telesis distributor or reseller. However, in an
isolated case this is probably not an issue.
NVS corrupt
Message NVS corrupt, was re-initialised
Explanation The BBR was found to be corrupt and was reinitialised. This is a potentially serious
issue.
Router startup
Message Router startup, ver <version-number>-00, <version-date>,
Clock Log: <time> on <date>
Recommended Action Verify that the device restart was not the result of unexpected behaviour. Contact
your authorised Allied Telesis distributor or reseller if behaviour is unexpected.
RTC corrupt
Message RTC corrupt
Recommended Action Set the real time clock correctly. Contact your authorised Allied Telesis distributor
or reseller if the message repeats on the next reboot, or if the real time clock is
subsequently found to have the incorrect time.
Recommended Action Set the real time clock correctly. Contact your authorised Allied Telesis distributor
or reseller if the message repeats on the next reboot, or if the real time clock is
subsequently found to have the incorrect time.
Explanation The device rebooted as the result of an unexpected exception, but there was no
entry in the unexpected exception list.
Explanation The device rebooted as the result of an unexpected exception, and the entry in the
unexpected exception list was corrupt.
Type: EXCEP
Exceptions
Unexpected Exception
Message Unexpected Exception $<offset>/
<unexpected-exception-description> Address $<address>
Explanation The device rebooted as the result of an unexpected exception, the details of which
are specified in this message.
Recommended Action Contact your authorised Allied Telesis distributor or reseller and provide them with
the output from the command:
show debug
obtained immediately after the reboot that caused this log message.
Type: LIC
Licencing
Explanation The slave controller card is missing a release licence for the release that is currently
running on the master controller card. This would cause it to fail to operate the
current release on the master controller card.
Recommended Action The proper release licence should be created for the slave controller card.
Explanation The slave controller card has a different release licence to that of the master
controller card.
Recommended Action The proper release licence should be created for the slave controller card.
Explanation The slave controller card is missing a feature licence that is installed on the master
controller card.
Recommended Action The proper feature licence should be created for the slave controller card.
Type: MSG
General Messages
Explanation System security mode has been enabled because a user has entered the ENABLE
SYSTEM SECURITY_MODE command.
Explanation System security mode has been disabled because a user has entered the DISABLE
SYSTEM SECURITY_MODE command.
Type: CONFIG
Configuration
Deleted board
Message Deleted board <board-name> serial number
<board-serial-number>
Explanation This message confirms that software support for a board has been deleted. This
happens when the board has been hot-swapped out and a different type of board
is hot-swapped in in its place.
Explanation This message confirms that a board has been hot-swapped out.
Hot-swapped in board
Message Hot-swapped in board <board-name> serial number
<board-serial-number>
Explanation This message confirms that a board has been hot-swapped in.
Hot-inserted board
Message Hot-inserted board <board-name> serial number
<board-serial-number>
Explanation This message confirms that a board has been hot-inserted, i.e. hot-swapped into a
previously empty slot or in place of a different type of board.
Type: SYSINFO
System Status and Alarms
corTempMessages
Message [Temperature below fixed threshold on master card]
Explanation These messages are output when the temperature crosses (in either direction) one
of the temperature thresholds; either the fixed threshold or the settable threshold.
The message can be output to reference either of the control cards in a
SwitchBlade.
Recommended Action A log message stating that a temperature threshold has been exceeded can
potentially indicate a serious problem.
In the case of a settable threshold, the value of the theshold should be checked to
verify that it has not been set so low that exceeding it does not represent a
danger. If the threshold has been exceeded, and represents true overheating, the
unit and its environment should be checked - fans must be running and air
conditioning in the room must be working adequately.
If there is no discernable cause for the overheating that can be fixed the unit may
have to be turned off to avoid damage to the unit or potential danger.
If the log message refers to the temperature going below the threshold, there is
less cause for immediate concern, as the concern should have been raised when
the temperature went over the threshold. The temperature below message could
be the result of having taken remedial action for a previous temperature exceeded
message.
Explanation These messages are output when the temperature crosses (in either direction) the
fixed temperature threshold. This message is output on devices with a fixed
controller on the motherboard of the device.
Recommended Action A log message stating that a temperature threshold has been exceeded can
potentially indicate a serious problem.
If there is no discernable cause for the overheating that can be fixed the unit may
have to be turned off to avoid damage to the unit or potential danger.
If the log message refers to the temperature going below the threshold, there is
less cause for immediate concern, as the concern should have been raised when
the temperature went over the threshold. The temperature below message could
be the result of having taken remedial action for a previous temperature exceeded
message.
Explanation The fan of a fan only module (FOM) is now operating correctly.
Explanation An error occurred while hot swapping a PSU or FOM. The most likely reason is
that the PSU/FOM was swapped in and then immediately swapped out again
before the personality information on the PSU/FOM could be read.
Explanation A PSU or FOM has been inserted but is not compatible with this device, for the
reason given.
Recommended Action Remove the PSU or FOM and replace it with a compatible model.
Explanation A PSU or FOM that was not compatible with this device has been removed.
Main PS status
Message Main PS status is good
Explanation The power supply is being monitored and the connection is not functioning. If the
power supply has completely failed, this log message can only be sent if a
redundant power supply or other back up system is present and functioning.
Explanation The power supply of a power supply unit is now functioning correctly.
Explanation The power supply and fans are being monitored correctly.
Explanation The power supply and fans are not being monitored correctly.
Explanation A PSU of the specified type has been inserted but is not compatible with the other
PSU already installed in this device. <identifier> is one of 1, 2, 1 or 2, or
Unknown ID. <type> is one of AC, DC, or Unknown Type.
Recommended Action Remove the PSU or FOM and replace it with a compatible model.
Explanation A PSU that was not compatible with the other PSU already installed in this device
has been removed. <identifier> is one of 1, 2, 1 or 2, or Unknown ID.
<type> is one of AC, DC, or Unknown Type.
Explanation The device does not have an Redundant Power Supply (RPS) connection and
cannot have an RPS installed.
Explanation The Redundant Power Supply (RPS) fan is being monitored and is functioning
correctly.
Explanation The redundant fan is being monitored and the Redundant Power Supply (RPS) unit
is not connected or the RPS is connected but the fan is faulty.
Recommended Action Check that the RPS is connected, and check the connection for faults. If necessary,
contact your authorised Allied Telesis distributor or reseller.
Explanation The Redundant Power Supply (RPS) fan status is not being monitored.
Redundant PS connection
Message Redundant PS connection is unsupported
Explanation The device does not have a Redundant Power Supply (RPS) connection, and
cannot have a RPS installed.
Explanation The Redundant Power Supply (RPS) is being monitored, is connected, and is
functioning correctly.
Explanation The Redundant Power Supply (RPS) is being monitored and is either not
connected, or it is connected but is not functioning well.
Recommended Action Check RPS is connected, and check the connection for faults.
Explanation The device has a connection to which an Redundant Power Supply (RPS) can be
connected, but the connection is not being monitored.
Redundant PS status
Message Redundant PS status is good
Explanation The Redundant Power Supply (RPS) is being monitored, is connected, and is
functioning correctly.
Explanation The Redundant Power Supply (RPS) unit is not functioning or not present.
Recommended Action Install the RPS. Contact your authorised Allied Telesis distributor or reseller.
Explanation The device does not have an Redundant Power Supply (RPS) connection, and
cannot have an RPS installed.
Explanation The operating temperature of the power supply unit is now within the fixed
threshold.
Explanation The operating temperature of the power supply unit is over the fixed threshold.
This chapter contains messages belonging to the module CH, sorted into the
following Types:
CMD: Command Processing on page 125
For more information about using the Command Handler, see the Using the
Command Line Interface (CLI) chapter in the Software Reference.
Module: CH; Type: CMD 125
Type: CMD
Command Processing
command entered
Message <command-just-entered>
Explanation This log message logs all commands entered via a console to the device.
Type: MSG
General Messages
message logged
Message <message-being-logged>
Explanation Every command handler output message generated via the message utility is
logged.
Recommended Action This is an audit trail of messages output as a result of commands. For maximum
usefulness also log the commands.
This chapter contains messages belonging to the module ICC, sorted into the
following Types:
Call Control on page 128
For more information about ISDN Call Control, see the Integrated Services Digital
Network (ISDN) chapter in the Software Reference.
Module: ICC, ISDNCC; Type: CALL 128
Type: CALL
Call Control
Explanation An ISDN call has come up, either in the incoming or outgoing direction, and the
channel is known and given in the LOG message.
Recommended Action Typically, no action is required. The call is up, which is typically normal behaviour.
However, it could be that you have not expected this call to have come up. In that
case, the activation of this call could have been due to unexpected traffic, or a
misconfiguration of the higher-layer protocol running over the ISDN call. If so, the
unexpected cause needs to be investigated.
Explanation An ISDN call has come up, either in the incoming or outgoing direction, and the
channel is unknown.
Recommended Action Typically, no action is required. The call is up, which is typically normal behaviour.
However, it could be that you have not expected this call to have come up. In that
case, the activation of this call could have been due to unexpected traffic, or a
misconfiguration of the higher-layer protocol running over the ISDN call. If so, the
unexpected cause needs to be investigated.
Explanation An ISDN call has gone down, probably as the result of an error, with cause
information.
Recommended Action If the call is not normal call clearing (16) then this message could indicate some
problem with the setup or the network itself. Consult ISDN troubleshooting
guides if you have them, or contact your authorised Allied Telesis distributor or
reseller for assistance. In addition, Q.931 debugging could help if the problem is
reproducible.
Explanation An ISDN call has gone down, probably as the result of an error, with no cause
information. No cause information usually indicates a problem trying to bring up a
call, or that this device is not accepting incoming calls.
Recommended Action Check the ISDN configuration and try Q.931 debugging. Contact your authorised
Allied Telesis distributor or reseller if you require further assistance.
Explanation An ISDN call has gone down and the time of activation and duration are specified.
Recommended Action Typically, no action is required. The call has closed, which is typically normal
behaviour. However, it could be that you have not expected this call to have
closed. In that case, the closing of this call could have been due to an unexpected
drop in traffic, or a misconfiguration of the higher-layer protocol running over the
ISDN call. If so, the unexpected cause needs to be investigated.
This chapter contains messages belonging to the module BRI, sorted into the
following Types:
PINT: Physical Layer Interfaces on page 131
For more information about BRI, see the Integrated Services Digital Network
(ISDN) chapter in the Software Reference.
Module: BRI; Type: PINT 131
Type: PINT
Physical Layer Interfaces
Explanation The BRI interface has entered the activated state. It is now able to transmit and
receive data frames.
Explanation The BRI interface has left the activated state. It is no longer able to transmit and
receive data frames. Most likely the interface cable has been disconnected, or
there is a fault in the ISDN, or there is a fault with the BRI interface hardware.
Recommended Action Contact your ISDN service provider, or your authorised Allied Telesis distributor or
reseller for assistance.
This chapter contains messages belonging to the module PRI, sorted into the
following Types:
Physical Layer Interfaces on page 133
For more information about PRI, see the Integrated Services Digital Network
(ISDN) chapter in the Software Reference.
Module: PRI; Type: PINT 133
Type: PINT
Physical Layer Interfaces
Explanation The PRI interface is no longer receiving any signal at all from the link partner. This
may mean that the link is broken or subject to extreme attenuation.
Recommended Action Contact your telecommunications service provider or your authorised Allied Telesis
distributor or reseller.
Explanation The PRI interface is unable to detect valid framing in the received signal. The
quality of the communications link in the direction towards the PRI interface has
deteriorated to the extent than the PRI interface is unable to successfully extract
the framing from the received signal. This usually means that the received signal is
suffering too much attentuation or noise.
Recommended Action Contact your telecommunications service provider or your authorised Allied Telesis
distributor or reseller.
Explanation The PRI interface has entered the operational state. It is now able to transmit and
receive data frames.
Explanation The PRI interface is receiving a Remote Alarm Indication and continuous CRC error
indications from the link partner. The link partner is not receiving a valid signal
from the PRI interface (E1 mode only). This probably means that there is
something wrong with the link in the direction from this interface towards the link
partner, or perhaps with the equipment at either end.
Recommended Action Contact your telecommunications service provider or your authorised Allied Telesis
distributor or reseller.
Explanation The PRI interface has been reset by command or automatically by the software.
PRI interfaces may be reset by command in an attempt to clear an error situation.
Normally a PRI interface reset is never required. Under some circumstances the
software may automatically reset the interface to clear an error condition. There
are error counters to indicate why the interface has been reset.
Explanation A line or payload loopback test of the PRI interface has been activated or
deactivated. Loopbacks can be activated and deactivated by command or
remotely by the telecommunications service provider. A loopback will disrupt
normal operation of the communications link.
Recommended Action If a loopback has not been locally activated and is not expected to be activated
remotely then contact the telecommunications service provider for assistance.
Explanation The PRI interface is receiving an Alarm Indication Signal (AIS) from the link partner.
The link partner, which may be a repeater, transmits AIS when it has no valid
signal to transmit in the direction towards the PRI interface. This usually means
that there is a problem somewhere upstream in the network.
Recommended Action Contact your telecommunications service provider or your authorised Allied Telesis
distributor or reseller.
Explanation The PRI interface is receiving a Remote Alarm Indication from the link partner as
the link partner is not receiving a valid signal from the PRI interface. This probably
means that there is something wrong with the link in the direction from this
interface towards the link partner, or perhaps with the equipment at either end.
Recommended Action Contact your telecommunications service provider or your authorised Allied Telesis
distributor or reseller.
This chapter contains messages belonging to the module USER, sorted into the
following Types:
AUTH: Authentication on page 137
USER: User Authentication Facility on page 138
RSO: Remote Security Officer on page 139
For more information about authenticating device users, see the User
Authentication chapter in the Software Reference.
Module: USER; Type: AUTH 137
Type: AUTH
Authentication
Explanation A RADIUS server has not responded to repeated requests from this device.
Recommended Action Check the connectivity and status of the RADIUS server.
Type: USER
User Authentication Facility
Explanation A user with the specified user name has just logged off the specified TTY or
asynchronous port.
Type: RSO
Remote Security Officer
Explanation A Remote Security Officer (RSO) has succeeded in logging in from the specified
IPv4 or IPv6 address.
Recommended Action No action is required. This message is useful as an audit trail for this security
command. Store and review these messages regularly.
Explanation An attempt to log in from the specified IPv4 or IPv6 address using a Security
Officer user name has failed because the IP address does not match a configured
Remote Security Officer (RSO) address range.
Recommended Action This is part of the audit trail for this security command, but represents an attempt
to log in from an unauthorised location. The IP address should be tracked and the
login attempt investigated.
Explanation An IPv4 or IPv6 address range has been added for Remote Security Officer (RSO)
logins.
Recommended Action No action is required. This message is useful as an audit trail for this security
command.
Explanation An IPv4 or IPv6 address range for Remote Security Officer (RSO) logins has been
deleted.
Recommended Action No action is required. This message is useful as an audit trail for this security
command.
Recommended Action No action is required. This message is useful as an audit trail for this security
command.
Recommended Action No action is required. This message is useful as an audit trail for this security
command.
This chapter contains messages belonging to the module ACC, sorted into the
following Types:
PINT: Physical Layer Interfaces on page 143
ACC: Call Control on page 144
For more information about ASYN ports, see the Interfaces chapter in the
Software Reference.
For more information about ACC, see the Asynchronous Call Control chapter in
the Software Reference.
Module: ACC; Type: PINT 143
Type: PINT
Physical Layer Interfaces
Asyn CD up
Message asyn<port-number> CD up
Explanation Indicates that the CD (carrier detect) control line has come up for a port. This can
indicate that the modem attached to the port has received a call, or that a
terminal has been plugged into the port.
Type: ACC
Call Control
Recommended Action Check the PPP and ACC configurations. To display a list of each PPP interface,
users of the interface, physical interfaces that the interface is running over, and
the current state of the interface, use the command:
show ppp
For a snapshot of the state of the device, capture the output of the command
show debug
Contact your authorised Allied Telesis distributor or reseller if you require further
assistance.
Explanation This is related to the message call <callname>, not found below. The
interface is dynamic and there is no call name involved. However, PPP does have a
port number to which it is trying to attach and this port is not valid.
Recommended Action Check the PPP and ACC configurations.To display a list of each PPP interface,
users of the interface, physical interfaces that the interface is running over, and
the current state of the interface, use the command:
show ppp
For a snapshot of the state of the device, capture the output of the command:
show debug
Contact your authorised Allied Telesis distributor or reseller if you require further
assistance.
Call active
Message Call ACTIVE, direction <direction>, asyn<number>
Explanation An ACC call has come up, either in the incoming or outgoing direction, on the
port specified.
Recommended Action Typically, no action is required. The call is up, which is typically normal behaviour.
However, it could be that you have not expected this call to have come up. In that
case, the activation of this call could have been due to unexpected traffic, or a
misconfiguration of the higher-layer protocol running over the ACC call. If so, the
unexpected cause needs to be investigated.
Explanation This message is related to the message call <callname>, not found below. The
call exists but there are no free ports for the call.
Recommended Action Check the PPP and ACC configurations. To display a list of each PPP interface,
users of the interface, physical interfaces that the interface is running over, and
the current state of the interface, use the command:
show ppp
For a snapshot of the state of the device, capture the output of the command:
show debug
Contact your authorised Allied Telesis distributor or reseller if you require further
assistance.
Explanation A dynamic interface has come up and PPP is trying to add it to a bundle, but the
reattachment fails because the call name is not found. However, this path is only
executed if the interface is not dynamic, which indicates that it is unlikely to
happen.
Recommended Action Check the PPP and ACC configurations. To display a list of each PPP interface,
users of the interface, physical interfaces that the interface is running over, and
the current state of the interface, use the command:
show ppp
For a snapshot of the state of the device, capture the output of the command:
show debug
Contact your authorised Allied Telesis distributor or reseller if you require further
assistance.
This chapter contains messages belonging to the module INST, sorted into the
following Types:
FEATURE: Feature Licencing on page 148
For more information about release and feature licences, see the Managing
Configuration Files and Software Versions chapter in the Software Reference.
Module: INST; Type: FEATURE 148
Type: FEATURE
Feature Licencing
Explanation This message is output when a feature licence is removed from the feature licence
table. A feature that used to have a licence no longer has a valid licence.
Recommended Action If a licence that should have been there has been removed, either re-enter the
licence if you have the licence details on record, or contact your authorised Allied
Telesis distributor or reseller.
This chapter contains messages belonging to the module OSPF, sorted into the
following Types:
OSPF: Open Shortest Path First on page 150
For more information about OSPF, see the Open Shortest Path First (OSPF) chapter
in the Software Reference.
Module: OSPF; Type: OSPF 150
Type: OSPF
Open Shortest Path First
Explanation The backup designated router on the given network has changed.
Recommended Action No action is required. This is routine, but this message indicates further
investigation may be required.
Explanation An OSPF database description packet was received, but the MTU field in the
packet does not match the MTU of the interface on which the packet was
received.
Recommended Action Ignore a single instance of this message. If there are many occurrences of this
message, check the OSPF configuration. If the error cannot be found and fixed,
contact your authorised Allied Telesis distributor or reseller for assistance.
