SSL source IP

When using SSL modules in the CSS, does the client source IP address show up on the web server? Or does the CSS do a source NAT so the packet comes back to the SSL module?

The SSL module does not have an IP address assigned to it, so it cannot use its own. The server should see the client IP address, unless you configure source nat specifically by using groups.
-Steve

Similar Messages

  • When webpages contain mixed content, does (or can) Firefox block content from unsecure sources?

    When secure webpages (those using SSL) contain content from non-SSL sources, Internet Explorer 8 and 9 ask if you want to view only the content that was delivered securely. I haven't been able to find a similar prompt in Firefox. I know of three possible explanations:
    1. Firefox does not offer protection against mixed content. I hope this isn't the case!
    2. Firefox has a setting I haven't found.
    3. Firefox may offer the protection but in a different manner than Internet Explorer.

    Firefox doesn't and can't block content coming via an insecure connection in that case, but you can get a warning.
    The settings for the warning messages have been removed from the user interface (Bug 513166).<br />
    You need to change the related security.warn_* prefs directly on the <b>about:config</b> page.<br />
    Filter: security.warn_viewing_mixed

  • CSS SSL Proxy - how can I write the original source address in http header

    I'm replacing some BigIP's with CSS11500's that are configured to do front/backend ssl proxying in a one-armed configuration. The BigIP's write the original source IP address as a http header value when the traffic is sent to the application, and the application uses the IP to match against an application ACL. How can I do the same in the CSS.
    thanks,
    Brian

    here is what you can insert with the SSL module :
    http://www.cisco.com/en/US/products/hw/contnetw/ps792/products_configuration_guide_chapter09186a0080292a76.html#wp1027619
    Gilles.

  • RH9 - Can I restore layouts in "Single Source Layouts" pod from .ssl files?

    RH 9 (latest)
    Windows 7 x64
    Due to some corruption somewhere in our main help project that prevented me from generating layouts using the RoboHelp command line (rhcl.exe), I deleted my .xpj file and .cpd file, and then recreated the .xpj project file from the .hhp file. This is the recommended fix to get things back to normal that I did two years ago when I got this same error. (For info, see Command line generation errors in log. How do I fix this?)
    However, as expected, all my single source layouts are now missing from the Single Source Layouts pod. Is there a way to recreate the single source layouts from the .ssl files so they appear back in the pod with their previous settings? Like a way to re-import then into the project? I have 36 individual ssls just for printable output alone that I spent creating all day last Friday (1 per chapter), I really do NOT want to manually recreate them.
    A related question is, where does RH store the link between xpj and ssl layouts? Because when I checked the xpj inside Notepad++ prior to deleting it, there weren't any references to the individual single source layout files there; I don't understand how deleting an xpj file removes references to the ssls when the .ssl files obviously still exist in the project folder.

    I'm not at a Rh machine to check where the link is stored but this should work.
    Move the old layouts from the project.
    Recreate layouts with the same character perfect names. Leave default settings.
    With Rh closed,  open them in a text editor. Do the same with the old files
    and copy the content across.
    Backups everywhere of course.

  • SSL Web Applications in Content Sources

    Hi there,
    I'm a bit stumped.  I have created two web applications - an Intranet and My Sites Host.  When I created them I selected the option on both for an SSL site.
    I have now set up the Search Service Application and added my site addresses to the "Local SharePoint Sites" content source.  When I start a full crawl, I get the following error:-
    This item could not be crawled because the repository did not respond within the specified timeout period. Try to crawl the repository at a later time, or increase the timeout value on the Proxy and Timeout page in search administration. You might
    also want to crawl this repository during off-peak usage times.
    Found some answers to that problem on the internet but none of them worked for me.
    So, I then created a new content source to crawl the "SharePoint - 80" web app which is an http app and the crawl was successful.
    Is there a little trick I am missing because my web apps are SSL?

    Open SharePoint Central Administration
    Select Manage service applications, from the Application Management section
    Select the Search Service Application. e.g. Search Service 1
    Select Farm Search Administration
    Toggle the Ignore SSL warnings to Yes
    http://www.infotext.com/help/sharepoint-could-not-estabilish-trust-relationship-for-the-ssltls-secure-channel-when-crawling-ssl-enabled-websites/

  • Error while trying SSL on OHS

    I'm getting "Init: SSL call to NZ function nzos_OpenWallet failed with error 29248" error in log file HTTP_Server~1 while starting OHS (using opmnctl startall).
    I created a Wallet with auto login option checked. I was able to create certificate Request and got a certificate from verisign (14 days Validity). I imported Root certificate and intermediate certificate from verisign into the wallet and then successfully imported the trial certificate. After saving the wallet in default location I got 2 files (cwallet.sso and ewallet.p12) there.
    Configuration in opmn.xml is :
    <ias-component id="HTTP_Server">
    <process-type id="HTTP_Server" module-id="OHS">
    <environment>
    <variable id="PERL5LIB" value="D:\product\10.1.3\OracleAS_1\Apache\Apache\mod_perl\site\5.8.3\lib\MSWin32-x86-multi-thread;$ORACLE_HOME\perl\5.8.3\lib;$ORACLE_HOME\perl\site\5.8.3\lib"/>
    <variable id="PHPRC" value="D:\product\10.1.3\OracleAS_1\Apache\Apache\conf"/>
    <variable id="PATH"
    value="$ORACLE_HOME\Perl\5.8.3\bin\MSWin32-x86-multi-thread" append="true"/>
    </environment>
    <module-data>
    <category id="start-parameters">
    <data id="start-mode" value="ssl-enabled"/>
    </category>
    </module-data>
    <process-set id="HTTP_Server" numprocs="1"/>
    </process-type>
    </ias-component>
    my httpd.conf file is as follows:
    ## httpd.conf -- Apache HTTP server configuration file
    # Based upon the NCSA server configuration files originally by Rob McCool.
    # This is the main Apache server configuration file. It contains the
    # configuration directives that give the server its instructions.
    # See <URL:http://www.apache.org/docs/> for detailed information about
    # the directives.
    # Do NOT simply read the instructions in here without understanding
    # what they do. They're here only as hints or reminders. If you are unsure
    # consult the online docs. You have been warned.
    # After this file is processed, the server will look for and process
    # D:\product\10.1.3\OracleAS_1\Apache\Apache/conf/srm.conf and then D:\product\10.1.3\OracleAS_1\Apache\Apache/conf/access.conf
    # unless you have overridden these with ResourceConfig and/or
    # AccessConfig directives here.
    # The configuration directives are grouped into three basic sections:
    # 1. Directives that control the operation of the Apache server process as a
    # whole (the 'global environment').
    # 2. Directives that define the parameters of the 'main' or 'default' server,
    # which responds to requests that aren't handled by a virtual host.
    # These directives also provide default values for the settings
    # of all virtual hosts.
    # 3. Settings for virtual hosts, which allow Web requests to be sent to
    # different IP addresses or hostnames and have them handled by the
    # same Apache server process.
    # Configuration and logfile names: If the filenames you specify for many
    # of the server's control files begin with "/" (or "drive:/" for Win32), the
    # server will use that explicit path. If the filenames do not begin
    # with "/", the value of ServerRoot is prepended -- so "logs/foo.log"
    # with ServerRoot set to "D:\product\10.1.3\OracleAS_1\Apache\Apache" will be interpreted by the
    # server as "D:\product\10.1.3\OracleAS_1\Apache\Apache/logs/foo.log".
    # NOTE: Where filenames are specified, you must use forward slashes
    # instead of backslashes (e.g., "c:/apache" instead of "c:\apache").
    # If a drive letter is omitted, the drive on which Apache.exe is located
    # will be used by default. It is recommended that you always supply
    # an explicit drive letter in absolute paths, however, to avoid
    # confusion.
    ### Section 1: Global Environment
    # The directives in this section affect the overall operation of Apache,
    # such as the number of concurrent requests it can handle or where it
    # can find its configuration files.
    # ServerType is either inetd, or standalone. Inetd mode is only supported on
    # Unix platforms.
    ServerType standalone
    # ServerRoot: The top of the directory tree under which the server's
    # configuration, error, and log files are kept.
    # Do NOT add a slash at the end of the directory path.
    ServerRoot "D:\product\10.1.3\OracleAS_1\Apache\Apache"
    # PidFile: The file in which the server should record its process
    # identification number when it starts.
    PidFile logs/httpd.pid
    # ScoreBoardFile: File used to store internal server process information.
    # Not all architectures require this. But if yours does (you'll know because
    # this file will be created when you run Apache) then you must ensure that
    # no two invocations of Apache share the same scoreboard file.
    ScoreBoardFile logs/httpd.scoreboard
    # In the standard configuration, the server will process httpd.conf (this