Explanation An OSPF database description packet was received, but the neighbour that sent
the packet is in the wrong state for this device to process the packet.
Recommended Action Ignore a single instance of this message. If there are many occurrences of this
message, check the OSPF configuration. If the error cannot be found and fixed,
contact your authorised Allied Telesis distributor or reseller for assistance.
Recommended Action No action is required. This is routine, but this message indicates further
investigation may be required.
Recommended Action No action is required. This is routine, but this message indicates further
investigation may be required.
Explanation A Hello packet was received whose parameters do not exactly match the
parameters configured for this interface. This message is currently output in two
places, the first when the network mask is checked, the second when other
parameters are checked.
Recommended Action Ignore a single instance of this message. If there are many occurrences of this
message, check the OSPF configuration. If the error cannot be found and fixed,
contact your authorised Allied Telesis distributor or reseller for assistance.
Explanation A link state advertisement (LSA) was received with an incorrect checksum.
Recommended Action Ignore a single instance of this message. If there are many occurrences of this
message, check the OSPF configuration. If the error cannot be found and fixed,
contact your authorised Allied Telesis distributor or reseller for assistance.
Explanation An OSPF link state acknowledgment packet was received, but the neighbour that
sent the packet is in the wrong state for this device to process the packet.
Recommended Action Ignore a single instance of this message. If there are many occurrences of this
message, check the OSPF configuration. If the error cannot be found and fixed,
contact your authorised Allied Telesis distributor or reseller for assistance.
Explanation An OSPF link state request packet was received, but the neighbour that sent the
packet is in the wrong state for this device to process the packet.
Recommended Action Ignore a single instance of this message. If there are many occurrences of this
message, check the OSPF configuration. If the error cannot be found and fixed,
contact your authorised Allied Telesis distributor or reseller for assistance.
Explanation An OSPF link state update packet was received, but the neighbour that sent the
packet is in the wrong state for this device to process the packet.
Recommended Action Ignore a single instance of this message. If there are many occurrences of this
message, check the OSPF configuration. If the error cannot be found and fixed,
contact your authorised Allied Telesis distributor or reseller for assistance.
Explanation A link state advertisement (LSA) in the LSA database has reached MaxAge (60
minutes).
Recommended Action No action is required. This is routine, but this message indicates further
investigation may be required.
Explanation A link state advertisement (LSA) has reached MaxAge and has been flushed from
the devices nearest neighbours.
Recommended Action No action is required. This is routine, but this message indicates further
investigation may be required.
Explanation This device has generated a new instance of a self-originated link state
advertisement (LSA).
Explanation An link state advertisement (LSA) was received that is older than the one currently
in the LSA database. This is an anomaly in the LSA flooding process, and the older
LSA will be ignored.
Recommended Action No action is required. This is routine, but this message indicates further
investigation may be required.
Explanation An OSPF packet was received whose authentication type does not match the
authentication type configured for the interface on which the packet was
received.
Recommended Action Ignore a single instance of this message. If there are many occurrences of this
message, check the OSPF configuration. If the error cannot be found and fixed,
contact your authorised Allied Telesis distributor or reseller for assistance.
Explanation An OSPF packet was received on a virtual link, but on an interface whose OSPF
area is not the transit area for the virtual link.
Recommended Action Ignore a single instance of this message. If there are many occurrences of this
message, check the OSPF configuration. If the error cannot be found and fixed,
contact your authorised Allied Telesis distributor or reseller for assistance.
Recommended Action Ignore a single instance of this message. If there are many occurrences of this
message, check the OSPF configuration. If the error cannot be found and fixed,
contact your authorised Allied Telesis distributor or reseller for assistance.
Explanation An OSPF packet was received with an OSPF version number in its header that the
Allied Telesis implementation of OSPF does not recognise.
Recommended Action Ignore a single instance of this message. If there are many occurrences of this
message, check the OSPF configuration. If the error cannot be found and fixed,
contact your authorised Allied Telesis distributor or reseller for assistance.
Explanation An OSPF packet was received on a virtual link, but due to configuration errors the
packet is not valid.
Recommended Action Ignore a single instance of this message. If there are many occurrences of this
message, check the OSPF configuration. If the error cannot be found and fixed,
contact your authorised Allied Telesis distributor or reseller for assistance.
Explanation An OSPF packet was received on an interface configured for MD5 authentication,
but the packet failed MD5 authentication.
Recommended Action Ignore a single instance of this message. If there are many occurrences of this
message, check the OSPF configuration. If the error cannot be found and fixed,
contact your authorised Allied Telesis distributor or reseller for assistance.
Explanation An OSPF packet was received whose source IP address does not belong to the
network of the interface on which the packet was received.
Recommended Action Ignore a single instance of this message. If there are many occurrences of this
message, check the OSPF configuration. If the error cannot be found and fixed,
contact your authorised Allied Telesis distributor or reseller for assistance.
Explanation An OSPF packet was received with simple password authentication and the
password in the packet did not match the configured password.
Recommended Action Ignore a single instance of this message. If there are many occurrences of this
message, check the OSPF configuration. If the error cannot be found and fixed,
contact your authorised Allied Telesis distributor or reseller for assistance.
Explanation An OSPF packet was received that was too long for the Allied Telesis
implementation of OSPF.
Recommended Action Ignore a single instance of this message. If there are many occurrences of this
message, check the OSPF configuration. If the error cannot be found and fixed,
contact your authorised Allied Telesis distributor or reseller for assistance.
Explanation An OSPF packet was received that could only be from a virtual link, but there is no
virtual link configured that the packet could have come from.
Recommended Action Ignore a single instance of this message. If there are many occurrences of this
message, check the OSPF configuration. If the error cannot be found and fixed,
contact your authorised Allied Telesis distributor or reseller for assistance.
Explanation An OSPF packet was received on an interface that is not configured for OSPF.
Recommended Action Ignore a single instance of this message. If there are many occurrences of this
message, check the OSPF configuration. If the error cannot be found and fixed,
contact your authorised Allied Telesis distributor or reseller for assistance.
Explanation An OSPF packet that is not a Hello packet has been received from an unknown
OSPF neighbour adjacency.
Recommended Action Ignore a single instance of this message. If there are many occurrences of this
message, check the OSPF configuration. If the error cannot be found and fixed,
contact your authorised Allied Telesis distributor or reseller for assistance.
Explanation OSPF has failed to redistribute routes from the specified protocol because the
route redistribution limit has been reached. This message is not output every time
the redistribution limit is exceeded. Instead, messages are output when the
number of times the limit has been reached exceeds a preset high water mark of
1, 100, 200, 500, 1000, 2000, 5000, or 10000. When the high water mark is
exceeded, a log message is generated, the high water mark is set to the next
number in the list, and a two minute timer is started. If the timer expires before
the redistribution limit is reached again, the high water mark is reset to 1.
Recommended Action Further investigation of this message may be required. Check the OSPF
configuration. If the error cannot be found and fixed, contact your authorised
Allied Telesis distributor or reseller for assistance.
Refresh LSA
Message Refresh <lsa-type> LSA <lsa-id>: router ID: <router-id>
Explanation A self-originated link state advertisement (LSA) has been refreshed. This occurs
every 30 minutes.
Explanation A link state advertisement (LSA) was received which is too long for this device to
process.
Recommended Action Further investigation of this message may be required. Check the OSPF
configuration. If the error cannot be found and fixed, contact your authorised
Allied Telesis distributor or reseller for assistance.
Explanation A link state acknowledgement packet was received containing a link state
advertisement (LSA) acknowledgement for a LSA that is not currently in this
devices LSA database.
Recommended Action Further investigation of this message may be required. Check the OSPF
configuration. If the error cannot be found and fixed, contact your authorised
Allied Telesis distributor or reseller for assistance.
This chapter contains messages belonging to the module GRE, sorted into the
following Types:
MSG: General Messages on page 162
For more information about GRE, see the Generic Routing Encapsulation (GRE)
chapter in the Software Reference.
Module: GRE; Type: MSG 162
Type: MSG
General Messages
GRE rejection
Message GRE rejection : Ver=<non-zero-gre-version> Fl=0
Prot=<protocol-type> Key=<gre-key-value>
Explanation The GRE implementation on this device is compliant with RFC 1701. The GRE
packet received has been dropped because it had an unsupported version of GRE
(anything other than version zero), or it contained a non-zero flags field.
Recommended Action Check that the device at the other end of the GRE tunnel is fully compliant with
RFC 1701.
Explanation The GRE implementation on this device only supports the reception of GRE
packets containing an IP packet as the payload. The GRE packet received has been
dropped because it had a non-IP payload.
Recommended Action The device at the other end of the GRE tunnel is not compatible with the GRE
implementation on this device. Replace it with a compatible device.
Explanation The GRE packet received has been dropped because it contains a GRE key value
when one was not expected, or contains an incorrect key value.
Recommended Action Check the GRE key configurations at both ends of the tunnel to ensure they
match.
This chapter contains messages belonging to the module TRG, sorted into the
following Types:
BATCH: Trigger and Script Activation on page 164
For more information about TRG, see the Trigger Facility chapter in the Software
Reference.
Note that there are more log messages about triggers in the chapter LOG:
General Messages on page 170.
Module: TRG; Type: BATCH 164
Type: BATCH
Trigger and Script Activation
Explanation When a trigger was activated the specified script file could not be found and
executed.
Trigger activated
Message Trigger <trigger-number> activated (<automatic>)
Explanation The specifed trigger has been activated either normally (automatic) or by
command (manual).
This chapter contains messages belonging to the module SCR, sorted into the
following Types:
BATCH: Trigger and Script Activation on page 166
For more information about scripting, see the Scripting chapter in the Software
Reference.
Module: SCR; Type: BATCH 166
Type: BATCH
Trigger and Script Activation
output logged
Message <output-being-logged>
Explanation When triggers execute scripts, the output from the script that would normally go
to the device that activated the script, goes to the log function instead via this call.
This chapter contains messages belonging to the module FILE, sorted into the
following Types:
FILE (048): File System on page 168
For more information about the file system, see the Managing the File System
chapter in the Software Reference.
Module: FILE; Type: FILE (048) 168
Explanation The newly created file handle was already on the list of files.
Recommended Action Remove and replace the CompactFlash card to refresh the file list.
Explanation The directory entry being deleted is not found in the list of directory entries.
Recommended Action Contact your authorised Allied Telesis distributor or reseller. Report the
hexadecimal number, along with the software release installed on the device.
Explanation The newly created file handle was already on the list of files. This error is
generated adding either a file or a directory to the software directory listing that
the file has been physically added to the CompactFlash card.
Recommended Action Remove and replace the CompactFlash card to refresh the file list.
Explanation The file pointer was not on the list of files when it was expected. This error is
generated deleting either a file or a directory. The physical delete has occurred and
the update of the software directory listing has failed.
Recommended Action Remove and replace the CompactFlash card to refresh the file list.
Explanation The file could not be opened due to another failure. A message will be output
indicating this failure.
This chapter contains messages belonging to the module LOG, sorted into the
following Types:
NULL (000): General Messages on page 171
The LOG module contains some of the messages for the following features:
Appletalk on page 171
BDbridge debugging on page 171
NVS on page 172
RADIUS on page 172
ENCOencryption over MIOX circuit on page 172
File errors on page 174
Ports on page 175
FFS and FFSerrorFLASH file system on page 175
IP and IPG on page 181
IGMP and IGMP snooping on page 186
LAPD on page 188
MLD snooping on page 193
NAS/DMP on page 194
NTP on page 196
RANDrandom number generation for encryption keys on page 196
Q.931 on page 198
TMASYN and SYN port loopback tests on page 199
TRGtriggers on page 201
Trial licenses on page 218
TCBTCP listen port for LPD on page 218
X.25T on page 218
Module: LOG; Type: NULL (000) 171
Explanation Appletalk is attempting to add a route, but the number of buffers in the device is
approaching buffer level 2. Buffer level 2 is advertised in the SHOW BUFFER
command as the level at which the device does not do monitor or command
output. This message will not occur if the route is being added at boot
configuration time.
Explanation This message indicates the Bridge feature debugging frames that have been set
up for logging.
Explanation The NVS block had a bad magic number. This usually indicates corruption.
Explanation An attempt by the MIOX layer to attach to ENCO has failed. This is usually caused
by the failure of ENCO channel creation.
Recommended Action Delete unnecessary ENCO attachments by other features. If this does not resolve
the issue then reset ENCO.
Explanation MIOX has received an event notification from ENCO that an ENCO channel
attachment by MIOX has failed.
Recommended Action Delete unnecessary ENCO attachments by other features. If this does not resolve
the issue then reset ENCO.
ENCO dead
Message ENCO Dead
Explanation MIOX has received an event notification from ENCO that an ENCO channel is not
operational.
Recommended Action Reset both ENCO and the MIOX circuit concerned.
Explanation MIOX has received an event notification from ENCO that an attempt by ENCO to
reset the decoding channel has failed.
Recommended Action Reset both ENCO and the MIOX circuit concerned.
Explanation MIOX has received an event notification from ENCO that an attempt by ENCO to
reset the encoding channel has failed.
Recommended Action Reset both ENCO and the MIOX circuit concerned.
Explanation The software failed to open the specified script file when converting an action to a
script and the specifed error code was returned.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
filePuts failed
Message filePuts failed
Explanation A file error occurred when trying to close a script file created for a converted
action.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation The software attempted to send a packet out the specified port, but the port was
not link-up.
Recommended Action No immediate action is required. If the problem persists, contact your authorised
Allied Telesis distributor or reseller for assistance.
Explanation The file header for the specified file could not be written sucessfully.
Recommended Action If the log message says that the error is recoverable try creating another file. If the
log message says the error is non-recoverable erase the contents of flash with the
CLEAR FLASH TOTALLY command.
Recommended Action Manually clear the contents of flash using the command:
clear flash totally
Explanation The flash software has erased the unerased location automatically.
Explanation Flash blocks need to be erased before they can be written to. An area of flash was
expected to be in an erased state when written to but was not.
Recommended Action No action is required as the flash software will erase the unerased location
automatically.
Explanation The flash software received an error while verifying the specified file.
Explanation The flash software received an error trying to write the specified file.
Explanation The file header being examined by the software had incorrect data in it.
Recommended Action No action is required. The flash software will try to obtain the correct data.
Explanation The flash software received an error trying to create the specified file.
Explanation The flash software received an error trying to delete the file.
Explanation The flash software received an error while trying to erase the flash device.
Explanation The flash software received an error trying to read the file.
FFSerror in compaction
Message FFSerror <error-number> in compaction
Explanation An error occurred during compaction. See the FLASH File System Message Codes
section of the Reference Tables appendix, Software Reference, for a list of
message codes and their meanings.
FFSerror in restart
Message FFSerror <error-number> in restart
Explanation The flash software received an error while attempting to restart the file system
Recommended Action No action is required. The flash software will attempt to reintitialise itself.
Explanation The flash software received an error trying to open the file.
Explanation The flash software received an error trying to write the specified file.
Explanation The flash software received an error trying to read the file.
Explanation The flash software received an error trying to rename the file.
Explanation The flash software received an error while verifying the specified file.
Explanation The flash software received an error trying to write the specified file.
Explanation An attempt to record a new host entry has failed because the device has run out
of memory. This should only happen if the device is used in a very extreme
memory shortage situation.
Explanation An attempt to add an ARP on an interface that is not used by IP has taken place.
Recommended Action Check to make sure that the ARP is added on the correct IP interface.
Explanation An attempt to delete an IP interface has failed. The IP interface table may have
been corrupted.
Explanation This log is generated if IP is trying to add a dynamic interface with an IP interface
index for an existing interface. This should never happen. If it does, this may
indicate that there has been memory corruption.
IP, ipArpDettachInterfaceCirc:mioxDetachCircuit
Message IP, ipArpDettachInterfaceCirc:
mioxDetachCircuit=<detachment-result-code>,
<ip-address-to-be-disassociated>
Recommended Action Reset both X.25 and IP so that they can reinitialise themselves to restore
communication.
Explanation This log is generated if IP is trying to add a dynamic interface with nonsensical
parameters. This should never happen. If it does, this may indicate that there has
been memory corruption.
Explanation The device failed to open a UDP listen port for RIP (port 512).
Explanation An IP route has been added by the route template facility on the specified
interface.
Recommended Action Reset both X.25 and IP so that they can reinitialise themselves to restore
communication.
Recommended Action Check to make sure that the ARP is added on the correct IP interface.
Explanation An attempt to set an ARP interface parameter with an illegal interface name has
taken place.
Recommended Action Check to make sure that the ARP is set with a correct IP interface.
Recommended Action Check to make sure that the MIOX (X.25) circuit is configured properly and also
that the physical connection is correctly configured.
Explanation The TCP fragment table is full. This implies serious packet loss in the network,
causing TCP packet streams to become fragmented.
Recommended Action Check general network performance, ping times, etc. Contact your authorised
Allied Telesis distributor or reseller if there are repeated occurrences of this
message.
Explanation The table used to store information about sending urgent segments is full.
Recommended Action Contact your authorised Allied Telesis distributor or reseller for assistance.
Explanation An attempt to add a trusted host entry on the device has failed because the
trusted table is full.
Explanation Hardware based filtering has been activated to trap all IGMP messages to be sent
to the CPU for further processing by the IGMP function.
Explanation Hardware based filtering has been activated to trap all IGMP messages to be sent
to the CPU for further processing by the IGMP snooping function.
Explanation Failed to add the IGMP snooping hardware filter to trap the IGMP packets, so
IGMP snooping cannot be enabled.
Recommended Action No immediate action is required. If the problem persists, contact your authorised
Allied Telesis distributor or reseller for assistance.
Explanation A hardware error occurred while trying to update the switch hardware
configuration.
Recommended Action Reboot the device in an attempt to clear the hardware error.
Explanation A packet was received from the network removing all Terminal Endpoint
Identifiers (TEIs).
Recommended Action Contact your authorised Allied Telesis distributor or reseller if ISDN interfaces are
not working.
Explanation When LAPD has attempted to attach to the underlying ISDN interface, the attach
has failed. The interface name and reason are specified.
Recommended Action Check the ISDN configuration and presence of expected hardware. If the error
cannot be found and fixed, contact your authorised Allied Telesis distributor or
reseller for assistance.
Recommended Action This message may not indicate a problem, or may indicate either a fault of the
network or a transmission error. Contact your authorised Allied Telesis distributor
or reseller for further assistance if there are repeated occurrences of this message.
Explanation A Terminal Endpoint Identifier (TEI) has been assigned which was already assigned.
The configuration states that in this case the TEI should be removed, rather than
the alternative, which is to verify the TEI.
Recommended Action Contact your authorised Allied Telesis distributor or reseller if ISDN interfaces are
not working.
Explanation A Terminal Endpoint Identifier (TEI) has been removed due to receiving an error
indication on that TEI.
Recommended Action Contact your authorised Allied Telesis distributor or reseller if the TEI does not
come back, or if there are repeated occurrences of this message
Explanation The device has attempted to verify a Terminal Endpoint Identifier (TEI) and the
verification has timed out, so the TEI is removed.
Recommended Action This message may indicate a lack of connectivity with the network. Check this and
if there is still no connectivity, contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation A packet was received from the network requesting the removal of all Terminal
Endpoint Identifiers (TEIs).
Recommended Action Contact your authorised Allied Telesis distributor or reseller if ISDN interfaces are
not working.
Explanation A packet was received from the network requesting the removal of a single
Terminal Endpoint Identifier (TEI).
Recommended Action Contact your authorised Allied Telesis distributor or reseller if ISDN interfaces are
not working.
Explanation There has been a request for a Terminal Endpoint Identifier (TEI) and none are
available. This will only occur for manually assigned TEIs.
Recommended Action Check the ISDN configuration - you may be able to add another TEI if required.
Contact your authorised Allied Telesis distributor or reseller if you require further
assistance.
Recommended Action This message may not indicate a problem. However, this message does indicate if
the interface is going down repeatedly, then coming up. Contact your authorised
Allied Telesis distributor or reseller for assistance in the first instance, rather than
the ISDN provider.
Recommended Action This message may not indicate a problem. However, this message does indicate a
problem if LAPD is meant to be established. Contact your authorised Allied Telesis
distributor or reseller for assistance in the first instance, rather than the ISDN
provider.
Explanation A packet was received from the network removing a single Terminal Endpoint
Identifier (TEI).
Recommended Action Contact your authorised Allied Telesis distributor or reseller if ISDN interfaces are
not working.
Explanation An invalid event was seen in the MDL state machine (the state machine that
negotiates Terminal Endpoint Identifiers (TEIs) before the link comes up).
Recommended Action Contact your authorised Allied Telesis distributor or reseller for further assistance if
there are repeated occurrences of this message.
Explanation A MLD snooping hardware filter was added to trap the MLD packets.
Explanation Failed to add the MLD snooping hardware filter to trap the MLD packets, so MLD
snooping cannot be enabled.
Recommended Action No immediate action is required. If the problem persists, contact your authorised
Allied Telesis distributor or reseller for assistance.
Explanation An attempt by the MIOX layer to attach to NAS has failed. This is usually caused
by the failure of NAS channel creation.
Recommended Action Delete unnecessary NAS attachments by other features. If this does not resolve the
issue then reset NAS.
Explanation MIOX has received an event notification from NAS that an attempt by NAS to
reset the decoding channel has failed.
Recommended Action Reset both NAS/DMP and the MIOX circuit concerned.
Explanation An attempt by the MIOX layer to attach to NAS has failed. This is usually caused
by the failure of NAS channel creation.
Recommended Action Delete unnecessary NAS attachments by other features. If this does not resolve the
issue then reset NAS.
NAS/DMP dead
Message NAS/DMP Dead
Explanation MIOX has received an event notification from NAS/DMP that an NAS/DMP
channel is not operational.
Recommended Action Reset both NAS/DMP and the MIOX circuit concerned.
Explanation MIOX has received an event notification from NAS that an attempt by NAS to
reset the encoding channel has failed.
Recommended Action Reset both NAS/DMP and the MIOX circuit concerned.
Explanation A NTP host IP address (the IP address used as the ID of the NTP agent) has been
modified.
Explanation An attempt by the operating system to read a random number generation file has
failed. This may indicate corruption of the random file kept in either NVS or Flash.
Recommended Action Try to delete the file(*.rnd) from either Flash or NVS. If this does not work, save all
other files in the same storage unit and then clear the storage area - see the Flash
or the NVS section in the Software Reference.
Recommended Action Check to make sure there is enough room in the storage area for writing the file.
If there is enough space, yet this log message still appears, save all other files in
the storage area and clear the storage area - see the Flash or the NVS section in
the Software Reference.
Explanation An attempt by the operating system to read keys in the random number
generation file has failed. This may indicate corruption of the random file kept in
either NVS or Flash.
Recommended Action Try to delete the file (*.rnd) from either Flash or NVS. If this does not work, save all
other files in the same storage unit and then clear the storage area - see the Flash
or the NVS section in the Software Reference.
Explanation An attempt by the operating system to read saved random numbers in the
random number generation file has failed. This may indicate corruption of the
random file kept in either NVS or Flash.
Recommended Action Try to delete the file (*.rnd) from either Flash or NVS. If this does not work, save all
other files in the same storage unit and then clear the storage area - see the Flash
or the NVS section in the Software Reference.
Explanation An attempt by the operating system to write keys to the random number
generation file has failed. This may indicate corruption of the random number
generation file kept in either NVS or Flash.
Recommended Action Check to make sure there is enough room in the storage area for writing the file.
If there is enough space, yet this log message still appears, save all other files in
the storage area and clear the storage area - see the Flash or the NVS section in
the Software Reference.
Explanation An attempt by the operating system to write saved random numbers to the
random number generation file has failed. This may indicate corruption of the
random number generation file kept in either NVS or Flash.
Recommended Action Check to make sure there is enough room in the storage area for writing the file.
If there is enough space, yet this log message still appears, save all other files in
the storage area and clear the storage area - see the Flash or the NVS section in
the Software Reference.
Explanation There has been an attempt to read a non-existent random file. This may happen
when the device has never had an automatically generated random number file in
its storage systems.
Q.931 display
Message Q.931 display [<display-ie>]
Explanation An ISDN message was received with an information element (IE) in it called
Display. The contents of this IE are logged.
Explanation A LAPD event was received by Q.931 that was invalid to receive on Connection
Endpoint Suffix (CES) 0.
Recommended Action This message is a useful diagnostic tool in the event of ISDN connectivity issues.
Explanation An error has been detected with the asynchronous port loopback test.
Recommended Action Check that the test equipment and cables are operating correctly to identify if the
fault is with the device under test or with the test equipment.
Explanation An error has been detected with the control signals in a synchronous port
loopback test.
Recommended Action Check that the test equipment and cables are operating correctly to identify if the
fault is with the device under test or with the test equipment.
Explanation An error has been detected with the control signals in a synchronous port
loopback test.
Recommended Action Check that the test equipment and cables are operating correctly to identify if the
fault is with the device under test or with the test equipment.
Explanation When converting an action number in the NVS configuration it was found to be
greater than the allowable maximum.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation When checking whether the day number appears in a trigger specification it was
found that the day number was illegal.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation The attempt to allocate some memory for a command queue record failed.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation The attempt to allocate some memory for the specified trigger failed.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation The attempt to allocate some memory for a queue of triggers failed.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation The software failed to convert the NVS configuration for the specified action to
the dynamic configuration.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation The software failed to convert the NVS trigger configuration for the specified
trigger to the dynamic configuration.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation The attempt to delete the specified trigger from the dynamic configuration failed.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation The specified error code was returned when attempting to read the actions of the
specified trigger from NVS.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation The specified error code was returned when attempting to read the header record
of the specified trigger number's configuration from NVS.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation The specified error code was returned when attempting to read the type specific
configuration of the specified trigger from NVS.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation When read from NVS the version or type of the specified trigger had an illegal
number.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation A NULL data pointer has been passed to the Display Trigger routine.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation The software discovered that there were too many actions when converting an
NVS trigger configuration to a dynamic configuration.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation The specified error code was returned when attempting to locate the type specific
configuration information of the specified trigger in NVS.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation The specified error code was returned when trying to read the specified action
from NVS.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation The specified error code was returned when trying to read the specified action
header from NVS.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation The specified error code was returned when trying to read the header of the
specified trigger from NVS.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation The specified error code was returned when trying to read the type-specific
information of the specified trigger from NVS.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation When checking the current time against a trigger time window an invalid value
was detected.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation When a trigger activated in TEST mode, the specified script could not be found.
Explanation When the trigger feature attempted to get the current time it found that the real
time clock had not been set.
Recommended Action To initialise the real time clock, use the commands:
set date
set time
Explanation The number of scripts for the specified trigger exceeded the maximum allowed.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation The number of a new trigger being created was already in use for another trigger.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation The number of the trigger being activated did not correspond to an available
trigger.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation There was a problem reading the specified trigger specification from NVS.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation The configuration for this trigger number was not found in NVS.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation The number of the trigger being activated fell outside the allowable range.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation The number of a new trigger being created was outside the allowable range.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation The number of the trigger being deleted fell outside the allowable range.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation The number of the trigger configuration being read fell outside the allowable
range.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation The specified error code was returned when attempting to locate the actions of
the specified trigger in NVS.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation An unexpected error code was returned when reading the specified action
number's configuration from NVS.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation The specified NVS error code was returned when the specified command number
of the specified action was read from NVS.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation An unexpected error code was returned when reading the header of the specified
action number's configuration from NVS.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation An unexpected error code was returned when reading the specified trigger
number's configuration from NVS.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation There was some unknown error or an invalid entry in the NVS for the specified
trigger.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation The software discovered an unknown trigger type when converting an NVS
trigger configuration to a dynamic configuration.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation The configuration of the specified trigger had an unknown version number when
read from NVS.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation The software discovered a version mismatch when converting an NVS action to a
dynamic configuration.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation The software discovered a version mismatch when converting an NVS trigger
configuration to a dynamic configuration.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation The configuration of the specified action had an unknown version number when
read from NVS.
Recommended Action This is an internal error. Contact your authorised Allied Telesis distributor or
reseller for assistance.
Explanation A temporary software licence, not a feature licence, has just expired.
Recommended Action If a new licence is required, obtain one from your authorised Allied Telesis
distributor or reseller.
Explanation The device failed to open a TCP listen port for LPD (port 515). There may be too
many TCP sessions on the device.
Recommended Action Close some TCP sessions such as telnet, LPD, HTTP to, or from, the device.
Explanation A facility in a call connected packet has been seen but is not recognised.
Recommended Action The device does not support all facilities. If the call is failing, then the lack of
support for a particular facility may be the problem. If this is suspected, contact
your authorised Allied Telesis distributor or reseller for assistance.
x25tActivateCall
Message x25tActivateCall >> Int not active, Circ=<pvc>
Act=<call-active> IntState=<1- LAPB-down>
UQueue=<reason-circuit-unable-to-queue>
x25tActivateCall >> Int not active, Circ=<pvc>
Act=<call-active> IntState=<2-restarting>
UQueue=<reason-circuit-unable-to-queue>
x25tActivateCall >> Int not active, Circ=<pvc>
Act=<call-active> IntState=<3-active>
UQueue=<reason-circuit-unable-to-queue>
x25tActivateCall >> Int not active, Circ=<pvc>
Act=<not-active> IntState=<1-LAPB-down>
UQueue=<reason-circuit-unable-to-queue>
x25tActivateCall >> Int not active, Circ=<pvc>
Act=<not-active> IntState=<2-restarting>
UQueue=<reason-circuit-unable-to-queue>
x25tActivateCall >> Int not active, Circ=<pvc>
Act=<not-active> IntState=<3-active>
UQueue=<reason-circuit-unable-to-queue>
x25tActivateCall >> Int not active, Circ=<svc>
Act=<call-active> IntState=<1-LAPB-down>
UQueue=<reason-circuit-unable-to-queue>
x25tActivateCall >> Int not active, Circ=<svc>
Act=<call-active> IntState=<2-restarting>
UQueue=<reason-circuit-unable-to-queue>
x25tActivateCall >> Int not active, Circ=<svc>
Act=<call-active> IntState=<3-active>
UQueue=<reason-circuit-unable-to-queue>
x25tActivateCall >> Int not active, Circ=<svc>
Act=<not-active> IntState=<1-LAPB-down>
UQueue=<reason-circuit-unable-to-queue>
x25tActivateCall >> Int not active, Circ=<svc>
Act=<not-active> IntState=<2-restarting>
UQueue=<reason-circuit-unable-to-queue>
x25tActivateCall >> Int not active, Circ=<svc>
Act=<not-active> IntState=<3-active>
UQueue=<reason-circuit-unable-to-queue>
Explanation An X.25 switched virtual circuit (SVC) has been activated, but the interface is not
active.
Recommended Action This message may not indicate a problem if the interface is still coming up,
otherwise this message could indicate a failure in the interface state.
x25tActivateTestCall
Message x25tActivateTestCall >> Circ=<pvc> Act=<call-active>
IntState=<1- LAPB-down>
UQueue=<reason-circuit-unable-to-queue>
x25tActivateTestCall >> Circ=<pvc> Act=<call-active>
IntState=<2-restarting>
UQueue=<reason-circuit-unable-to-queue>
x25tActivateTestCall >> Circ=<pvc> Act=<call-active>
IntState=<3-active>
UQueue=<reason-circuit-unable-to-queue>
x25tActivateTestCall >> Circ=<pvc> Act=<not-active>
IntState=<1-LAPB-down>
UQueue=<reason-circuit-unable-to-queue>
x25tActivateTestCall >> Circ=<pvc> Act=<not-active>
IntState=<2-restarting>
UQueue=<reason-circuit-unable-to-queue>
x25tActivateTestCall >> Circ=<pvc> Act=<not-active>
IntState=<3-active>
UQueue=<reason-circuit-unable-to-queue>
x25tActivateTestCall >> Circ=<svc> Act=<call-active>
IntState=<1-LAPB-down>
UQueue=<reason-circuit-unable-to-queue>
x25tActivateTestCall >> Circ=<svc> Act=<call-active>
IntState=<2-restarting>
UQueue=<reason-circuit-unable-to-queue>
x25tActivateTestCall >> Circ=<svc> Act=<call-active>
IntState=<3-active>
UQueue=<reason-circuit-unable-to-queue>
x25tActivateTestCall >> Circ=<svc> Act=<not-active>
IntState=<1-LAPB-down>
UQueue=<reason-circuit-unable-to-queue>
x25tActivateTestCall >> Circ=<svc> Act=<not-active>
IntState=<2-restarting>
UQueue=<reason-circuit-unable-to-queue>
x25tActivateTestCall >> Circ=<svc> Act=<not-active>
IntState=<3-active>
UQueue=<reason-circuit-unable-to-queue>
Explanation An X.25 test call has been activated, but the interface is not active.
Recommended Action This message may not indicate a problem if the interface is still coming up,
otherwise this message could indicate a failure in the interface state.
x25tDTable
Message x25tDTable >> Circ=<pvc> Act=<call-active>
IntState=<1-LAPB-down>
UQueue=<reason-circuit-unable-to-queue>
Idx=<internal-state-machine-variable>
DEvent=<internal-state-machine-variable>
CurrState=<internal-state-machine-variable>
x25tDTable >> Circ=<pvc> Act=<call-active>
IntState=<2-restarting>
UQueue=<reason-circuit-unable-to-queue>
Idx=<internal-state-machine-variable>
DEvent=<internal-state-machine-variable>
CurrState=<internal-state-machine-variable>
x25tDTable >> Circ=<pvc> Act=<call-active>
IntState=<3-active>
UQueue=<reason-circuit-unable-to-queue>
Idx=<internal-state-machine-variable>
DEvent=<internal-state-machine-variable>
CurrState=<internal-state-machine-variable>
x25tDTable >> Circ=<pvc> Act=<not-active>
IntState=<1-LAPB-down>
UQueue=<reason-circuit-unable-to-queue>
Idx=<internal-state-machine-variable>
DEvent=<internal-state-machine-variable>
CurrState=<internal-state-machine-variable>
x25tDTable >> Circ=<pvc> Act=<not-active>
IntState=<2-restarting>
UQueue=<reason-circuit-unable-to-queue>
Idx=<internal-state-machine-variable>
DEvent=<internal-state-machine-variable>
CurrState=<internal-state-machine-variable>
x25tDTable >> Circ=<pvc> Act=<not-active>
IntState=<3-active>
UQueue=<reason-circuit-unable-to-queue>
Idx=<internal-state-machine-variable>
DEvent=<internal-state-machine-variable>
CurrState=<internal-state-machine-variable>
x25tDTable >> Circ=<svc> Act=<call-active>
IntState=<1-LAPB-down>
UQueue=<reason-circuit-unable-to-queue>
Idx=<internal-state-machine-variable>
DEvent=<internal-state-machine-variable>
CurrState=<internal-state-machine-variable>
x25tDTable >> Circ=<svc> Act=<call-active>
IntState=<2-restarting>
UQueue=<reason-circuit-unable-to-queue>
Idx=<internal-state-machine-variable>
DEvent=<internal-state-machine-variable>
CurrState=<internal-state-machine-variable>
Explanation An internal error has been detected in processing the D (data) event table.
Recommended Action Contact your authorised Allied Telesis distributor or reseller for assistance.
x25tProcessPacket
Message x25tProcessPacket >> Idx=<internal-state-machine-variable>
REvent=<internal-state-machine-variable>
CurrState=<internal-state-machine-variable>
Explanation An internal error has been detected in processing the R (restart) event table.
Recommended Action Contact your authorised Allied Telesis distributor or reseller for assistance.
x25tPTable
Message x25tPTable >> Circ=<pvc> Act=<call-active>
IntState=<1-LAPB-down>
UQueue=<reason-circuit-unable-to-queue>
Idx=<internal-state-machine-variable>
DEvent=<internal-state-machine-variable>
CurrState=<internal-state-machine-variable>
x25tPTable >> Circ=<pvc> Act=<call-active>
IntState=<2-restarting>
UQueue=<reason-circuit-unable-to-queue>
Idx=<internal-state-machine-variable>
DEvent=<internal-state-machine-variable>
CurrState=<internal-state-machine-variable>
x25tPTable >> Circ=<pvc> Act=<call-active>
IntState=<3-active>
UQueue=<reason-circuit-unable-to-queue>
Idx=<internal-state-machine-variable>
DEvent=<internal-state-machine-variable>
CurrState=<internal-state-machine-variable>
x25tPTable >> Circ=<pvc> Act=<not-active>
IntState=<1-LAPB-down>
UQueue=<reason-circuit-unable-to-queue>
Idx=<internal-state-machine-variable>
DEvent=<internal-state-machine-variable>
CurrState=<internal-state-machine-variable>
x25tPTable >> Circ=<pvc> Act=<not-active>
IntState=<2-restarting>
UQueue=<reason-circuit-unable-to-queue>
Idx=<internal-state-machine-variable>
DEvent=<internal-state-machine-variable>
CurrState=<internal-state-machine-variable>
x25tPTable >> Circ=<pvc> Act=<not-active>
IntState=<3-active>
UQueue=<reason-circuit-unable-to-queue>
Idx=<internal-state-machine-variable>
DEvent=<internal-state-machine-variable>
CurrState=<internal-state-machine-variable>
x25tDTable >> Circ=<svc> Act=<call-active>
IntState=<1-LAPB-down>
UQueue=<reason-circuit-unable-to-queue>
Idx=<internal-state-machine-variable>
DEvent=<internal-state-machine-variable>
CurrState=<internal-state-machine-variable>
x25tPTable >> Circ=<svc> Act=<call-active>
IntState=<2-restarting>
UQueue=<reason-circuit-unable-to-queue>
Idx=<internal-state-machine-variable>
DEvent=<internal-state-machine-variable>
CurrState=<internal-state-machine-variable>
Explanation An internal error has been detected in processing the P (call connection) event
table.