    # file, specified by the -f command line option), srm.conf, and access.conf
    # in that order. The latter two files are now distributed empty, as it is
    # recommended that all directives be kept in a single file for simplicity.
    # The commented-out values below are the built-in defaults. You can have the
    # server ignore these files altogether by using "/dev/null" (for Unix) or
    # "nul" (for Win32) for the arguments to the directives.
    #ResourceConfig conf/srm.conf
    #AccessConfig conf/access.conf
    # Timeout: The number of seconds before receives and sends time out.
    Timeout 300
    # SendBufferSize: controls setsockopt() call made to set send buffer size on
    # all sockets. Default OS value on most Windows platforms is too small.
    # Larger values can help if the average page size served by OHS is
    # large (~64 k)
    SendBufferSize 16384
    # KeepAlive: Whether or not to allow persistent connections (more than
    # one request per connection). Set to "Off" to deactivate.
    KeepAlive On
    # MaxKeepAliveRequests: The maximum number of requests to allow
    # during a persistent connection. Set to 0 to allow an unlimited amount.
    # We recommend you leave this number high, for maximum performance.
    MaxKeepAliveRequests 100
    # KeepAliveTimeout: Number of seconds to wait for the next request from the
    # same client on the same connection.
    KeepAliveTimeout 15
    # Apache on Win32 always creates one child process to handle requests. If it
    # dies, another child process is created automatically. Within the child
    # process multiple threads handle incoming requests. The next two
    # directives control the behaviour of the threads and processes.
    # MaxRequestsPerChild: the number of requests each child process is
    # allowed to process before the child dies. The child will exit so
    # as to avoid problems after prolonged use when Apache (and maybe the
    # libraries it uses) leak memory or other resources. On most systems, this
    # isn't really needed, but a few (such as Solaris) do have notable leaks
    # in the libraries. For Win32, set this value to zero (unlimited)
    # unless advised otherwise.
    # NOTE: This value does not include keepalive requests after the initial
    # request per connection. For example, if a child process handles
    # an initial request and 10 subsequent "keptalive" requests, it
    # would only count as 1 request towards this limit.
    MaxRequestsPerChild 0
    # Number of concurrent threads (i.e., requests) the server will allow.
    # Set this value according to the responsiveness of the server (more
    # requests active at once means they're all handled more slowly) and
    # the amount of system resources you'll allow the server to consume.
    ThreadsPerChild 50
    # Server-pool size regulation. Rather than making you guess how many
    # server processes you need, Apache dynamically adapts to the load it
    # sees --- that is, it tries to maintain enough server processes to
    # handle the current load, plus a few spare servers to handle transient
    # load spikes (e.g., multiple simultaneous requests from a single
    # Netscape browser).
    # It does this by periodically checking how many servers are waiting
    # for a request. If there are fewer than MinSpareServers, it creates
    # a new spare. If there are more than MaxSpareServers, some of the
    # spares die off. The default values are probably OK for most sites.
    #MinSpareServers 5
    #MaxSpareServers 20
    # Limit on total number of servers running, i.e., limit on the number
    # of clients who can simultaneously connect --- if this limit is ever
    # reached, clients will be LOCKED OUT, so it should NOT BE SET TOO LOW.
    # It is intended mainly as a brake to keep a runaway server from taking
    # the system with it as it spirals down...
    #MaxClients 150
    # Listen: Allows you to bind Apache to specific IP addresses and/or
    # ports, in addition to the default. See also the <VirtualHost>
    # directive.
    #Listen 3000
    #Listen 12.34.56.78:80
    # BindAddress: You can support virtual hosts with this option. This directive
    # is used to tell the server which IP address to listen to. It can either
    # contain "*", an IP address, or a fully qualified Internet domain name.
    # See also the <VirtualHost> and Listen directives.
    #BindAddress *
    # Dynamic Shared Object (DSO) Support
    # To be able to use the functionality of a module which was built as a DSO you
    # have to place corresponding `LoadModule' lines at this location so the
    # directives contained in it are actually available before they are used.
    # Please read the file README.DSO in the Apache 1.3 distribution for more
    # details about the DSO mechanism and run `apache -l' for the list of already
    # built-in (statically linked and thus always available) modules in your Apache
    # binary.