Recommended Action Contact your authorised Allied Telesis distributor or reseller for assistance.
x25tPvcAttach
Message x25tPvcAttach >> Circ=<pvc> Act=<call-active>
IntState=<1-LAPB-down>
UQueue=<reason-circuit-unable-to-queue>
x25tPvcAttach >> Circ=<pvc> Act=<call-active>
IntState=<2-restarting>
UQueue=<reason-circuit-unable-to-queue>
x25tPvcAttach >> Circ=<pvc> Act=<call-active>
IntState=<3-active>
UQueue=<reason-circuit-unable-to-queue>
x25tPvcAttach >> Circ=<pvc> Act=<not-active>
IntState=<1-LAPB-down>
UQueue=<reason-circuit-unable-to-queue>
x25tPvcAttach >> Circ=<pvc> Act=<not-active>
IntState=<2-restarting>
UQueue=<reason-circuit-unable-to-queue>
x25tPvcAttach >> Circ=<pvc> Act=<not-active>
IntState=<3-active>
UQueue=<reason-circuit-unable-to-queue>
x25tPvcAttach >> Circ=<svc> Act=<call-active>
IntState=<1-LAPB-down>
UQueue=<reason-circuit-unable-to-queue>
x25tPvcAttach >> Circ=<svc> Act=<call-active>
IntState=<2-restarting>
UQueue=<reason-circuit-unable-to-queue>
x25tPvcAttach >> Circ=<svc> Act=<call-active>
IntState=<3-active>
UQueue=<reason-circuit-unable-to-queue>
x25tPvcAttach >> Circ=<svc> Act=<not-active>
IntState=<1-LAPB-down>
UQueue=<reason-circuit-unable-to-queue>
x25tPvcAttach >> Circ=<svc> Act=<not-active>
IntState=<2-restarting>
UQueue=<reason-circuit-unable-to-queue>>
x25tPvcAttach >> Circ=<svc> Act=<not-active>
IntState=<3-active>
UQueue=<reason-circuit-unable-to-queue>>
Explanation An X.25 permanent virtual circuit (PVC) has been attached to, but the interface is
not active.
Recommended Action This message may not indicate a problem if the interface is still coming up,
otherwise this message could indicate a failure in the interface state.
This chapter contains messages belonging to the module PING, sorted into the
following Types:
PING: Ping Polling on page 227
For more information about Ping Polling, see the Ping Polling of Device
Reachability chapter in the Software Reference.
Module: PING; Type: PING 227
Type: PING
Ping Polling
Recommended Action Investigate why the device being polled is now unreachable.
This chapter contains messages belonging to the module SNMP, sorted into the
following Types:
SNMP: Simple Network Management Protocol on page 229
For more information about SNMP, see the Simple Network Management Protocol
(SNMP) chapter in the Software Reference.
Module: SNMP; Type: SNMP 229
Type: SNMP
Simple Network Management Protocol
Explanation An incoming SNMP request could not be processed because there was insufficient
system memory available or SNMP was already using all the system memory
allocated to it.
Recommended Action Use the show buffer command to check system memory usage. Use the show
snmp command to check for excessive polling.
Explanation An SNMP trap could not be sent because there was insufficient system memory
available or SNMP was already using all the system memory allocated to it.
Recommended Action Use the show buffer command to check system memory usage. Use the show
snmp command to check for excessive polling.
This chapter contains messages belonging to the module SCC, sorted into the
following Types:
PINT: Physical Layer Interfaces on page 231
For more information about SCC, see the Integrated Services Digital Network
(ISDN) chapter in the Software Reference.
Module: SCC; Type: PINT 231
Type: PINT
Physical Layer Interfaces
Explanation The router has been restarted due to an error condition on a SYN interface
installed in an AT-AR040 Network Service Module (NSM).
Recommended Action No immediate action is required. There is an extremely rare error condition that
can prevent operation of SYN interfaces in an AT-AR040 NSM. If this error
condition occurs then it is cleared by warm restarting the router.
Explanation The software was unable to configure the serial interface channel routing table for
the communication channels requested on the specified interface. This indicates
that a very complicated arrangement of communication channels has been
requested, presumably for a PRI interface. This is very unlikely to happen.
Explanation A fatal error on the AT-AR040 Network Service Module (NSM) installed in a router
has been detected. The router has been warm restarted twice but this has not
cleared the problem. This indicates a hardware problem with an AR040 in a
router.
This chapter contains messages belonging to the module IPv6, sorted into the
following Types:
MSG: General Messages on page 234
For more information about IPv6, see the Internet Protocol version 6 (IPv6) chapter
in the Software Reference.
Module: IPV6; Type: MSG 234
Type: MSG
General Messages
Explanation A Version 2 Multicast Listener Discovery (MLD) query was received on the specified
IPv6 interface, which is configured for MLD Version 1.
Explanation A Version 1 Multicast Listener Discovery (MLD) query was received on the specified
IPv6 interface, which is configured for MLD Version 2.
This chapter contains messages belonging to the module ATM, sorted into the
following Types:
ATM: Asynchronous Transfer Mode on page 236
For more information about ATM, see the ATM over xDSL chapter in the Software
Reference.
Module: ATM; Type: ATM 236
Type: ATM
Asynchronous Transfer Mode
Instance attached
Message Instance <number> attached to <interface>
Explanation The specified ATM instance is now attached to the specified physical interface. An
ATM instance must attach to a physical instance for the ATM interface to operate.
The device can attach one ATM instance per ADSL or SHDSL interface.
Instance down
Message Instance <number> over <interface> down
Explanation The ATM instance is no longer working because the physical interface is down.
Recommended Action No action is required if this is expected. If this is unexpected, investigate the
physical interfaces status by:
using the show adsl or show shdsl command
checking the physical connection between the device and the ATM service
provider
checking the log messages recently generated for ATM and the physical
interface
Explanation The specified ATM instance did not attach to the specified physical interface. This
can occur when:
the physical interface already has an instance attached
the physical interface is not available to ATM
an internal error has occurred on the device
Recommended Action Check that the device is correctly configured. Try configuring the ATM instance to
attach to a different physical interface.
Explanation The receive and transmit rates have changed for the specified ATM instance.
These rates can change when:
you reconfigure the device using the set adsl or set shdsl commands
the service provider adjusts its transmit and receive settings to your device
Recommended Action The device retrains to the new rates when autoretrain=on in the set adsl and
set shdsl commands. Contact your service provider if this change disrupts your
service from them.
Instance up
Message Instance <number> over <interface> up
Explanation The specified ATM instance is now operating across the specified physical
interface.
Interface created
Message Interface <interface> Created
Explanation A new ATM interface link exists on the device. ATM interfaces are created using
the add atm channel command.
Interface destroyed
Message Interface <interface> Destroyed
Explanation The specified ATM interface link no longer exists. ATM interfaces are destroyed
using the delete atm channel command.
Interface disabled
Message Interface <interface> disabled
Explanation The specified ATM interface link is disabled. ATM interfaces are disabled using the
disable atm command.
Interface down
Message Interface <interface> Down
Explanation The specified physical interface is no longer operating. ATM cannot operate while
the interface is down.
Recommended Action No action is required if this is expected. If this is unexpected, investigate the
physical interfaces status by:
using the show adsl or show shdsl command
checking the physical connection between the device and the ATM service
provider
checking the log messages recently generated for the physical interface
Interface enabled
Message Interface <interface> enabled
Explanation The specified ATM interface link is enabled. ATM interfaces are enabled with the
enable atm command.
Interface up
Message Interface <interface> up
This chapter contains messages belonging to the module DHCP (module ID 70,
DHCP for IPv4), sorted into the following Types:
DHCP (027): Dynamic Host Control Protocol on page 241
For more information about DHCP, see the Dynamic Host Control Protocol (DHCP)
chapter in the Software Reference.
For log messages about DHCP for IPv6 (module ID 117), see DHCP: Dynamic
Host Control Protocol for IPv6 on page 243.
For log messages about DHCP Snooping (module ID 137), see DHCP: DHCP
Snooping on page 248.
Module: DHCP; Type: DHCP (027) 241
Explanation The DHCP server has assigned the specified address to the specified client.
Explanation The specified client requested the specified address, but the server did not assign
the address to the client, because the address was not available, or was not
appropriate for the VLAN that the client was attached to.
Recommended Action No action is required, unless you expected the address to be appropriate and
available. If so, investigate VLAN membership and/or why the address is not
available. For example, another host could be statically configured with that
address, or the IP address pool could be too small.
Explanation A client refused a DHCP offer because the IP network offered by the server was in
use by another IP interface.
This chapter contains messages belonging to the module DHCP (module ID 117,
DHCP for IPv6), sorted into the following Types:
DHCP6: DHCP for IPv6 on page 244
For more information about DHCP6, see the Dynamic Host Control Protocol for
IPv6 (DHCP6) chapter in the Software Reference.
For log messages about DHCP for IPv4 (module ID 70), see DHCP: Dynamic Host
Control Protocol on page 240.
For log messages about DHCP Snooping (module ID 137), see DHCP: DHCP
Snooping on page 248.
Module: DHCP; Type: DHCP6 244
Type: DHCP6
DHCP for IPv6
Explanation The DHCP6 client has successfully assigned the specified address to a client.
Explanation A DHCP6 client has requested a rebind message exchange, and the DHCPv6
operation was completed successfully.
Explanation A DHCP6 client has requested a renewal message exchange, and the DHCPv6
operation was completed successfully.
Explanation The message from the specified source has failed DHCP6 authentication. This
could be the result of an invalid key.
Recommended Action Check that the keys have been created correctly or that the correct key is being
used.
Explanation The device was not able to allocate an address to one of its interfaces because the
prefix delegated to it did not contain enough /64 prefixes. The prefix delegated to
the device and its length are given in the message.
Explanation The DHCP6 client has successfully released an IPV6 address from use.
Explanation The DHCP6 client has failed to obtain the address type specified by the user. The
DHCPv6 Clients request or renew has failed. This could occur if:
the client was requesting an address that was not on the correct link
the client was attempting to renew an address for which the server had no
binding, or
the DHCPv6 server requires the use of Multicast addressing.
Recommended Action Check the configuration of both the DHCPv6 server and the client to ensure they
are set up correctly.
Explanation The DHCP6 client has successfully obtained the address type specified by the user.
This chapter contains messages belonging to the module DHCP (module ID 137,
DHCP Snooping), sorted into the following Types:
DHCPS: DHCP Snooping on page 249
For more information about DHCP Snooping, see the DHCP Snooping chapter in
the Software Reference.
For log messages about DHCP for IPv4 (module ID 70), see DHCP: Dynamic Host
Control Protocol on page 240.
For log messages about DHCP for IPv6 (module ID 117), see DHCP: Dynamic
Host Control Protocol for IPv6 on page 243.
Module: DHCP; Type: DHCPS 249
Type: DHCPS
DHCP Snooping
Explanation A new entry has been added to the DHCP Snooping Binding database.
Deleting entry
Message Deleting entry [chaddr <client-hardware-address>],
clientIP <assigned-ip-address>, vlan<vid>,
port<port-number>, serverIP <server-ip-address>
Explanation An entry has been deleted from the DHCP Snooping Binding database.
Explanation An entry has timed out and been deleted from the DHCP Snooping Binding
database.
Updating entry
Message Updating entry [chaddr <client-hardware-address>],
clientIP <assigned-ip-address>, vlan<vid>,
port<port-number>, serverIP <server-ip-address>,
Expires <time> <date>
Explanation An existing entry in the DHCP Snooping Binding database has been updated.
Entries in the database are indexed using the client hardware address (chaddr), so
this message indicates that an entry in the database with the specified chaddr
already existed. Changed fields are marked by a trailing (*).
Explanation An entry could not be added to the DHCP Snooping database because it would
exceed the maximum number of leases.
Recommended Action If the maximum lease number is set to the correct value for the port, this message
means that an unexpected host attempted to use the port and was stopped by
DHCP snooping. In that case, no action is required. However, if the host was
expected, you may need to increase the maximum number of leases available for
the specified port using the command:
set dhcpsnooping port=port-number maxleases=max-leases
Explanation An entry could not be added to the DHCP Snooping database or updated because
there are no DHCP classifiers available.
Recommended Action Ensure that the specified port has a QoS policy attached that contains a classifier
specifying either DHCPSnooping as the IP Source Address, or DHCPSnooping as
the MAC Source Address or both. For example:
create classifier=10 ipsaddr=dhcpsnooping
Explanation An ARP request was discarded without being processed because it was not in the
correct format.
Explanation An ARP request was discarded without being processed because the sender was
not in the DHCP snooping database.
Explanation An ARP request was discarded without being processed because the senders
MAC address and IP address did not match an entry in the DHCP snooping
database.
This chapter contains messages belonging to the module ENCO, sorted into the
following Types:
ENCO: Encryption and Compression on page 254
For more information about ENCO, see the Encryption Services or Compression
and Encryption Services chapter in the Software Reference.
Module: ENCO; Type: ENCO 254
Type: ENCO
Encryption and Compression
Explanation The 1141 security processor has failed its internal testing of the Public Key engine.
Explanation The 1141 security processor has failed its internal testing of the encryption
process.
Explanation The 1141 security processor has failed its internal testing of the hash process.
Explanation The 7711 Security and compression processor has failed its internal testing of the
encryption process.
Explanation The 7711 Security and compression processor has been located.
Explanation The 7711 Security and compression processor has failed its internal testing of the
onboard RAM.
Explanation The 7711 Security and compression processor has failed its internal testing.
9711 Initialised
Message 9711 Initialised
Explanation The 9711 compression processor CRAM test has completed successfully.
Explanation The 9711 compression processor has been located and internal testing has
started.
Explanation The 9711 compression processor has failed its internal testing when reading the
configuration register.
Explanation The 9711 compression processor has failed its internal testing when reading the
chip ID.
Explanation The 9711 compression processor has failed its internal testing of the CRAM.
9711 Startup Test Fail: CRAM test <code> (B): Cmd In Prog
9711 Startup Test Fail: CRAM test <code> (C): Cmd In Prog
9711 Startup Test Fail: CRAM test <code> (D): Cmd In Prog
Explanation The 9711 compression processor has failed its internal testing of the CRAM.
9711 Startup Test Fail: CRAM test <code> (B): Cmd In Prog:
PC
9711 Startup Test Fail: CRAM test <code> (C): Cmd In Prog:
PC
9711 Startup Test Fail: CRAM test <code> (D): Cmd In Prog:
PC
Explanation The 9711 compression processor has failed its internal testing of the CRAM.
9711 Startup Test Fail: CRAM test <code> (D): Data <code>
(<code> <code>)
Explanation The 9711 compression processor has failed its internal testing of the CRAM.
9711 Startup Test Fail: CRAM test <code> (D): Dest Count
<code>
Explanation The 9711 compression processor has failed its internal testing of the CRAM.
9711 Startup Test Fail: CRAM test <code> (B): Result Flags
<code>
9711 Startup Test Fail: CRAM test <code> (C): Result Flags
<code>
9711 Startup Test Fail: CRAM test <code> (D): Result Flags
<code>
Explanation The 9711 compression processor has failed its internal testing of the CRAM.
9711 Startup Test Fail: CRAM test <code> (B): Rslt In Prog
9711 Startup Test Fail: CRAM test <code> (C): Rslt In Prog
9711 Startup Test Fail: CRAM test <code> (D): Rslt In Prog
Explanation The 9711 compression processor has failed its internal testing of the CRAM.
9711 Startup Test Fail: CRAM test <code> (B): Rslt In Prog:
PR
9711 Startup Test Fail: CRAM test <code> (C): Rslt In Prog:
PR
9711 Startup Test Fail: CRAM test <code> (C): Rslt In Prog:
PR
Explanation The 9711 compression processor has failed its internal testing of the CRAM.
9711 Startup Test Fail: CRAM test <code> (B): Rslt Not
Ready
9711 Startup Test Fail: CRAM test <code> (C): Rslt Not
Ready
9711 Startup Test Fail: CRAM test <code> (D): Rslt Not
Ready
Explanation The 9711 compression processor has failed its internal testing of the CRAM.
9711 Startup Test Fail: CRAM test <code> (C): Source Count
<code>
Explanation The 9711 compression processor has failed its internal testing of the CRAM.
Explanation The 9711 compression processor has failed its internal testing of the CRAM.
Explanation The 9711 compression processor has failed its internal testing when reading the
FIFO configuration register.
Explanation The 9711 compression processor passthru test 1 has completed successfully.
Explanation The 9711 compression processor passthru test 2 has completed successfully.
9711 Startup Test Fail: Pass Thru test state check: Bad
result
Message 9711 Startup Test Fail: Pass Thru test state check: Bad
result: <code>
9711 Startup Test Fail: Pass Thru test state check: Rslt
In Prog
Message 9711 Startup Test Fail: Pass Thru test state check: Rslt In
Prog: <code>
Explanation The Cryptek security processor has failed its internal testing.
Explanation The Cryptek security processor has passed its internal testing.
Explanation The PAC security and compression card has failed its internal testing of the
encryption process.
Explanation The PAC security and compression card has been located.
Explanation The PAC security and compression card has successfully initialised.
Explanation The PAC security and compression card has failed its internal testing of the Public
Key Engine.
Explanation The PAC security and compression card has failed its internal testing of the
onboard RAM.
STAC SW Initialised
Message STAC SW Initialised
This chapter contains messages belonging to the module SSH, sorted into the
following Types:
MSG: General Messages on page 274
SSH: Secure Shell on page 275
SCP: Secure Copy on page 279
For more information about SSH, see the Secure Shell chapter in the Software
Reference.
For more information about SCP, see the Secure Shell and Managing
Configuration Files and Software Versions chapters in the Software Reference.
Module: SSH; Type: MSG 274
Type: MSG
General Messages
Type: SSH
Secure Shell
Explanation A Secure Shell (SSH) session to or from the IP address has been disconnected for
the specified reason.
Recommended Action If this is expected behaviour, no action is required. If this is an unexpected and
unwelcome event, then investigate why the session has gone down.
Explanation A Secure Shell (SSH) session was rejected because the other device is using an
incompatible version of the SSH protocol.
Recommended Action Check the version of the SSH protocol on the remote device. Version 1.5 should
be used.
Explanation A Secure Shell (SSH) session was rejected due to lack of resources.
Recommended Action Encryption and authentication resources can be checked with the SHOW ENCO
command. If no resources are available, check that the required feature licences
are installed.
Explanation A new user has been added to the Secure Shell (SSH) user database.
Explanation A user has been modified in the Secure Shell (SSH) user database.
Explanation A user has been deleted from the Secure Shell (SSH) user database.
Explanation A Secure Shell (SSH) session was rejected because the user has exceeded the
maximum number of failed logins.
and confirm the reason for the login failure with the user. Re-enable user if a
password mistake was made.
Explanation A Secure Shell (SSH) session was rejected because of a user authentication failure.
Type: SCP
Secure Copy
Aborted by user
Message Aborted by user
Explanation The file loaded onto the device, but appears damaged.
Recommended Action The source file may be damaged. Check that you are loading the correct file, and
that the file is not corrupt.
Explanation The SCP session or network connection has been disrupted, and the file could not
be transferred to the SCP server.
Recommended Action Check the connection between the device and the SCP server, then retry the file
transfer.
Explanation The file cannot be copied, as a file by that name already exists on the device.
Recommended Action Check the filename is correct, or remove the existing file before loading the new
file.
Explanation The download failed because the destination filename has a text-type file
extension, but the file contains binary data. A file containing binary data cannot
be saved as a text-type file.
Explanation The file cannot be copied, as there is no file by that name on the device.
Recommended Action Check the filename is correct and that the file exists.
Explanation The file cannot be uploaded from the device to the SCP server, because the file is
not allowed to be copied.
Filename is invalid
Message Filename is invalid - <filename>
Recommended Action Make sure that the file exists, and that there is enough free space on the device,
then retry.
Recommended Action Check that the file exists on the device and retry.
Recommended Action Check that there is no file with the same name on the device, and that the device
has enough free space.
Explanation The file could not be downloaded because the flash on the device was busy.
Recommended Action Flash may be compacting or another process is reading from flash, or writing to
flash. Wait until the current flash operation is complete, then re-enter the
command. Use the show flash command to see flash status.
Explanation The file could not be downloaded because the device does not have enough free
space.
Explanation Secure Copy failed to start the Secure Shell server because an invalid command or
option was specifed by the remote client.
Invalid S-record
Message Invalid S-record
Explanation The firmware image failed to download because the file has an invalid S-record
format.
Recommended Action Check that the firmware image is not damaged or corrupt.
Permission denied
Message Permission denied - <user>
Explanation The user does not have the privileges required to transfer files to or from the
device.
Remote error
Message Remote error - <message>
Explanation The file could not be loaded due to an error on the remote SCP server.
Explanation The Secure Copy service has been disabled. The SSH server will reject incoming
SCP connections.
Explanation The Secure Copy service has been enabled. The SSH server will accept incoming
SCP connections.
Explanation The file failed to download because the System Redundancy feature (SYSR) is
busy.
Recommended Action Try the load after SYSR synchronisation is complete. Check the SYS status with the
show system sysr command.
This chapter contains messages belonging to the module Firewall, sorted into the
following Types:
VINT: Virtual Interfaces on page 287
FIRE: Firewall on page 288
ACCO: Accounting on page 328
For more information about the firewall, see the Firewall chapter in the Software
Reference.
Module: FIRE; Type: VINT 287
Type: VINT
Virtual Interfaces
Type: FIRE
Firewall
Explanation The Firewall failed to find session records for all data channels associated with an
RTSP control channel when deleting an RTSP session record.
Explanation A device has started sending traffic that either passes from an interface specified
in a firewall policy to an interface that is not in the policy, or vice-versa.
Recommended Action Examine the data flow in question to determine if it is valid traffic. If it is valid,
then consider adding the non-policy interface to the firewall policy. If it is not
valid, then take the necessary steps to prevent it from being sent.
Explanation The SIP ALG has reached the maximum number of clients it is configured to
support in automatic client management mode. Clients who initiate sessions
above this limit are not managed by the SIP ALG automatic client management.
This log is rate-limited to once every 20 minutes after the first log is generated.
The rate limit is reset after a 20 minute period has passed in which the SIP clients
have not exceeded the client support limit.
Recommended Action Consider raising the limit higher by using the maxautoclients parameter in the
set firewall sipalg command. If this level of SIP activity is unexpected, investigate
the SIP clients by using the command:
show firewall sipalg autoclient summary
To see whether the sessions are initiated from the private or public side of the
firewall, use the command:
show firewall sipalg
Explanation The SIP ALG cannot access the client database stored in flash memory, because
the file is incorrectly formatted. This file is created by the SIP ALG when it is in
automatic client management mode, and is used to recover the SIP ALG firewall
sessions after the device reboots or restarts.
Explanation There is a conflict between the current configuration of the firewall and the list of
SIP ALG firewall sessions held in the client database found in flash memory. The
conflicting SIP ALG sessions have not been restored.
This conflict occurs if the device restarts, and the configuration script for the
firewall does not match the configuration that the firewall had before the restart.
Recommended Action Check the firewall configuration is correct for your current network.
Explanation An FTP port command was rejected either due to incorrect formatting or
insufficient firewall resources.
Recommended Action If the specified source address is that of a local device contact the administrator of
that device. Otherwise, no action is required.
Explanation An outgoing packet was unable to be NATed and forwarded because the public IP
interface is currently unnumbered.
Recommended Action Assign an IP address to the public interface or check the status of the address
allocation mechanism in use.
Explanation An ICMP packet was dropped as the policy does not permit this ICMP type to be
forwarded.
Explanation The packet was dropped because the firewall policy is not configured to allow this
type of ICMP packet.
Recommended Action If packet was expected to be permitted, check the Firewall configuration.
Otherwise, no action is required.
Explanation The packet was dropped because the firewall was unable to find a matching
record for the session specified in the IDENT request.
Recommended Action If the specified source address is that of a local device contact the administrator of
that device. Otherwise, no action is required.
Bad IP option
Message Bad IP option
012/INDOTHER
Explanation The packet was dropped because it contained an IP option that is not permitted
by the firewall policy.
Explanation A packet was dropped because the interface that received the packet is not in the
same policy as the interface that the packet would be forwarded on.
Recommended Action If this packet is to be supported the policies need to be modified so that both
interfaces appear in both policies. Appropriate rules will also be required.
Explanation A denial of service attack from the specified source IP has started.
Recommended Action If this source IP seems to a regular offender, then consider adding a rule or IP filter
to block all traffic from this source, or even try to work out the ISP from which the
traffic originates, and urge them to take steps to prevent re-occurrences of this
attack.
Explanation A denial of service attack from the specified source IP has stopped.
Explanation Firewall stateful inspection of a TCP packet required that the packet be divided
into two separate packets. An internal error related to the packet header occurred
during the process of dividing the packet.
Firewall enabled
Message <date> <time> Firewall enabled
Explanation This message is output as part of firewall event logging when there is a reason
defined.
Recommended Action Read this message in conjunction with other log messages for the same firewall
event.
Firewall disabled
Message <date> <time> Firewall disabled
Explanation Some aspect of the configuration of the specified firewall policy has been
changed.
Explanation A new IP address list or MAC address list has been added to the specified rule on
the specified policy.
Explanation The specified rule in the specified Firewall policy has been deleted.
Explanation The SMTP domain configured for this firewall policy has been changed.
Explanation One or more of the session timeout values (TCP, UDP, other) have been changed
for this firewall policy.
Explanation The parameters associated with an attack type have been changed for this firewall
policy.
Explanation One or more of the parameters associated with the specified rule in this firewall
policy have been changed.
Explanation A raw dump of packet data for a denied packet. Refer to the following log
messages for more information:
Bad ICMP forward on page 291
Bad policy setup on page 293
Policy rejected on page 311
No free memory slots on page 308
TCP session started on page 320
UDP flow started on page 323
ICMP flow started on page 302
Other IP flow started on page 309
TCP bad sequence number on page 318
TCP bad open handshake on page 319
Bad global address of 0.0.0.0 on page 290
FTP listen session started on page 301
Explanation The SIP ALG could not write to flash because auto write is disabled. The SIP ALG
stores a static version of its client database on flash when it is in automatic client
management mode. This version is used to restore the SIP firewall sessions in case
of a restart or reboot of the device.
This event is only logged once, regardless of how many times the SIP ALG
attempts to write to flash.
If you did not disabled flash autowrite, check the territory settings for the device,
because this is disabled by default when the territory is set to Japan.
Explanation The packet was dropped because there was either a specific deny rule, or no allow
rule that matched this packet.
Recommended Action If packet was expected to be permitted, check the Firewall configuration.
Otherwise, no action is required.
Explanation The packet was dropped because the source of the packet was identified as the
source of an attack.
Recommended Action If the specified source address is that of a local device, then contact the
administrator of that device. If this source IP seems to a regular offender, then
consider adding a rule or IP filter to block all traffic from this source, or even try to
work out the ISP from which the traffic originates, and urge them to take steps to
prevent re-occurrences of this attack.
Recommended Action If this source IP seems to a regular offender, then consider adding a rule or IP filter
to block all traffic from this source, or even try to work out the ISP from which the
traffic originates, and urge them to take steps to prevent re-occurrences of this
attack.
Explanation The FTP application gateway has created a session to allow an FTP data channel to
pass through the Firewall, in response to a PORT or 227 message sent by an FTP
control channel.
Explanation A host scan attack from the specified source IP address has stopped.
Explanation A host scan attack from the specified source IP address has started.
Recommended Action If this source IP seems to a regular offender, then consider adding a rule or IP filter
to block all traffic from this source, or even try to work out the ISP from which the
traffic originates, and urge them to take steps to prevent re-occurrences of this
attack.
Explanation A new ICMP flow has been allowed through the Firewall.
Explanation An ICMP packet of the specifed ICMP type and code with the specified source and
destination IP addresses, travelling inwards was allowed.
Explanation An ICMP packet of the specifed ICMP type and code with the specified source and
destination IP addresses, travelling outwards was allowed.
Explanation An ICMP packet of the specifed ICMP type and code with the specified source and
destination IP addresses, travelling inwards was denied.
Explanation An ICMP packet of the specifed ICMP type and code with the specified source and
destination IP addresses, travelling outwards was denied.
Explanation The packet was dropped by the firewall because the flag values specified in the
TCP packet header were invalid.
Recommended Action If the specified source address is that of a local device contact the administrator of
that device. The device may be infected by a virus or have faulty software.
Otherwise, no action is required.
Explanation The packet was dropped by the firewall because the protocol header of the ICMP,
TCP or UDP packet was either incomplete or absent.
Recommended Action If the specified source address is that of a local device contact the administrator of
that device. The device may be infected by a virus or have faulty software.
Otherwise, no action is required.
Recommended Action If this source IP seems to a regular offender, then consider adding a rule or IP filter
to block all traffic from this source, or even try to work out the ISP from which the
traffic originates, and urge them to take steps to prevent re-occurrences of this
attack.
Recommended Action If this source IP seems to a regular offender, then consider adding a rule or IP filter
to block all traffic from this source, or even try to work out the ISP from which the
traffic originates, and urge them to take steps to prevent re-occurrences of this
attack.
Explanation The packet was dropped because the firewall was unable to match the packet in
the payload of an ICMP destination unreachable, source quench, time to live
exceeded or parameter problem message, to any recorded session.
Explanation The packet was dropped because it attempted to pass from a private interface to
a public interface where NAT is required, but there is no address translation
configured for the packets source IP address.
Recommended Action If packet was expected to be permitted, check the Firewall configuration.
Otherwise, no action is required.
Explanation The packet was dropped because the Firewall has used up all the memory that is
available to it for tracking sessions.
Look for sessions that have not been used for a long time, i.e. sessions whose
seconds to deletion value is a lot less than the configured timeout value for the
protocol. If there are a large number of session in this state, consider decreasing
the timeout values for the protocol affected using the command:
set firewall policy
Explanation The first new TCP session has been created, either since the last active TCP session
was closed, or if no TCP sessions had been previously created.
Explanation A new packet flow has been allowed through the Firewall. Refer to previous log
message specifying the packet details to determine the packets protocol.
Explanation The packet was dropped because it was identified as part of a TCP SYN flood.
Recommended Action If the specified source address is that of a local device contact the administrator of
that device. Otherwise, no action is required. Consider added a deny rule to
permanently block traffic from this device.
Explanation A ping of death attack from the specified source IP has stopped.
Explanation A ping of death attack from the specified source IP has started.
Recommended Action If this source IP seems to a regular offender, then consider adding a rule or IP filter
to block all traffic from this source, or even try to work out the ISP from which the
traffic originates, and urge them to take steps to prevent re-occurrences of this
attack.
Policy destroyed
Message <date> <time> Policy destroyed
Policy rejected
Message Policy rejected
Explanation The packet was dropped because it was denied by the policy (either an explicit
deny rule or implicitly via the deny all incoming rule).
Explanation A port scan attack from the specified source IP address has stopped.
Explanation A port scan attack from the specified source IP address has started.
Recommended Action If this source IP seems to a regular offender, then consider adding a rule or IP filter
to block all traffic from this source, or even try to work out the ISP from which the
traffic originates, and urge them to take steps to prevent re-occurrences of this
attack.
Explanation A packet with the specified protocol, source IP and destination IP, travelling
inwards was allowed.
Explanation A packet with the specified protocol, source IP and destination IP, travelling
outwards was allowed.
Explanation A packet with the specified protocol, source IP and destination IP, travelling
inwards was denied.
Explanation A packet with the specified protocol, source IP and destination IP, travelling
outwards was denied.
Removed cookie
Message Removed cookie from (<source-ip-address>) <domain-name>
Explanation A request to set a cookie, by a server with the specified domain name, was
blocked by the HTTP proxy.
Explanation The firewall session licence loaded on the device allows more sessions than the
device can support. The number of concurrent firewall sessions will be limited to
the number the device can support.
Recommended Action No action is required. To discuss whether a different feature licence would be
more suitable for your device, contact your authorised Allied Telesis distributor or
reseller.
Explanation The firewall has rejected a session initiated by a device because the device has
reached the maximum concurrent sessions it is allowed to initiate. This limit is set
using the add firewall policy limitrule command.
Explanation A smurf amp attack from the specified source IP has stopped.
Explanation A smurf amp attack from the specified source IP address has started.
Recommended Action If this source IP seems to a regular offender, then consider adding a rule or IP filter
to block all traffic from this source, or even try to work out the ISP from which the
traffic originates, and urge them to take steps to prevent re-occurrences of this
attack.
Explanation A mail client with the specified IP address has stopped trying to send spam emails.
Explanation A mail client with the specified IP address has started trying to send spam emails.
Recommended Action If this source IP seems to a regular offender, then consider adding a rule or IP filter
to block all traffic from this source, or even try to work out the ISP from which the
traffic originates, and urge them to take steps to prevent re-occurrences of this
attack.
Explanation A mail client with the specified IP address has stopped trying to use the private
mail server as a third party relay.
Explanation A mail client with the specified IP address has started trying to use the private mail
server as a third party relay.
Recommended Action Consider adding a rule or IP filter to block all traffic from this source.
Recommended Action If this source IP seems to a regular offender, then consider adding a rule or IP filter
to block all traffic from this source, or even try to work out the ISP from which the
traffic originates, and urge them to take steps to prevent re-occurrences of this
attack.
012/INDOTHER
Explanation The packet was targeted at a private side address that is hidden from the public
side by a NAT (Network Address Translation) or a proxy.
Recommended Action If this source IP seems to a regular offender, then consider adding a rule or IP filter
to block all traffic from this source, or even try to work out the ISP from which the
traffic originates, and urge them to take steps to prevent re-occurrences of this
attack.
Explanation A device has stopped sending traffic that either passes from an interface specified
in a firewall policy to an interface that is not in the policy, or vice-versa.
Explanation A TCP SYN attack from the specified source IP has stopped.
Explanation A TCP SYN attack from the specified source IP has started.
Recommended Action If this source IP seems to a regular offender, then consider adding a rule or IP filter
to block all traffic from this source, or even try to work out the ISP from which the
traffic originates, and urge them to take steps to prevent re-occurrences of this
attack.
Explanation A TCP fragment attack from the specified source IP has stopped.
Explanation A TCP fragment attack has been started from the specified source IP.
Recommended Action If this source IP seems to a regular offender, then consider adding a rule or IP filter
to block all traffic from this source, or even try to work out the ISP from which the
traffic originates, and urge them to take steps to prevent re-occurrences of this
attack.
Explanation A TCP packet was dropped because stateful inspection determined that the
packets sequence number was inconsistent with the other packets in the session.
The remote device may be faulty or a malicious device may be trying to hijack the
TCP session.
Recommended Action If this occurs regularly, attempt to contact the administrator of the remote device
or consider adding a rule or IP filter to block packets from this source.
Explanation A TCP packet was dropped because stateful inspection determined that the flag
values in the packet were inappropriate. The remote device may be faulty or a
malicious device may be trying to disrupt the TCP session.
Recommended Action If this occurs regularly attempt to contact the administrator of the remote device.
Explanation The packet was dropped because it contained TCP flags that are invalid for the
first packet in a TCP session and there was no record of an existing session.
Explanation The TCP session record was timed out and deleted because the server failed to
respond to a SYN packet.
Recommended Action If the specified destination address is that of a local device contact the
administrator of that device. Otherwise, no action is required.
Explanation A new TCP session has been allowed through the Firewall.
Explanation A TCP packet with the specified source and destination IP addresses, and source
and destination TCP ports, travelling in the inwards direction has been allowed.
Explanation A TCP packet with the specified source and destination IP addresses, and source
and destination TCP ports, travelling in the outwards direction has been allowed.
Explanation A TCP packet with the specified source and destination IP addresses, and source
and destination TCP ports, travelling in the inwards direction has been denied.
Explanation A TCP packet with the specified source and destination IP addresses, and source
and destination TCP ports, travelling in the outwards direction has been denied
Explanation If the initiator of the TCP session is a local device contact the administrator of that
device. Otherwise, no action is required.
012/INDOTHER
Explanation The packet was dropped because it attempted to either access a firewall interface
from a non-firewall interface or access a non-firewall interface from a firewall
interface.
Recommended Action Ensure all IP interfaces on the device are present in the Firewall policy and carefully
define the permitted behaviour for each interface.
Recommended Action If this source IP seems to a regular offender, then consider adding a rule or IP filter
to block all traffic from this source, or even try to work out the ISP from which the
traffic originates, and urge them to take steps to prevent re-occurrences of this
attack.
Explanation A new UDP flow has been allowed through the Firewall.
Explanation A UDP packet with the specified source and destination IP addresses, and source
and destination UDP ports, travelling in the inwards direction has been allowed.
Explanation A UDP packet with the specified source and destination IP addresses, and source
and destination UDP ports, travelling in the outwards direction has been allowed.
Explanation A UDP packet with the specified source and destination IP addresses, and source
and destination UDP ports, travelling in the inwards direction has been denied.
Explanation A UDP packet with the specified source and destination IP addresses, and source
and destination UDP ports, travelling in the outwards direction has been denied.
012/INDOTHER
Explanation The packet was dropped because the firewall was unable to handle it, as the
maximum number of simultaneous sessions already existed.
Look for sessions that have not been used for a long time, i.e. sessions whose
seconds to deletion value is a lot less than the configured timeout value for the
protocol. If there are a large number of session in this state, consider decreasing
the timeout values for the protocol affected using the command:
set firewall policy
Explanation The packet was dropped because it needed to be NATed, but there was no free
global IP address in the address pool.
Recommended Action If these messages appear frequently and users are experiencing delays in accessing
the internet, increase the size of the global IP address pool in the Firewall NAT
configuration where possible. If it is not possible to increase the size of the global
IP address pool, consider using enhanced NAT which only requires a single global
IP address and can be used by a very large group of users.
Explanation A UPnP port mapping was added to map packets with the specified characteristic
through to a private side.
URL: blocked
Message URL:<blocked-url> blocked from <source-ip-address>
Explanation A URL requested by a device with the specified source IP was blocked by the HTTP
proxy because the URL is not permitted by the policy.