    # Note: The order in which modules are loaded is important. Don't change
    # the order below without expert advice.
    # Example:
    # LoadModule foo_module libexec/mod_foo.dll
    LoadModule mime_magic_module modules/ApacheModuleMimeMagic.dll
    LoadModule mime_module modules/ApacheModuleMime.dll
    LoadModule dbm_auth_module modules/ApacheModuleAuthDBM.dll
    LoadModule digest_auth_module modules/ApacheModuleAuthDigest.dll
    LoadModule anon_auth_module modules/ApacheModuleAuthAnon.dll
    LoadModule cern_meta_module modules/ApacheModuleCERNMeta.dll
    LoadModule digest_module modules/ApacheModuleDigest.dll
    LoadModule expires_module modules/ApacheModuleExpires.dll
    LoadModule headers_module modules/ApacheModuleHeaders.dll
    LoadModule proxy_module modules/ApacheModuleProxy.dll
    LoadModule speling_module modules/ApacheModuleSpeling.dll
    LoadModule status_module modules/ApacheModuleStatus.dll
    LoadModule info_module modules/ApacheModuleInfo.dll
    LoadModule usertrack_module modules/ApacheModuleUserTrack.dll
    LoadModule vhost_alias_module modules/ApacheModuleVhostAlias.dll
    LoadModule agent_log_module modules/ApacheModuleLogAgent.dll
    LoadModule referer_log_module modules/ApacheModuleLogReferer.dll
    LoadModule perl_module modules/ApacheModulePerl.DLL
    LoadModule fastcgi_module modules/ApacheModuleFastCGI.dll
    LoadModule php4_module modules/ApacheModulePHP4.dll
    LoadModule onsint_module modules/ApacheModuleOnsint.dll
    LoadModule wchandshake_module modules/ApacheModuleWchandshake.dll
    ClearModuleList
    AddModule mod_so.c
    AddModule mod_onsint.c
    AddModule mod_mime_magic.c
    AddModule mod_mime.c
    AddModule mod_access.c
    AddModule mod_auth.c
    AddModule mod_negotiation.c
    AddModule mod_include.c
    AddModule mod_autoindex.c
    AddModule mod_dir.c
    AddModule mod_cgi.c
    #AddModule mod_userdir.c
    AddModule mod_alias.c
    AddModule mod_env.c
    AddModule mod_log_config.c
    AddModule mod_asis.c
    AddModule mod_imap.c
    AddModule mod_actions.c
    AddModule mod_setenvif.c
    AddModule mod_isapi.c
    AddModule mod_vhost_alias.c
    AddModule mod_log_referer.c
    AddModule mod_log_agent.c
    AddModule mod_auth_anon.c
    AddModule mod_auth_dbm.c
    AddModule mod_auth_digest.c
    AddModule mod_cern_meta.c
    AddModule mod_digest.c
    AddModule mod_expires.c
    AddModule mod_headers.c
    AddModule mod_proxy.c
    AddModule mod_speling.c
    AddModule mod_info.c
    AddModule mod_status.c
    AddModule mod_usertrack.c
    AddModule mod_perl.c
    AddModule mod_fastcgi.c
    AddModule mod_php4.c
    AddModule mod_wchandshake.c
    <IfDefine SSL>
    LoadModule ossl_module modules/ApacheModuleOSSL.DLL
    </IfDefine>
    # ExtendedStatus controls whether Apache will generate "full" status
    # information (ExtendedStatus On) or just basic information (ExtendedStatus
    # Off) when the "server-status" handler is called. The default is Off.
    ExtendedStatus On
    ### Section 2: 'Main' server configuration
    # The directives in this section set up the values used by the 'main'
    # server, which responds to any requests that aren't handled by a
    # <VirtualHost> definition. These values also provide defaults for
    # any <VirtualHost> containers you may define later in the file.
    # All of these directives may appear inside <VirtualHost> containers,
    # in which case these default settings will be overridden for the
    # virtual host being defined.
    # Port: The port to which the standalone server listens. Certain firewall
    # products must be configured before Apache can listen to a specific port.
    # Other running httpd servers will also interfere with this port. Disable
    # all firewall, security, and other services if you encounter problems.
    # To help diagnose problems use the Windows NT command NETSTAT -a
    Port 7777
    Listen 7777
    # ServerAdmin: Your address, where problems with the server should be
    # e-mailed. This address appears on some server-generated pages, such
    # as error documents.
    ServerAdmin [email protected]
    # ServerName allows you to set a host name which is sent back to clients for
    # your server if it's different than the one the program would get (i.e., use
    # "www" instead of the host's real name).
    # Note: You cannot just invent host names and hope they work. The name you
    # define here must be a valid DNS name for your host. If you don't understand
    # this, ask your network administrator.
    # If your host doesn't have a registered DNS name, enter its IP address here.
    # You will have to access it by its address (e.g., http://123.45.67.89/)
    # anyway, and this will make redirections work in a sensible way.
    # 127.0.0.1 is the TCP/IP local loop-back address, often named localhost. Your
    # machine always knows itself by this address. If you use Apache strictly for