Explanation A URL requested by a device with the specified source IP was blocked by the HTTP
proxy because it contains a keyword that is not permitted by the policy.
Type: ACCO
Accounting
Explanation The amount of data that was exchanged by the packet flow described in the
previous log message.
Explanation A packet flow with the specified characteristics has started and is being monitored
by the Firewall.
Explanation A packet flow with the specified characteristics, which was being monitored by
the Firewall, has stopped.
This chapter contains messages belonging to the module IPSEC, sorted into the
following Types:
IPSEC: IP Security on page 331
For more information about IPsec, see the IP Security (IPsec) chapter in the
Software Reference.
Module: IPSEC; Type: IPSEC 331
Type: IPSEC
IP Security
Explanation The VPN tunnel could not be created, because this would exceed the number of
concurrent VPN connections allowed with the current feature license.
Recommended Action Wait until another connection has closed, then retry. To force a policys connection
to close, use the reset ipsec policy command for the specific policy. To arrange a
feature licence for a higher tier, contact your authorised Allied Telesis distributor or
reseller.
Explanation During inbound IPsec processing a packet was discarded as specified by a policy
action. IPsec has denied the traffic due to a matching policy with a deny action.
Explanation This message indicates that during IPSEC processing an inbound ESP, AH or
IPCOMP packet was discarded. Detailed information of the packet and reasons for
discard are logged.
Explanation During inbound IPSEC processing, the processing for a packet failed. This may be
because of the IPsec policy configuration, or because a failure has occurred in the
processing of the packet protocols.
Recommended Action Check the IPsec policy configuration for incorrect action or selectors. If the
configuration is correct, initiate debugging of packet traffic using the command:
enable ipsec policy debug
Explanation During inbound IPSEC processing, an IPSEC packet was received which did not
match a local policy.
Recommended Action Check IPsec policy configuration for incorrect action or selectors.
Explanation An IPsec policy SA bundle has reached its soft expiry lifetime limit. IPsec will
attempt to renegotiate a new bundle.
Explanation The VPN tunnel could not be created because this would exceed the licensed
number of concurrent VPN connections.
Recommended Action Wait until another connection has closed, then retry. To arrange a feature license
for a higher tier, please contact your authorised Allied Telesis distributor or reseller.
Explanation This message indicates that during IPSEC processing an outbound ESP, AH or
IPCOMP packet was discarded. Detailed information of the packet and reasons for
discard are logged.
Explanation An IPSEC policy SA bundle has reached its expiry lifetime limit. The traffic will be
queued and IPSEC will attempt to renegotiate a new SA bundle.
Explanation During outbound IPSEC processing, an IPSEC policy SA bundle was not found.
IPSEC will attempt to renegotiate a new SA bundle.
Explanation An IPSEC policy SA bundle has reached its soft expiry lifetime limit. IPSEC will
attempt to renegotiate a new bundle.
Explanation During inbound IPsec processing, the verification of the ICV (Integrity Check
Value) contained in the security protocol header failed. Authentication may have
failed due to incompatible ICV or padding.
Recommended Action Check the IPsec configuration to ensure authentication keys are correctly setup.
Explanation This message indicates that during an inbound IPsec processing, a packet passed
to IPSEC with invalid ESP encryption padding.
Recommended Action Check the IPsec configuration to ensure encryption keys are correctly setup.
Explanation During outbound IPsec processing, a packet was discarded due to a sequence
number overflow. The sequence number has cycled and 'anti-replay' is
configured.
Recommended Action Check the configuration of the remote device to ensure it is correctly setup.
Explanation During inbound IPSEC processing, a packet with sequence number out of the valid
window range was seen. The sequence number has wrapped or is too old and
'anti-replay' is configured.
Explanation During inbound IPSEC processing, IPsec received a packet with a sequence
number that had been seen before. 'Anti-replay' is configured.
Explanation The VPN licence loaded on the device allows more VPNs than the device can
support. The number of concurrent VPN tunnels is limited to the number that the
device can support.
Recommended Action No action is required. To discuss whether a different feature licence would be
more suitable for your device, contact your authorised Allied Telesis distributor or
reseller.
This chapter contains messages belonging to the module ISAK, sorted into the
following Types:
IKMP: ISAKMP Key Management on page 339
For more information about ISAKMP, see the IP Security (IPsec) chapter in the
Software Reference.
Module: ISAK; Type: IKMP 339
Type: IKMP
ISAKMP Key Management
Authentication failed
Message Exchange <number>: Authentication failed
Explanation An ISAKMP peer sent a Hash payload which was different to the expected Hash,
so the peer could not be authenticated.This indicates one of the generated
authentication SKEYIDs is incorrect.
Recommended Action The devices may not be configured correctly, or an error may have occurred in the
SKEYID generation. Check that the devices have the same pre-shared secret, and
the same Hash algorithm configured. Check the Nonce payloads sizes are correct,
and re-attempt the exchange.
Explanation The device discarded a packet the peer sent over the old NAT-T UDP port. Once a
NAT-T (500 to 4500) port change occurs, any Main mode or Aggressive mode
packets received on the old port are discarded (as per the NAT-T draft).
Recommended Action This indicates that the device received an old, delayed packet, or that the peer is
behaving unexpectedly. If the secure connection does not establish, use the
enable isakmp debug command to investigate the problem further, paying
particular attention to the NAT-T payloads and port numbers used. Multiple log
messages received for the same exchange can indicate a replay attack.
Explanation The device received an encrypted ISAKMP message that it judged as invalid.
Recommended Action Check the pre-shared secret on the peer device is correct. This could also indicate
a DOS attack.
Explanation The device received a Delete message notifying it that the peer had destroyed an
ISAKMP or IPsec SA. ISAKMP peers periodically re-key and delete SAs, as
configured traffic volume and time expiry limits are reached.
Explanation The device discarded a packet received from a peer, because the source IP address
or source port address had changed unexpectedly. Either no NAT devices were
detected between the peers, or the NAT device detected should not require the
port or IP address change that was made.
Recommended Action This could indicate that the device received an old, delayed packet, or that there is
a problem due to a NAT-T inter-operability difficulty with a third-party device. If
the secure connection does not establish, use the enable isakmp debug
command to investigate the problem further, paying particular attention to the
NAT-T payloads and IP addresses and port numbers used. Multiple log messages
received for the same exchange can indicate a replay attack.
Recommended Action Check the configuration of the peer device. If it is a third party device, it may be
configured to negotiate for another DOI, or to send messages with an invalid
value.
Exchange failed
Message Exchange <number>: Failed
Explanation An ISAKMP exchange could not be created because too many ISAKMP exchanges
are already in progress. The device limits the number of concurrent ISAKMP
exchanges to protect its CPU resources from Denial of Service attacks.
Recommended Action If the device normally accepts a large number of ISAKMP connections, then
connections to the device may occasionally exceed the exchange limit without
affecting ISAKMP and IPsec operation. If this is affecting ISAKMP and IPsec
operations, then:
Check the reliability of the network. If the network is unreliable, then
configure both this device and its peer device with similar ISAKMP
retransmission timeouts. To change the timeout settings, use the
msgtimeout and msgretrylimit options in the set isakmp policy
command.
Check the frequency of this exchange limit failure using the log feature. If this
issue occurs at consistent time intervals, and the device has a large number of
policies, then ISAKMP may be re-keying many exchanges at the same time,
causing congestion. Stagger the ISAKMP and IPsec expiry-limits to avoid any
congestion by using the expirykbytes and expiryseconds options in the
set ipsec bundlespecification and set isakmp policy commands.
Check the peer addresses for unknown hosts using the show isakmp
exchange command. Any unknown address could be a malicious host
launching an ISAKMP DOS attack. If an unknown IP address is generating the
an excessive number of exchanges, then investigate the host. If a known IP
address is generating an excessive number of exchanges, then check that the
peer device is configured correctly.
Check the length of time that exchanges are taking. ISAKMP exchanges
should complete quickly, and should not take longer than a few seconds,
accept for when in deletedelay state. If exchanges are taking more than a
few seconds, then the peer device could be misconfigured. To find slow
exchanges, use the show isakmp exchange command multiple times every
two seconds, and look for exchanges that are taking more than a few
seconds to complete. Alternatively, check for slow exchanges by comparing
the time listed in the exchange started and the exchange completed logs
for each exchange.
Explanation Repeated attempts to complete an ISAKMP exchange have failed. IKE exchanges
are only re-attempted when the parameter retryikeattempts is set to a non-zero
value in the create isakmp policy and set isakmp policy commands. See the IP
Security (IPsec) chapter of the Software Reference for more information. The
device has reached the configured number of consecutive retry attempts and will
no longer retry the exchange. The previous IKE exchange may have failed because:
there is a network problem or outage
SA proposals sent by the device were rejected
the device or its peer are misconfigured or unresponsive
If the device has IPsec traffic to encrypt it will still initiate ISAKMP exchanges
normally, however, manual intervention may be required to successfully bring up a
secure connection.
Recommended Action Investigate the possible causes. Try sending traffic, such as ping, across the tunnel
to troubleshoot the problem. Use the following commands to determine if a VPN
tunnel is still active and what the cause of the failure was:
enable isakmp debug
show ipsec counter
show ipsec policy sabundle for the specific policy
show ipsec sa
show isakmp counters
show isakmp exchange
show isakmp sa
show log
See the IP Security (IPsec) chapter for more information about using these
commands.
Incompatible versions
Message Exchange <number>: Incompatible versions
Explanation The device does not support the version of ISAKMP specified in the received
message. Currently the device only supports version 1.0 of ISAKMP.
Recommended Action Check the version(s) of ISAKMP that the peer device supports, and configure to
version 1.0 if possible.
Explanation An IKE exchange is being re-attempted after an exchange failure. IKE exchanges
are only re-attempted when the parameter retryikeattempts is set to a non-zero
value in the create isakmp policy and set isakmp policy commands. See the IP
Security (IPsec) chapter for more information. The previous IKE exchange may
have failed because:
there was a temporary network problem
there was a one-off error with the key exchange
the device rejected the SA proposal from the peer
the peer sent a delete message for the only remaining SA
Recommended Action Investigate the possible causes if the IKE exchanges continue to fail, despite
successive retry attempts. Try sending traffic, such as ping, across the tunnel to
troubleshoot the problem. Use the following commands to determine if a VPN
tunnel is still active and what the cause of the failure was:
enable isakmp debug
show ipsec counter
show ipsec policy sabundle for the specific policy
show ipsec sa
show isakmp counters
show isakmp exchange
show isakmp sa
show log
See the IP Security (IPsec) chapter for more information about using these
commands.
Explanation An ISAKMP peer sent a Hash payload with the wrong length. The Hash payload
needs to be the same length as the Hash algorithm configured on the device.
Recommended Action Check that the ISAKMP peer has the correct Hash algorithm configured, and that
the Hash payload length sent is the right length for the Hash algorithm.
Invalid id information
Message Exchange <number>: Invalid id information
Explanation The device received an Identification payload which contained invalid information.
For phase 1 exchanges, this can mean:
an invalid X.500 distinguished name was specified
the port was incorrect; this should be set to either 500 or zero
the protocol was incorrect; this should be set to UDP or zero
Recommended Action Check the configuration on the peer device. The peer may be sending an incorrect
Identification payload.
Explanation An ISAKMP payload that the device received is different to the expected payload
type. The payload may have been an unknown type, or may have occurred in the
message more times than expected.
Recommended Action The ISAKMP peer may be sending vendor-specific payloads, or behaving
unexpectedly. Use the show isakmp counters, or enable isakmp debug
commands to see determine why the payload is invalid. Check the configuration
of the peer device.
Explanation An error was encountered while processing the format of the ISAKMP proposal
payloads. The error may have occurred because:
the phase 1 SA proposal was not the first payload
more than one phase 1 proposal was specified
more proposals or transforms were specified than the device supports
the proposal/transform payload format was incorrect
Recommended Action To determine the exact cause of the proposal syntax error, use the enable isakmp
debug command and check the output from the show isakmp counter
command for aggressive, main and quick mode. Once the exact cause is found,
change the configuration of the peer as needed.
Invalid protocol id
Message Exchange <number>: Invalid protocol id
Explanation The value received for the Protocol-ID field in a Notification, Delete, or Proposal
payload was not supported by the device, or was different to what the device
expected. For example, receiving an IPsec Protocol-ID in a phase 1 exchange,
when it should be an ISAKMP Protocol-ID.
Recommended Action Check the configuration on the peer device. It may be configured to negotiate an
unsupported Protocol-ID, or it may be sending messages with an invalid value.
Invalid SPI
Message Exchange <number>: Invalid SPI
Explanation The IPsec SPI received was a different length or different value than expected. A
4-byte SPI is expected, as per RFC 2409. If IPComp is used, then a 2-byte SPI is also
accepted.
Recommended Action Check the configuration on the peer device. It may be configured to negotiate for
an unsupported SPI size, or it may be sending messages with an invalid value.
Explanation The local UDP port has changed. This occurs when NAT-T moves the ISAKMP
traffic from the primary port (default 500) to the secondary 4500 port.
Explanation The device received more than one Initial-Contact notification for the same
ISAKMP SA. The Initial-Contact message is only sent if the new SA is the first SA
established with a peer. This can occur if the peer reboots, which makes older SAs
no longer valid.
Recommended Action Investigate the sending device if repeated Initial-Contact notification messages
occur, as this indicate a DoS replay attack.
No proposal chosen
Message Exchange <number>: No proposal chosen
Explanation None of the ISAKMP proposals offered by the peer matched the values of the local
security policies on the device.
Recommended Action Use the enable isakmp debug commands to determine which ISAKMP attribute
is failing to match. Check the configuration on both devices as one device may be
misconfigured. In particular, check both devices have the correct values for the:
encryption algorithm
Hash algorithm
authentication method
Diffie-Hellman group description and group type
key length
Explanation The device received a notification message that indicates an error occurred in an
ISAKMP exchange.
Recommended Action Investigate the notification type received. Standard notification message types are
defined by RFC 2408 and more information on why the peer sent an individual
message can be found in that document.
Explanation The device received a notification message where the message type is a DOI-
specific code. DOI-specific codes are described in RFC 2407. This normally
indicates the device has received status information that is supplementary to the
exchange. This generally means:
this is the first ever SA established with the peer
the peer chose a different SA lifetime
the devices are establishing whether anti-replay detection will be used
Explanation The device received a notification message where the message type is a private-
use code. This indicates that the peer is sending an invalid or unsupported notify
message type.
Recommended Action Check the configuration on the peer device. It may be trying to use vendor-
specific functionality that it not supported by the device.
Explanation The device received a notification message where the message type is a reserved
code. This indicates that the peer is sending an invalid or unsupported notify
message type.
Recommended Action Check the configuration on the peer device. It may be trying to use vendor-
specific functionality that it not supported by the device.
Explanation The device sent a notification message to the peer indicating that an error
occurred in the ISAKMP exchange.
Recommended Action To determine why the exchange failed, examine the log messages for that
exchange. To see extended details use the commands show isakmp counter and
enable isakmp debug.
Explanation The device sent a Connected notification to the peer, indicating that the new SA is
established and ready to receive traffic. The device can only send these messages
when the setcommit parameter is set to on for the ISAKMP policy.
Explanation The device sent a DOI-specific notification to the peer. This is usually an Initial-
Contact message, which is sent when the new SA is the first SA established with
the peer. These are commonly sent when the device reboots, and a peer is sending
traffic over an SA established before the reboot. The message sent informs the
peer that any previous SAs are no longer valid.
Payload malformed
Message Exchange <number>: Payload malformed: <reason>
Explanation The payload of a packet received by the device did not conform due to the reason
listed. The packet was dropped. Discrepancies with packet payloads can be due
to:
unexpected messages or retransmissions, which can be due to an SA being
removed on one peer but not the other
the message being decrypted incorrectly, which can occur when pre-shared
keys are incorrect
the peer using an unsupported ISAKMP behaviour or cryptographic algorithm
packet corruption
a denial-of-service attack
Discrepancies with the interpretation of RFC standards by third party
equipment operating as the peer
Recommended Action If multiple payload malformed messages are received, then check that the secure
connection is still valid, for example, by pinging across the IPSEC tunnel. If the
IPSec tunnel is no longer valid, then try to re-establish the SAs manually. If this is
the first time that an IPSec tunnel is being attempted with the peer, then check
that the configuration and any pre-shared keys are correct on both devices.
Payload missing
Message Exchange <number>: Payload missing
Explanation An expected payload did not arrive, or arrived in an unexpected order. For
example, the first payload in each Quick mode message should always be the
Hash payload. This may indicate:
that the device and its peer are mis-configured; for example, they may be
using different authentication methods
if the peer is a third-party device, that the vendors ISAKMP implementation
interpret the RFCs in a different or unusual manner
that a DoS attack is occurring.
Check that the peer is configured correctly and the message originated from the
peer device. Referring to the RFCs may also help to understand why the payload is
unexpected. Contact your authorised Allied Telesis distributor or reseller for
further help if this problem continues to cause trouble establishing a secure
connection.
Explanation The device initiated a new phase 1 exchange with an ISAKMP peer.
Explanation The device is responding to a new phase 1 exchange, initiated by an ISAKMP peer.
Explanation The device initiated a new phase 2 exchange with an ISAKMP peer.
Explanation The device is responding to a new phase 2 exchange, initiated by an ISAKMP peer.
Prenegotiation failed
Message Exchange <number>: Prenegotiate failed
Explanation The ISAKMP exchange was rejected because the SA life-duration value set by the
peer is lower than this device supports.
Recommended Action Set the SA life-duration value on the peer device to 60 seconds or greater. If you
cannot access the peer device, then investigate whether the peer is
misconfigured, or attempting a denial-of-service attack.
Explanation The remote IP address has changed. This can occur if the NAT box is restarted, and
has a global IP address dynamically assigned to it.
Explanation The remote UDP port has changed. This occurs when NAT-T moves the ISAKMP
traffic from the primary port (default 500) to the secondary 4500 port.
Explanation The device received a retransmission of the last message from the ISAKMP peer
after the ISAKMP exchange had completed. The exchange must be in the
DELETEDELAY state. This indicates that the peer did not receive the last message
that the device transmitted in the ISAKMP exchange.
Recommended Action This could indicate that the last message that the device transmitted was lost due
to network congestion. The device will resend its last message again, in an
attempt to recover the ISAKMP exchange.
Explanation The device received an ISAKMP message which had an unsupported situation
value in the SA proposal. Currently the device only supports the IPsec DOIs
SIT_IDENTITY_ONLY (0x01).
Recommended Action Check the configuration on the ISAKMP peer. It may be configured to negotiate
for another DOI or situation, or it may be sending messages with an invalid value.
Explanation An ISAKMP message received has a length field which is different to the actual
length of the message.
Recommended Action Check that the peer is formatting the ISAKMP message correctly. This could
indicate a DoS attack.
Explanation The device responded to a new phase 1.5 transaction exchange by sending
extended authentication information to the peer. The device is acting as the
XAUTH client in this exchange.
Explanation The device initiated a new phase 1.5 transaction exchange with the peer to verify
the peers extended authentication information. The device is acting as the XAUTH
server in this exchange.
Explanation The XAUTH transaction exchange with the specified peer failed.
Recommended Action Check the XAUTH details configured for the client device, such as the username
and password, match the details specified in the servers user database.
Explanation The XAUTH transaction exchange with the specified peer succeeded.
This chapter contains messages belonging to the module FING, sorted into the
following Types:
AUTH: Authentication on page 361
For more information about Finger, see the Internet Protocol (IP) chapter in the
Software Reference.
Module: FING; Type: AUTH 361
Type: AUTH
Authentication
Recommended Action Check that the host has a finger server running.
Explanation The reply message from the host fingered had invalid ASCII codes in it.
Recommended Action Contact your authorised Allied Telesis distributor or reseller for assistance.
This chapter contains messages belonging to the module HTTP, sorted into the
following Types:
AUTH: Authentication on page 363
HTTP: Hypertext Transfer Protocol on page 364
For more information about using HTTP, see the Managing Configuration Files and
Software Versions chapter in the Software Reference.
Module: HTTP; Type: AUTH 363
Type: AUTH
Authentication
Explanation The authorisation of an HTTP request has failed. The user is identified by user-
name and IP address.
Recommended Action A user has failed to type the correct user-name and/or password into the browser
prompt. Check that they have the correct user-name and password.
Type HTTP
Hypertext Transfer Protocol
Explanation An HTTP request has been received that exceeds 80k bytes.
Recommended Action HTTP requests which are greater than 80k bytes are considered to be unsafe. It is
possible that someone is attacking the device. Investigate.
Explanation An HTTP response header has been received that exceeds 80k bytes.
Recommended Action HTTP response headers which are greater than 80k bytes are considered to be
unsafe. It is possible that someone is attacking the device. Investigate.
Explanation An unexpected end-of-line has been encountered when parsing a file within
multi-part HTTP form data.
Recommended Action The received HTTP request is corrupted. Someone could be trying to attack the
device. Investigate.
Explanation An unexpected end-of-line has been encountered when parsing a file path within
multi-part HTTP form data. The received HTTP request is corrupted. Someone
could be trying to attack the device.
Recommended Action The received HTTP request is corrupted. Someone could be trying to attack the
device. Investigate.
Recommended Action The received HTTP request is corrupted. Someone could be trying to attack the
device. Investigate.
Explanation A file being served by the HTTP server could not be closed.
Explanation A file being served by the HTTP server could not be opened.
Explanation A read operation failed on the file being served by the HTTP server.
Explanation An HTTP request has failed. The HTTP failure code and message is displayed and
the user is identified by user-name and IP address.
Recommended Action HTTP failure codes are described in RFC 2616 - Hypertext Transfer Protocol.
Explanation An HTTP request has been successfully received. The user is identified by user-
name and IP address.
This chapter contains messages belonging to the module VRRP, sorted into the
following Types:
VRRP: Virtual Router Redundancy Protocol on page 369
For more information about VRRP, see the Virtual Router Redundancy Protocol
(VRRP) chapter in the Software Reference.
Module: VRRP; Type: VRRP 369
Type: VRRP
Virtual Router Redundancy Protocol
Explanation This device has become the master router of the specified Virtual Router.
Recommended Action If this device is not the preferred master router, check the operational status of the
preferred master router. Otherwise, no action is required.
Explanation A VRRP advertisement packet was received and discarded due to errors in the
packet.
If the problem persists contact your authorised Allied Telesis distributor or reseller.
Explanation An internal error occurred when configuring the device to receive the VRRP virtual
MAC address. This error will prevent the device from correctly acting as the VRRP
master router.
Explanation An internal error occurred when removing the VRRP virtual MAC address from the
list of MAC addresses that the device should receive.
Explanation An internal error occurred when configuring the switch hardware tables to handle
the VRRP virtual MAC address. This error will prevent the switch from correctly
acting as the VRRP master router.
Explanation An internal error occurred when removing the VRRP virtual MAC address from
switch hardware tables when the device ceased to be the master router.
Explanation The priority of this device within the specified Virtual Router has been reduced
due to the specified Monitored Interface going down.
Recommended Action Check the status of the Monitored Interface. Restore the connection if required.
Explanation The Virtual Router interface is not attached to IP, so it cannot be used. (This Virtual
Router interface is the one specified using the OVER parameter of the CREATE
VRRP command.)
Explanation Either:
when attempting to transmit a VRRP advertisement packet, VRRP was unable
to find an appropriate interface IP address to use as the source address of the
packet,
the interface this Virtual Router is operating over no longer has an IP interface
attached to it. The Virtual Router cannot operate correctly, or
the device attempted to become either a backup router or the master router
for the specified virtual router but the interface this Virtual Router is operating
over no longer has an IP interface attached to it. The Virtual Router cannot
operate correctly.
Recommended Action Check the interface that this VRRP operates over. Make sure there is at least one IP
interface configured and that its subnet includes the Virtual Router IP address.
Explanation The priority of this device within the specified Virtual Router has been increased
because the specified Monitored Interface has come up.
Explanation The device previously acting as the master router (this device or another one in the
VR) of the virtual router has been replaced by the device with the specified
IP address.
Recommended Action If the device with the specified IP address is not the preferred master router, check
the operational status of the preferred master router.
Explanation The number of active ports in the specified VLAN has decreased so VRRP Port
Monitoring has decreased the priority of this device in the Virtual Router by the
specified amount.
Recommended Action Check that all required ports in the specified VLAN are connected. If ports are
connected but not active check the condition of cables and the remote device.
Explanation The number of active ports in the specified VLAN has increased so VRRP Port
Monitoring has increased the priority of this device in the Virtual Router by the
specified amount.
Explanation The specified virtual router has been disabled or destroyed on this device.
Previously, this device was master of this virtual router, so it has sent a VRRP
advertisement packet indicating that it is retiring as master router.
Recommended Action If this is the intended behaviour, no action is necessary. Otherwise, check the
status of the specified virtual router on this device.
This chapter contains messages belonging to the module GUI, sorted into the
following Types:
USER: User Authentication Facility on page 376
GUI: Graphical User Interface on page 377
For more information about using the GUI, see the Using the Graphical User
Interface (GUI) chapter in the Software Reference.
Module: GUI; Type: USER 376
Type: USER
User Authentication Facility
Explanation A user with the IP address specified has logged on using the HTTP-based graphical
user interface (GUI).
Recommended Action Make sure that the user is authorised to log in using the GUI. If not, investigate
the source of the user.
Explanation A GUI user with the IP address specified has logged out.
Recommended Action Make sure that user is authorised to use the GUI. If not, investigate the source of
the user.
Type: GUI
Graphical User Interface
Explanation The GUI resource file has been set to the specified resource file for the specified
install.
Explanation The GUI resource file has been set to none for the specified install, effectively
disabling the GUI when the device runs from that install.
This chapter contains messages belonging to the module PKI, sorted into the
following Types:
PKI: Public Key Infrastructure on page 379
For more information about PKI, see the Public Key Infrastructure (PKI) chapter in
the Software Reference.
Module: PKI; Type: PKI 379
Type: PKI
Public Key Infrastructure
Explanation The certificate enrollment for the specified keypair has completed successfully.
Explanation The certificate update for the specified keypair has completed successfully.
This chapter contains messages belonging to the module BGP, sorted into the
following Types:
BGP: Border Gateway Protocol on page 381
For more information about BGP, see the Border Gateway Protocol version 4
(BGP-4) chapter in the Software Reference.
Module: BGP; Type: BGP 381
Type: BGP
Border Gateway Protocol
Explanation The system is getting low on memory. To reduce the chance that the system runs
out of RAM and reboots or other parts of the system are affected, BGP is now
limiting the learning/propagation of BGP route information. This means your BGP
network is unreliable.
Recommended Action Work out which aspect of the system is using more RAM than expected when the
product was sized for this task. Resolve the memory shortage in one of the
following ways:
To add more RAM, contact your authorised Allied Telesis distributor or reseller.
Reduce the number of routes BGP is learning, or storing.
If the RAM usage was a non-BGP task then restrict or limit this other task.
Reboot the device, as its BGP tables are unrecoverably inconsistent with the BGP
peers tables.
followed by:
<event> -> <new-state>
Explanation These two log messages occur together when a BGP peer relationship has
changed state, showing the old state, the event that caused the state change, and
the new state.
Explanation BGP failed to register one of the BGP limits for system memory usage, and BGP
backoff functionality will not be activated.
Explanation BGP failed to set a notification threshold for monitory system memory usage, and
BGP backoff functionality will not be activated.
Explanation BGP failed to set a memory usage limit. The BGP backoff memory limits will not be
changed from their current values.
Recommended Action Retry setting the memory usage limits, and disable and enable bgp backoff. If this
does not work, restart the device.
Explanation The total system memory usage has reached the limit set for BGP backoff, and
BGP has stopped processing. BGP will continue to back off until the memory
usage falls, unless either the total backoff limit or the consecutive backoff limit is
reached. This log displays the amount of consecutive backoffs reached so far.
Recommended Action Increase the memory size of the device, or reduce the number of BGP routes that
the device is required to learn.
Explanation BGP has reached either the consecutive or total backoff limit. If either one of these
limits is reached, then all peers will be disabled. Peers will need to be manually re-
enabled.
Recommended Action Reduce the number of routes that BGP is expected to learn, then re-enable the
BGP peers.
followed by:
<error-code> error, <error-subcode>
Explanation These two log messages occur together when the identified peer has sent a
notification message. The peer connection has shut down.
Recommended Action Check the configuration of the remote device to ensure it is correctly setup.
followed by:
<error-code> error, <error-subcode>
Explanation These two log messages occur together when the BGP system transmits a
NOTIFICATION message to the identified peer. The string representation of the
error code and error subcode is output.
Recommended Action Evaluate the notification message to identify why the peer connection was taken
down.
Threshold reached
Message Lower BACKOFF threshold reached. Initiating Upper threshold <number>%
Explanation BGP backoff has reached either its upper or lower threshold and will begin
monitoring the opposite threshold. If the upper threshold has been reached then
BGP will be in a backed off state. If the lower threshold has been reached then
BGP will begin processing unless its peers are disabled.
Explanation The system has received more than the configured limit of routes from this peer.
The last learnt routes are being dropped to protect system resources.
Recommended Action Check the configured maxprefix limit for the peer by using the command
show bgp peer=<peer-ip-address>
If necessary, contact the peers administrator to find out why it is sending more
routes than you expect.
Explanation The system has received more than the configured limit of routes from this peer.
The peer connection is being disconnected.
Recommended Action Contact the peers administrator to find out why it is sending more routes than
you expect.
This chapter contains messages belonging to the module LOAD, sorted into the
following Types:
LBAL: Server Load Balancer on page 387
For more information about the load balancer, see the Server Load Balancing
chapter in the Software Reference.
Module: LOAD; Type: LBAL 387
Type: LBAL
Server Load Balancer
Explanation A resource returned an HTTP server error status code that has been specified by
the user to indicate that the resource is in an error state. As a result the resource
has been marked as down.
Recommended Action Check the cause of the HTTP error code. When the HTTP server is available, enable
the Load Balancer to use it as a resource using the command:
enable loadblancer resource
Recommended Action Check the resource. To change the critical RST value, use the command:
set loadbalancer criticalrst
Explanation One of the periodic healthcheck pings of a Load Balancer resource configured on
the device failed, and as a result the resource has been marked as down.
Either:
the connection to the resources has gone down, or
the resources themselves have all become unavailable, because they have
failed or are too busy to respond.
Recommended Action Restore the connection between the load balancer and the resources, restart the
resources (if they have become unavailable), or wait for the resources to become
less busy. Then, either wait for the resources to be marked up again by the load
balancer, or set all the resources to up using the command:
enable loadbalancer resource
Explanation This message indicates that the other device, which is to be the redundant load
balancing peer, is unavailable (i.e. is unable to be pinged), hence a redundant
peering relationship cannot be initiated.
Recommended Action Check all physical connections for the IP interface used to access the LB replication
peer router. Try manually pinging the address of the LB replication peer router
(this is the peerip parameter in the configuration). Check that the configuration
for this replication is correct. It should be similar to the following configuration:
set loadbalancer redundancy peerip=192.168.2.201
listenport=5555 publicint=vlan1 redundip=172.207.1.2
redunmask=255.255.0.0
Make sure that there is no confusion between the parameters peerip and
redundip. The parameter peerip is the address of the redundancy peer, and
redundip is the IP address that is backed up by the redundancy protocol. This is
the IP address used by the master for load balancing.
Explanation This message indicates that the other device, acting as a redundant load balancing
peer, is available on the network and therefore a redundant peering relationship
can be initiated.
Explanation The Load Balancer resource has changed state to closing or down.
Either:
the connection to the resources has gone down, or
the resources themselves have all become unavailable, because they have
failed or are too busy to respond.
Recommended Action Restore the connection between the load balancer and the resources, restart the
resources (if they have become unavailable), or wait for the resources to become
less busy. Then either wait for the resources to be marked up again by the load
balancer, or set all the resources to up using the command:
enable loadbalancer resource
Explanation The Load Balancer resource has changed state from closing or down to up, so the
resource has become available.
Explanation None of the resources in the resource pool associated with the virtual balancer
handling a client connection could accept the connection.
Recommended Action Check all resources, and enable any that are down using the command:
enable loadbalancer resource
Recommended Action If this is intended behaviour, no action is necessary. To return the virtual balancer
to the up state, use the ENABLE LOADBALANCER VIRTUALBALANCER command.
Explanation The virtual balancer has changed state from closing or down to up.
This chapter contains messages belonging to the module CFLA, sorted into the
following Types:
FILE (048): File System on page 393
CFLASH: CompactFlash on page 395
For more information about CompactFlash support, see the Managing the File
System chapter in the Software Reference.
Module: CFLA; Type: FILE (048) 393
Explanation The newly created file handle was already on the list of files. This error is
generated adding either a file or a directory to the software directory listing that
the file has been physically added to the CompactFlash card.
Recommended Action Remove and replace the CompactFlash card to refresh the file list.
Explanation The file pointer was not on the list of files when it was expected. This error is
generated deleting either a file or a directory. The physical delete has occurred and
the update of the software directory listing has failed.
Recommended Action Remove and replace the CompactFlash card to refresh the file list.
Explanation The file could not be opened due to another failure. A message will be output
indicating this failure.
Type: CFLASH
CompactFlash
Explanation The FAT table entry for the current directory could not be found. This usually
occurs because the CompactFlash card is incorrectly formatted or has become
corrupted.
Recommended Action Replace the CompactFlash card with a correctly formatted CompactFlash card.
Explanation There is a fixed limit on the number of entries, files or directories, in the root
directory. This is dependant on the size of a cluster; a typical number is 512.
Explanation There was not enough free space found to create a directory entry on the
CompactFlash card. At least one free cluster is required to create a file or directory.
Recommended Action Delete some files from the CompactFlash card to create space.
Explanation The CompactFlash card reported an error during the confirmation of a write
operation.
Explanation The CompactFlash card reported an error. Refer to the CompactFlash card
vendors datasheet for status values.
Explanation The CompactFlash card did not complete the confirmation of a write operation.
Explanation The CompactFlash card did not complete the operation. This usually indicates a
faulty or mis-inserted card.
This chapter contains messages belonging to the module ALAR, sorted into the
following Types:
SYSINFO: System Status and Alarms on page 400
For more information about the alarms, see the Configuring and Monitoring the
System chapter in the Software Reference.
Module: ALAR; Type: SYSINFO 400
Type: SYSINFO
System Status and Alarms
Explanation An alarm has been activated. An alarm is a relay which may be used to drive
external alarm devices such as flashing lights or sirens.
Recommended Action If the alarms are being used to drive an external alarm device, action may already
have been taken. To display the exact event that occurred, enter the command:
show alarm
Explanation An alarm has been deactivated. An alarm is a relay which may be used to drive
external alarm devices such as flashing lights or sirens.
Recommended Action Alarm deactivation does not require action, as deactivation represents the clearing
of an alarm condition that required action.
This chapter contains messages belonging to the module SSL, sorted into the
following Types:
SSL: Secure Sockets Layer on page 402
For more information about SSL, see the Secure Socket Layer (SSL) chapter in the
Software Reference.
Module: SSL; Type: SSL 402
Type: SSL
Secure Sockets Layer
Handshake failed
Message The handshake initiated by <remote-ip-address> failed
Explanation The SSL handshake failed. The connection will be closed after a fatal alert has
been sent.
Recommended Action Investigate the cause of the failure using the commands:
enable ssl debug
show ssl [counters]
Explanation SSL failed to establish resources for encryption or decryption from ENCO.
Recommended Action Investigate why encryption/decryption resources were not available using the
commands:
show enco
show enco counters
Explanation The PKI certificate required by the SSL Server was not found. The HTTP and
LOADBALANCER commands use the SSL KEY parameter as a reference to the
certificate. The SSL KEY is the ENCO KEY that was used to create the certificate. If
the SSL KEY has changed since the certificate was created then SSL will fail to find
the certificate.
Recommended Action Ensure that the certificate has been correctly set up, using the commands:
show pki cert
show enco key
Note that if system security is disabled, ENCO keys are lost when the device
restarts. If another ENCO key is created, it will no longer match the key specified
for the PKI certificate.
Explanation The SSL caches negotiated sessions so that they can be quickly re-established. A
session could not be added to the session resumption cache because the cache is
full. If the SSL client attempts to re-establish a session that is not in the cache
using the abbreviated handshake sequence then the SSL server will force the client
to use a full handshake sequence (the handshake will still work).
Recommended Action No action is required. To show the number of entries in the cache, use the
command:
show ssl
To show detailed information about the SSL sessions stored in the session
resumption caches, use the command:
show ssl sessions
To specify the maximum time that a session is retained in the cache and the
maximum number of sessions allowed in the cache, use the command:
set ssl [cachetimeout=cache-timeout]
[maxsessions=max-sessions]
This chapter contains messages belonging to the module DS3, sorted into the
following Types:
PINT: Physical Layer Interfaces on page 405
For more information about DS3, see the Interfaces chapter in the Software
Reference.
Module: DS3; Type: PINT 405
Type: PINT
Physical Layer Interfaces
Explanation The DS3 interface is no longer receiving the Alarm Indication Signal. This indicates
that the device at the remote end is operating normally again.
Explanation The DS3 interface is receiving the Alarm Indication Signal. This signal is injected by
the device at the remote end of the DS3 link to indicate a failure condition on the
device or to indicate that the device has been removed from service.
Recommended Action Contact the service personnel responsible for the device at the remote end of the
DS3 link.
Explanation The remote end has inserted the Idle signal into the DS3 signal.
Explanation The DS3 interface has been manually reset by the user.
Explanation The DS3 interface is now ready to provide service to higher layers (either PPP or
Frame Relay).
Explanation The Loss of Framing indication on the DS3n interface has been removed.
Explanation The DS3 interface has received a signal with corrupt framing bits. Possible reasons
for this include:
Excessive noise on the physical link between the interface and the remote
end.
A faulty interface card.
The interface has been placed in an internal looparound mode but the
clocking has been set to loop timing.
The clocking has been set to loop timing but the interface is not receiving and
accurate timing signal from the remote end.