    # local testing and development, you may use 127.0.0.1 as the server name.
    ServerName IFLMUD5DLHY4G.i-flex.com
    # DocumentRoot: The directory out of which you will serve your
    # documents. By default, all requests are taken from this directory, but
    # symbolic links and aliases may be used to point to other locations.
    DocumentRoot "D:\product\10.1.3\OracleAS_1\Apache\Apache\htdocs"
    # Each directory to which Apache has access, can be configured with respect
    # to which services and features are allowed and/or disabled in that
    # directory (and its subdirectories).
    # First, we configure the "default" to be a very restrictive set of
    # permissions.
    <Directory />
    Options FollowSymLinks MultiViews
    AllowOverride None
    </Directory>
    # Note that from this point forward you must specifically allow
    # particular features to be enabled - so if something's not working as
    # you might expect, make sure that you have specifically enabled it
    # below.
    # This should be changed to whatever you set DocumentRoot to.
    <Directory "D:\product\10.1.3\OracleAS_1\Apache\Apache\htdocs">
    # This may also be "None", "All", or any combination of "Indexes",
    # "Includes", "FollowSymLinks", "ExecCGI", or "MultiViews".
    # Note that "MultiViews" must be named explicitly --- "Options All"
    # doesn't give it to you.
    Options FollowSymLinks MultiViews
    # This controls which options the .htaccess files in directories can
    # override. Can also be "All", or any combination of "Options", "FileInfo",
    # "AuthConfig", and "Limit"
    AllowOverride None
    # Controls who can get stuff from this server.
    Order allow,deny
    Allow from all
    </Directory>
    # UserDir: The name of the directory which is appended onto a user's home
    # directory if a ~user request is received.
    # Under Win32, we do not currently try to determine the home directory of
    # a Windows login, so a format such as that below needs to be used. See
    # the UserDir documentation for details.
    <IfModule mod_userdir.c>
    UserDir "D:\product\10.1.3\OracleAS_1\Apache\Apache\users\"
    </IfModule>
    # Control access to UserDir directories. The following is an example
    # for a site where these directories are restricted to read-only.
    #<Directory /home/*/public_html>
    # AllowOverride FileInfo AuthConfig Limit
    # Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec
    # <Limit GET POST OPTIONS PROPFIND>
    # Order allow,deny
    # Allow from all
    # </Limit>
    # <LimitExcept GET POST OPTIONS PROPFIND>
    # Order deny,allow
    # Deny from all
    # </LimitExcept>
    #</Directory>
    # DirectoryIndex: Name of the file or files to use as a pre-written HTML
    # directory index. Separate multiple entries with spaces.
    <IfModule mod_dir.c>
    DirectoryIndex index.html
    </IfModule>
    # AccessFileName: The name of the file to look for in each directory
    # for access control information.
    AccessFileName .htaccess
    # The following lines prevent .htaccess files from being viewed by
    # Web clients. Since .htaccess files often contain authorization
    # information, access is disallowed for security reasons. Comment
    # these lines out if you want Web visitors to see the contents of
    # .htaccess files. If you change the AccessFileName directive above,
    # be sure to make the corresponding changes here.
    # Also, folks tend to use names such as .htpasswd for password
    # files, so this will protect those as well.
    <Files ~ "^\.ht">
    Order allow,deny
    Deny from all
    </Files>
    # CacheNegotiatedDocs: By default, Apache sends "Pragma: no-cache" with each
    # document that was negotiated on the basis of content. This asks proxy
    # servers not to cache the document. Uncommenting the following line disables
    # this behavior, and proxies will be allowed to cache the documents.
    #CacheNegotiatedDocs
    # UseCanonicalName: (new for 1.3) With this setting turned on, whenever
    # Apache needs to construct a self-referencing URL (a URL that refers back
    # to the server the response is coming from) it will use ServerName and
    # Port to form a "canonical" name. With this setting off, Apache will
    # use the hostname:port that the client supplied, when possible. This
    # also affects SERVER_NAME and SERVER_PORT in CGI scripts.
    UseCanonicalName On
    # TypesConfig describes where the mime.types file (or equivalent) is
    # to be found.
    <IfModule mod_mime.c>
    TypesConfig conf/mime.types
    </IfModule>
    # DefaultType is the default MIME type the server will use for a document
    # if it cannot otherwise determine one, such as from filename extensions.
    # If your server contains mostly text or HTML documents, "text/plain" is
    # a good value. If most of your content is binary, such as applications
    # or images, you may want to use "application/octet-stream" instead to