Recommended Action 1) If the interface has been set to an internal looparound mode, ensure the clock
is set to internal using the command
show ds3=instance state
If the clock is not set to internal then set it to internal using the command
set ds3=instance clock=internal
2) Set the interface into internal clocking mode (see above) and switch on the
internal looparound using the command
set ds3=instance test=3
If the LOF disappears suspect the remote end or the transmission equipment
between the two interfaces.
Explanation The DS3 interface now recognises the incoming signal as a DS3 signal.
Explanation The DS3 interface can no longer recognise the incoming signal as a DS3 signal.
This usually means the incoming signal has been severed physically but could also
mean equipment failure.
Recommended Action Place the DS3 interface in Diagnostic Loopback mode, using the command:
enable ds3=instance test=3
If the LOS persists, the DS3 Network Service feature (NSM) may be faulty.
Replace the NSM. Contact your authorised Allied Telesis distributor or reseller.
If the LOS alarm is not present in internal loopback mode, either the device at
the remote end of the link has failed, or the physical link has failed.
Contact the service personnel responsible for the device at the remote end of
the DS3 link.
If this does not resolve the issue, contact the service provider for the physical
link.
Explanation The DS3 interface has received a Remote Alarm Indication signal. This occurs
because the remote end is receiving either Loss Off Signal (LOS), Loss Of Framing
(LOF), or Alarm Indication Signal (AIS).
Recommended Action 1) Contact the service personnel for the equipment at the remote end. If they are
receiving LOS or LOF they should take appropriate action. If they are receiving AIS,
ensure the AIS test is not switched on using the command:
show ds3=instance test
If the AIS test is switched on, switch it off using the command:
disable ds3=instance test=9
Explanation The DS3 interface is reporting a Threshold Crossing Alert, because one of the
performance parameters (Table 2) has crossed a 15 minute or 24 hour interval
threshold at the near or far end.
Performance Meaning
Parameter
PESs The trigger was caused by the P-bit Errored Seconds parameter counter
exceeding a specified threshold.
PSESs The trigger was caused by the P-bit Severely Errored Seconds parameter
counter exceeding a specified threshold.
SEFs The trigger was caused by the Severely Errored Framing Seconds parameter
counter exceeding a specified threshold.
UASs The trigger was caused by the UnAvailable Seconds parameter counter
exceeding a specified threshold.
LCVs The trigger was caused by the Line Coding Violations primitive counter
exceeding a specified threshold.
PCVs The trigger was caused by the P-bit Coding Violations primitive counter
exceeding a specified threshold.
LESs: PSESs The trigger was caused by the Line Error Seconds parameter and the PSESs
parameter counters exceeding specified thresholds.
CCVs The trigger was caused by the C-bit Coding Violations primitive counter
exceeding a specified threshold.
CESs The trigger was caused by the C-bit Errored Seconds parameter counter
exceeding a specified threshold.
CSESs The trigger was caused by the C-bit Severely Errored Seconds parameter
counter exceeding a specified threshold.
This chapter contains messages belonging to the module VOIP, sorted into the
following Types:
Voice Over IP on page 413
This section describes log messages and recommended actions related to Voice
over IP (VOIP). For more information about VoIP, see the Voice Over IP (VOIP)
chapter in the Software Reference.
Module: VOIP; Type: VOIP 413
Type: VOIP
Voice Over IP
Explanation There is a call established for the VoIP PIC. The call type is specified.
Explanation The call was disconnected.The following table lists possible reason codes:
Code Description
0 Normal call clear.
1 Unreachable destination.
2 Destination rejection.
3 No permission.
4 No acceptable.
5 Bad format address.
6 In configuration.
7 Undefined reason.
8 Route call to proxy.
9 Call forwarded.
10 Security denied.
11 Called party number not registered.
12 Calling party number not registered.
13 Called party number release.
14 Calling party number release.
15 User busy
Explanation An error has been encountered during the call. For information about the error
code, see VoIP PIC Error Codes on page 419.
Recommended Action Use the error code to investigate and fix the problem.
Recommended Action Check that the phone connected to the VoIP PIC rings and functions correctly.
Explanation There is an internal error generated by VoIP PIC. For information about the error
code, see VoIP PIC Error Codes on page 419.
Recommended Action Use the error message to investigate the cause of the error. Contact your
authorised Allied Telesis distributor or reseller if you require further assistance.
PIC: Off-Hook
Message PIC <engine-name>: Off-Hook
PIC: On-Hook
Message PIC <engine-name>: On-Hook
Recommended Action Wait for the ringing tone and the other end to accept the call.
PIC: Registered
Message PIC <engine-name>: Registered
PIC: Unregistered
Message PIC <engine-name>: Unregistered
Recommended Action Make sure the registration server, such as the H323 gatekeeper, is reachable by
the device. Make sure the telephone number you try to register is not already
registered by another VoIP end point. If the telephone number is registered, try to
use another telephone number.
Explanation The VoIP PIC did not respond to the devices request. Therefore, the PIC must be
reset properly.
Explanation Started downloading a file from the TFTP server to the VoIP PIC.
Recommended Action Wait until the firmware download from the TFTP server is completed.
Explanation There is an error downloading the file from TFTP server to VoIP PIC. For
information about the error code, see VoIP PIC Error Codes on page 419.
Recommended Action Fix the problem indicated by the error code and restart the firmware download
again.
Explanation Downloading a file from the TFTP server to the VoIP PIC is finished.
Recommended Action Wait until downloaded firmware is executed by the VoIP PIC.
Explanation This message indicates the PIC is now enabled but the IP address assigned to the
public interface is not yet resolved. The PIC is enabled with a dummy router IP,
however all the outgoing traffic will be blocked until the IP address has been
resolved.
Recommended Action Check that the process used to assign the IP address to the interface (e.g. DHCP) is
operating correctly and in a timely manner.
Code Description
0 No error.
1 Operation not permitted.
2 No such entity.
3 No such process.
4 Operation interrupted.
5 I/O error.
9 Bad file handler.
11 Try again later.
12 Out of memory.
16 Resource busy.
18 Cross-device link.
19 No such device.
22 Invalid argument.
23 Too many open files in system.
24 Too many open files.
27 File too large.
28 No space left on device.
29 Illegal seek.
30 Read-only file system.
33 Argument to math function outside valid.
34 Math result cannot be represented.
35 Resource deadlock would occur.
38 Function not implemented.
60 File name too long.
95 Not supported error.
Code Description
320 Socket operation on non-socket.
321 Destination address required.
322 Message too long.
323 Protocol wrong type for socket.
324 Protocol not available.
325 Protocol not supported.
326 Socket type not supported.
327 Operation not supported.
328 Protocol family not supported.
329 Address family not supported by protocol family.
330 Address already in use.
350 Network is down.
351 Network is unreachable.
352 Network dropped connection on reset.
353 Software caused connection abort.
354 Connection reset by peer.
355 No buffer space available.
356 Socket is already connected.
357 Socket is not connected.
358 Cant send after socket shutdown.
359 Too many references: cant splice.
360 Operation timed out.
361 Connection refused.
364 Host is down.
365 No route to host.
This chapter contains messages belonging to the module UPNP, sorted into the
following Types:
UPNP: Universal Plug and Play on page 422
For more information about UPnP, see the UPnP chapter in the Software
Reference.
Module: UPNP; Type: UPNP 422
Type: UPNP
Universal Plug and Play
This chapter contains messages belonging to the module PORT, sorted into the
following Types:
PORTAUTH: Port Authentication on page 424
For more information about Port Authentication, see the Port Authentication
chapter in the Software Reference.
Module: PORT; Type: PORTAUTH 424
Type: PORTAUTH
Port Authentication
Auth Failure
Message Auth Failure: Port=<port-number> User=<user-name>
MAC=<supplicant-mac-address>
Recommended Action Check that the supplicant user-name, password, encryption, and method
parameters are set correctly. Check that the connected authenticator is configured
to allow supplicant connections to authenticate.
Recommended Action Check that the supplicant is authorised to connect to the device. If the problem is
persistent and the supplicant is known to be set up correctly, check that the
authenticator user-name, password, encryption, and method parameters are set
correctly. Also check that the RADIUS server is correctly configured.
Auth Success
Message Auth Success: Port=<port-number> User=<user-name>
MAC=<supplicant-mac-address>
Explanation An attempt to initialise internal port authentication data structures for a particular
port has failed.
Explanation An attempt to create internal data structures for a multi-supplicant port on the
device has failed.
Explanation Corruption of internal port authentication data structures for a port on the device
has occurred.
Explanation The Supplicant PAE State Machine for a port defined as a supplicant is in an
unknown state.
Explanation Corruption has occurred while generating port authentication debug output.
Explanation An attempt to reserve internal memory for use by port authentication has failed.
No Authenticator Present
Message No Authenticator Present : Port=<port-number>
Explanation A port defined as a supplicant on the device has been unable to communicate
with an authenticator and will now assume that its network link is not under 802.
1x control.
Explanation A port authentication message has been transmitted from a port on the device
defined as a single-supplicant authenticator and has not received a timely
response from the authentication server.
Recommended Action Check the connections between the device and the authentication server. Check
that the authentication server is configured correctly both on the server itself and
on the authenticator device. Check that a correct route exists between the
authenticator and the authentication server.
Explanation A port authentication message has been transmitted from a port on the device
defined as a multi-supplicant authenticator and has not received a timely response
from the authentication server.
Recommended Action Check the connections between the device and the authentication server. Check
that the authentication server is configured correctly both on the server itself and
on the authenticator device. Check that a correct route exists between the
authenticator and the authentication server.
Explanation A port authentication message has been transmitted from a port on the device
defined as a supplicant and has not received a timely response from the
authenticator.
Recommended Action Check the connections between the authenticator and the supplicant. Check that
the authenticator is configured correctly.
Explanation A port authentication message has been transmitted from a port on the device
defined as a single-supplicant authenticator and has not received a timely
response from the supplicant.
Recommended Action Check the connections between the authenticator and the supplicant. Check that
the supplicant is configured correctly.
Explanation A port authentication message has been transmitted from a port on the device
defined as a multi-supplicant authenticator and has not received a timely response
from a supplicant.
Recommended Action Check the connections between the authenticator and the specific supplicant.
Check that the supplicant is configured correctly.
Supplicant Logoff
Message Supplicant Logoff : Port=<port-number> User=<user-name>
MAC=<supplicant-mac-address>
Explanation A supplicant port on the device has logged off the authenticator.
This chapter contains messages belonging to the module ADSL, sorted into the
following Types:
ADSL: Asymmetric Digital Subscriber Line on page 434
For more information about ADSL, see the ATM over xDSL chapter in the Software
Reference.
Module: ADSL; Type: ADSL 434
Type: ADSL
Asymmetric Digital Subscriber Line
Explanation The ADSL driver could not alter the current state of the ADSL chip set.
Recommended Action Try rebooting the device. If this continues to occur, contact your authorised Allied
Telesis distributor or reseller.
Explanation The ADSL driver could not initialise the ADSL chip set.
Recommended Action Try a cold reboot of the device, then test the interface using the enable test
command. See the Test Facility chapter of the Software Reference for more
information about testing interfaces. If the reboot and the test fail, contact your
authorised Allied Telesis distributor or reseller.
Explanation The ADSL driver could not upload the firmware to the ADSL chip set.
Recommended Action Try a cold reboot of the device, then test the interface using the enable test
command. See the Test Facility chapter of the Software Reference for more
information about testing interfaces. If the reboot and the test fail, contact your
authorised Allied Telesis distributor or reseller.
Explanation ADSL could not use the TCP port 8701 for WHIP, as another application is
currently using it.
Explanation The ADSL driver cannot remedy a fault within the ADSL chip set, despite
attempting multiple times to reset the ADSL hardware.
Recommended Action Try a cold restart of the device. If this issue continues to occur, contact your
authorised Allied Telesis distributor or reseller.
Explanation The ADSL driver is currently remedying a fault with the ADSL chip set. To do this,
the driver resets the ADSL hardware.
Recommended Action Check whether the ADSL driver has created a fault recovery abandoned log. If
it has, follow the recommended action for that log. If it has not, then the ADSL
driver successfully remedied the fault, and no action is required.
Explanation The self tests that the ADSL driver hardware runs have failed. These tests occur
when the ADSL driver uploads the firmware to the ADSL chip set.
Recommended Action Try resetting the ADSL instance. If this does not work, try rebooting the device. If
this issue continues to occur, contact your authorised Allied Telesis distributor or
reseller.
Line connected
Message adsl0: Line connected
Explanation The specified ADSL interface has successfully connected to your service provider.
Line disabled
Message adsl0: Line disabled
Explanation The specified ADSL interface is disabled. ADSL interfaces are disabled using the
disable adsl command.
Line disconnected
Message adsl0: Line disconnected
Explanation The specified ADSL interface has disconnected from your service provider.
Recommended Action No action is required if this is expected. If this is unexpected, investigate the
interfaces status by:
using the show adsl command
checking the physical connection between the device and the ATM service
provider
checking the log messages recently generated for ATM and the physical
interface
Line enabled
Message adsl0: Line enabled
Explanation The specified ADSL interface is enabled. ADSL interfaces are enabled automatically
on the device. Previously disabled ADSL interfaces are enabled using the enable
adsl command.
Explanation ADSL discovered the specified line faults. These faults can cause the line to
disconnect, or may be caused by the line disconnecting. Use the following table to
identify who detected the fault, and what type of fault occurred:
String Meaning
ATU-R ADSL Terminating Unit - Remote. This indicates that this device detected
the fault.
LOS Near-end Loss of Signal.
SEF Near-end Severely Errored Frames.
NCD-I Near-end No Cell Delineations for the interleaved data
stream.
NCD-F Near-end No Cell Delineations for the fast data stream.
LCD-I Near-end Loss of Cell Delineations for the interleaved
data stream.
LCD-F Near-end Loss of Cell Delineations for the fast data
stream.
ATU-C ADSL Terminating Unit - Central. This indicates that the service provider
detected the fault.
LPR Far-end Dying Gasp frames.
LOS Far-end Loss of Signal.
RDI Far-end Severely Errored Frames
FNCD-I Far-end No Cell Delineations for the interleaved data
stream.
FNCD-F Far-end No Cell Delineation for the fast data stream.
FLCD-I Far-end Loss of Cell Delineations for the interleaved
data stream.
FLCD-F Far-end Loss of Cell Delineations for the fast data
stream.
Recommended Action No action is necessary, if this is expected. Otherwise, use the show adsl counter
command to see detailed counters for faults on the ADSL line. Check the cabling
between the device and your service provider. If these faults continue to cause the
line to disconnect, contact your service provider and your authorised Allied Telesis
distributor or reseller.
Line reset
Message adsl0: Line reset
Explanation The specified ADSL interface was reset. ADSL interfaces are reset using the
reset adsl command.
Explanation A remote device has established a WHIP connection with this device.
Recommended Action No action is necessary if this is expected. Otherwise, contact your authorised
Allied Telesis distributor or reseller.
Explanation A remote device has ended a WHIP connection with this device.
Recommended Action No action is necessary if this is expected. Otherwise, contact your authorised
Allied Telesis distributor or reseller.
This chapter contains messages belonging to the module LLDP, sorted into the
following Types:
LLDP: Link Layer Discovery Protocol on page 442
For more information about LLDP, see the Link Layer Discovery Protocol chapter in
the Software Reference.
Module: LLDP; Type: LLDP 442
Type: LLDP
Link Layer Discovery Protocol
Explanation A new CDP neighbour has been added to the neighbour table.
Explanation A CDP neighbour has been removed from the neighbour table, either because
information about it has timed out, or because a corresponding interface has
gone down.
Recommended Action If this action was unexpected, check the device and/or its links to ensure that they
are up.
This chapter contains messages belonging to the module MACF, sorted into the
following Types:
MACFF: MAC-Forced Forwarding on page 444
For more information about MACFF, see the Mac-Forced Forwarding chapter in
the Software Reference.
Module: MACF; Type: MACFF 444
Type: MACFF
MAC-Forced Forwarding
Explanation An ARP request from a client failed because there are no access routers associated
with the client in the MAC-Forced Forwarding server database. This message is
also generated when all routers associated with a client are removed from the
MAC-Forced Forwarding server database.
Recommended Action Investigate the cause if this event is unexpected. Begin by determining whether
the client is a static or dynamic entry in the server database, and checking
whether it is configured correctly, by using the show dhcpsnooping database
command.
If the client is a static entry, then its access routers should be static entries in
the server database. Check that these access routers are configured correctly,
and check that they are accessible on the network, by using the ping
command.
If the client is a dynamic entry, check the status of the access routers attached
to the network, by using the ping command. If there are no network
connection problems, then the DHCPACK packet sent by the access routers
may have incorrect information.
Investigate the problem further by checking the DHCP snooping logs, and
checking the ARP entries on the device using the show ip arp command.
Explanation An ARP request from a client failed because the device could not resolve the MAC
address of any access routers associated with the client.
Recommended Action Investigate by checking the status of the network with the ping command. If
there are no network connection problems, check the ARP entries on the device
using the show ip arp command. If this is occurring for a statically configured
client, then check that the client, and access routers associated with the client, are
correctly configured.
Explanation The MAC address of a dynamic server entry has changed as the result of an ARP
response.
Recommended Action Manual intervention may be required on the downstream clients to force them to
refresh their ARP cache and use the new MAC address.
Explanation One of the MAC-Forced Forwarding log types is generating an excessive amount
of logs, and has reached the log threshold value. This triggers the device to
temporarily reduce the number of these logs that it is generating. The device
continues to reduce the number of logs generated for that log type as long as the
threshold value is exceeded. The log threshold exceeded log is also generated
each time the device checks the threshold value and finds that it is exceeded.
Normal log generation recommences once the suspended log type is no longer
above the threshold value.
Recommended Action Investigate why the device is generating the log type by checking the
recommended action listed for the log message:
Client ARP failed - no routers
Client ARP failed - router ARP failed
New upstream server acquired
Upstream server - cannot contact
Upstream server lost
Explanation The device has a new entry, either an access router or an application server, in the
MAC-Forced Forwarding server database. MAC-Forced Forwarding acquires static
entries when you use the add macff server command, and dynamic entries
when DHCP Snooping checks the DHCPACK message sent to a client.
Explanation A static server has been added, but the MAC address clashes with an existing
dynamic entry. The new static entry will override the existing dynamic entry.
Downstream clients will still have the old dynamic MAC address in their ARP cache
and will not be able to communicate with upstream servers until their ARP cache
is refreshed. This may require manual intervention.
Recommended Action Manual intervention may be required on the downstream clients to force them to
refresh their ARP cache and use the new MAC address.
Explanation A background task that checks the entries listed in the MAC-Forced Forwarding
server database cannot establish contact with the specified entry.
Recommended Action Investigate by checking the status of the network with the ping command. If
there are no network connection problems, check the ARP entries on the device
using the show ip arp command. If this is occurring for a statically configured
entry, then check that the entry is correctly configured.
Explanation MAC-Forced Forwarding has removed an entry from its server database. It
removes dynamic entries when the access router no longer has any clients listed in
the DHCP snooping database, and removes static entries when you use the
delete macff server command to remove an entry.