    # keep browsers from trying to display binary files as though they are
    # text.
    DefaultType text/plain
    # The mod_mime_magic module allows the server to use various hints from the
    # contents of the file itself to determine its type. The MIMEMagicFile
    # directive tells the module where the hint definitions are located.
    # mod_mime_magic is not part of the default server (you have to add
    # it yourself with a LoadModule [see the DSO paragraph in the 'Global
    # Environment' section], or recompile the server and include mod_mime_magic
    # as part of the configuration), so it's enclosed in an <IfModule> container.
    # This means that the MIMEMagicFile directive will only be processed if the
    # module is part of the server.
    <IfModule mod_mime_magic.c>
    MIMEMagicFile conf/magic
    </IfModule>
    # HostnameLookups: Log the names of clients or just their IP addresses
    # e.g., www.apache.org (on) or 204.62.129.132 (off).
    # The default is off because it'd be overall better for the net if people
    # had to knowingly turn this feature on, since enabling it means that
    # each client request will result in AT LEAST one lookup request to the
    # nameserver.
    HostnameLookups Off
    # ErrorLog: The location of the error log file.
    # If you do not specify an ErrorLog directive within a <VirtualHost>
    # container, error messages relating to that virtual host will be
    # logged here. If you do define an error logfile for a <VirtualHost>
    # container, that host's errors will be logged there and not here.
    ErrorLog "|D:\product\10.1.3\OracleAS_1\Apache\Apache\bin\rotatelogs logs/error_log 43200"
    # LogLevel: Control the number of messages logged to the error.log.
    # Possible values include: debug, info, notice, warn, error, crit,
    # alert, emerg.
    LogLevel warn
    # The following directives define some format nicknames for use with
    # a CustomLog directive (see below).
    # Alternate "common" format to use when fronted by webcache:
    # LogFormat "%{ClientIP}i %l %u %t \"%r\" %>s %b %h" common_webcache
    # When webcache is forwarding requests to OHS, %h becomes the IP of
    # the originating webcache server and the real client IP is stored
    # in the ClientIP header. The common_webcache format can be used
    # in place of the common format when using webcache but with one
    # important caveat: if clients are capable of bypassing webcache
    # then it is possible to spoof the client IP by manually setting
    # the ClientIP header so the %h field should be monitored in such
    # an environment. Another alternative to specifying the ClientIP
    # header directly in a LogFormat is to use the "UseWebCacheIp"
    # directive:
    # UseWebCacheIp On
    # When this is specified, %h is derived internally from the ClientIP
    # header and the access log format does not need to be modified.
    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
    LogFormat "%h %l %u %t \"%r\" %>s %b" common
    LogFormat "%{Referer}i -> %U" referer
    LogFormat "%{User-agent}i" agent
    # The location and format of the access logfile (Common Logfile Format).
    # If you do not define any access logfiles within a <VirtualHost>
    # container, they will be logged here. Contrariwise, if you do
    # define per-<VirtualHost> access logfiles, transactions will be
    # logged therein and not in this file.
    CustomLog "|D:\product\10.1.3\OracleAS_1\Apache\Apache\bin\rotatelogs logs/access_log 43200" common
    # If you would like to have agent and referer logfiles, uncomment the
    # following directives.
    #CustomLog logs/referer.log referer
    #CustomLog logs/agent.log agent
    # If you prefer a single logfile with access, agent, and referer information
    # (Combined Logfile Format) you can use the following directive.
    #CustomLog logs/access.log combined
    # Optionally add a line containing the server version and virtual host
    # name to server-generated pages (error documents, FTP directory listings,
    # mod_status and mod_info output etc., but not CGI generated documents).
    # Set to "EMail" to also include a mailto: link to the ServerAdmin.
    # Set to one of: On | Off | EMail
    ServerSignature On
    # Apache parses all CGI scripts for the shebang line by default.
    # This comment line, the first line of the script, consists of the symbols
    # pound (#) and exclamation (!) followed by the path of the program that
    # can execute this specific script. For a perl script, with perl.exe in
    # the C:\Program Files\Perl directory, the shebang line should be:
    #!c:/program files/perl/perl
    # Note you mustnot_ indent the actual shebang line, and it must be the
    # first line of the file. Of course, CGI processing must be enabled by
    # the appropriate ScriptAlias or Options ExecCGI directives for the files
    # or directory in question.
    # However, Apache on Windows allows either the Unix behavior above, or can
    # use the Registry to match files by extention. The command to execute
    # a file of this type is retrieved from the registry by the same method as
    # the Windows Explorer would use to handle double-clicking on a file.
    # These script actions can be configured from the Windows Explorer View menu,
    # 'Folder Options', and reviewing the 'File Types' tab. Clicking the Edit
    # button allows you to modify the Actions, of which Apache 1.3 attempts to
    # perform the 'Open' Action, and failing that it will try the shebang line.
    # This behavior is subject to change in Apache release 2.0.
    # Each mechanism has it's own specific security weaknesses, from the means
    # to run a program you didn't intend the website owner to invoke, and the
    # best method is a matter of great debate.
    # To enable the this Windows specific behavior (and therefore -disable- the
    # equivilant Unix behavior), uncomment the following directive:
    #ScriptInterpreterSource registry
    # The directive above can be placed in individual <Directory> blocks or the
    # .htaccess file, with either the 'registry' (Windows behavior) or 'script'
    # (Unix behavior) option, and will override this server default option.
    # Aliases: Add here as many aliases as you need (with no limit). The format is
    # Alias fakename realname
    <IfModule mod_alias.c>
    # Note that if you include a trailing / on fakename then the server will
    # require it to be present in the URL. So "/icons" isn't aliased in this
    # example, only "/icons/"..
    Alias /icons/ "D:\product\10.1.3\OracleAS_1\Apache\Apache\icons/"
    Alias /javacachedocs/ "D:\product\10.1.3\OracleAS_1\javacache\javadoc/"
    <IfModule mod_perl.c>
    Alias /perl/ "D:\product\10.1.3\OracleAS_1\Apache\Apache/cgi-bin/"
    </IfModule>
    <Directory "icons">
    Options MultiViews
    AllowOverride None
    Order allow,deny
    Allow from all
    </Directory>
    # ScriptAlias: This controls which directories contain server scripts.
    # ScriptAliases are essentially the same as Aliases, except that
    # documents in the realname directory are treated as applications and
    # run by the server when requested rather than as documents sent to the client.
    # The same rules about trailing "/" apply to ScriptAlias directives as to
    # Alias.
    ScriptAlias /cgi-bin/ "D:\product\10.1.3\OracleAS_1\Apache\Apache\cgi-bin/"
    # "D:\product\10.1.3\OracleAS_1\Apache\Apache/cgi-bin" should be changed to whatever your ScriptAliased
    # CGI directory exists, if you have that configured.
    <Directory "D:\product\10.1.3\OracleAS_1\Apache\Apache\cgi-bin">
    AllowOverride None
    Options None
    Order allow,deny
    Allow from all
    </Directory>
    </IfModule>
    # End of aliases.
    # Redirect allows you to tell clients about documents which used to exist in
    # your server's namespace, but do not anymore. This allows you to tell the
    # clients where to look for the relocated document.
    # Format: Redirect old-URI new-URL
    # Directives controlling the display of server-generated directory listings.
    <IfModule mod_autoindex.c>
    # FancyIndexing is whether you want fancy directory indexing or standard
    # Note, add the option TrackModified to the IndexOptions default list only
    # if all indexed directories reside on NTFS volumes. The TrackModified flag
    # will report the Last-Modified date to assist caches and proxies to properly
    # track directory changes, but it does not work on FAT volumes.
    IndexOptions FancyIndexing
    # AddIcon* directives tell the server which icon to show for different
    # files or filename extensions. These are only displayed for
    # FancyIndexed directories.
    AddIconByEncoding (CMP,/icons/compressed.gif) x-compress x-gzip
    AddIconByType (TXT,/icons/text.gif) text/*
    AddIconByType (IMG,/icons/image2.gif) image/*
    AddIconByType (SND,/icons/sound2.gif) audio/*
    AddIconByType (VID,/icons/movie.gif) video/*
    AddIcon /icons/binary.gif .bin .exe
    AddIcon /icons/binhex.gif .hqx
    AddIcon /icons/tar.gif .tar
    AddIcon /icons/world2.gif .wrl .wrl.gz .vrml .vrm .iv
    AddIcon /icons/compressed.gif .Z .z .tgz .gz .zip
    AddIcon /icons/a.gif .ps .ai .eps
    AddIcon /icons/layout.gif .html .shtml .htm .pdf
    AddIcon /icons/text.gif .txt
    AddIcon /icons/c.gif .c
    AddIcon /icons/p.gif .pl .py
    AddIcon /icons/f.gif .for
    AddIcon /icons/dvi.gif .dvi
    AddIcon /icons/uuencoded.gif .uu
    AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl
    AddIcon /icons/tex.gif .tex
    AddIcon /icons/bomb.gif core
    AddIcon /icons/back.gif ..
    AddIcon /icons/hand.right.gif README
    AddIcon /icons/folder.gif ^^DIRECTORY^^
    AddIcon /icons/blank.gif ^^BLANKICON^^
    # DefaultIcon is which icon to show for files which do not have an icon
    # explicitly set.
    DefaultIcon /icons/unknown.gif
    # AddDescription allows you to place a short description after a file in
    # server-generated indexes. These are only displayed for FancyIndexed
    # directories.
    # Format: AddDescription "description" filename
    #AddDescription "GZIP compressed document" .gz
    #AddDescription "tar archive" .tar
    #AddDescription "GZIP compressed tar archive" .tgz
    # ReadmeName is the name of the README file the server will look for by
    # default, and append to directory listings.
    # HeaderName is the name of a file which should be prepended to
    # directory indexes.
    # If MultiViews are amongst the Options in effect, the server will
    # first look for name.html and include it if found. If name.html
    # doesn't exist, the server will then look for name.txt and include
    # it as plaintext if found.
    ReadmeName README
    HeaderName HEADER
    # IndexIgnore is a set of filenames which directory indexing should ignore
    # and not include in the listing. Shell-style wildcarding is permitted.
    IndexIgnore .??* *~ *# HEADER* README* RCS CVS *,v *,t
    </IfModule>
    # End of indexing directives.
    # Document types.
    <IfModule mod_mime.c>
    # AddEncoding allows you to have certain browsers (Mosaic/X 2.1+) uncompress
    # information on the fly. Note: Not all browsers support this.
    # Despite the name similarity, the following Add* directives have nothing
    # to do with the FancyIndexing customization directives above.
    AddEncoding x-compress Z
    AddEncoding x-gzip gz tgz
    # AddLanguage allows you to specify the language of a document. You can
    # then use content negotiation to give a browser a file in a language
    # it can understand.
    # Note 1: The suffix does not have to be the same as the language
    # keyword --- those with documents in Polish (whose net-standard
    # language code is pl) may wish to use "AddLanguage pl .po" to
    # avoid the ambiguity with the common suffix for perl scripts.
    # Note 2: The example entries below illustrate that in quite
    # some cases the two character 'Language' abbriviation is not
    # identical to the two character 'Country' code for its country,
    # E.g. 'Danmark/dk' versus 'Danish/da'.
    # Note 3: In the case of 'ltz' we violate the RFC by using a three char
    # specifier. But there is 'work in progress' to fix this and get
    # the reference data for rfc1766 cleaned up.
    # Danish (da) - Dutch (nl) - English (en) - Estonian (ee)
    # French (fr) - German (de) - Greek-Modern (el)
    # Italian (it) - Korean (kr) - Norwegian (no)
    # Portugese (pt) - Luxembourgeois* (ltz)
    # Spanish (es) - Swedish (sv) - Catalan (ca) - Czech(cz)
    # Polish (pl) - Brazilian Portuguese (pt-br) - Japanese (ja)
    # Russian (ru)
    AddLanguage ar .ar
    AddLanguage da .dk .da
    AddLanguage nl .nl
    AddLanguage en .en
    AddLanguage et .ee
    AddLanguage fi .fi
    AddLanguage fr .fr
    AddLanguage de .de
    AddLanguage el .el
    AddLanguage es .es_ES .es
    AddLanguage he .he .iw
    AddLanguage hu .hu
    AddCharset ISO-8859-8 .iso8859-8
    AddLanguage it .it
    AddLanguage ja .ja
    AddCharset ISO-2022-JP .jis
    AddLanguage ko .ko
    AddLanguage kr .kr
    AddCharset ISO-2022-KR .iso-kr
    AddLanguage nn .nn
    AddLanguage no .no
    AddLanguage pl .po
    AddCharset ISO-8859-2 .iso-pl
    AddLanguage pt .pt
    AddLanguage pt-br .pt_BR .pt-br
    AddLanguage ltz .lu
    AddLanguage ca .ca
    AddLanguage sk .sk
    AddLanguage sv .sv
    AddLanguage th .th
    AddLanguage tr .tr
    AddLanguage cz .cz .cs
    AddLanguage ro .ro
    AddLanguage ru .ru
    AddLanguage zh-cn .zh_CN
    AddLanguage zh-tw .zh_TW
    AddCharset Big5 .Big5 .big5
    AddCharset WINDOWS-1251 .cp-1251
    AddCharset CP866 .cp866
    AddCharset ISO-8859-5 .iso-ru
    AddCharset KOI8-R .koi8-r
    AddCharset UCS-2 .ucs2
    AddCharset UCS-4 .ucs4
    AddCharset UTF-8 .utf8
    # LanguagePriority allows you to give precedence to some languages
    # in case of a tie during content negotiation.
    # Just list the languages in decreasing order of preference. We have
    # more or less alphabetized them here. You probably want to change this.
    <IfModule mod_negotiation.c>
    LanguagePriority ar en da nl et fi fr de el it ja ko kr no pl pt pt-br ro ru ltz ca es sk sv th tr zh-cn zh-tw zh-cn
    </IfModule>
    # AddType allows you to tweak mime.types without actually editing it, or to
    # make certain files to be certain types.
    # For example, the PHP 3.x module (not part of the Apache distribution - see
    # http://www.php.net) will typically use:
    #AddType application/x-httpd-php3 .php3
    #AddType application/x-httpd-php3-source .phps
    # And for PHP 4.x, use:
    AddType application/x-httpd-php .php .phtml
    AddType application/x-httpd-php-source .phps
    AddType application/x-tar .tgz
    # AddHandler allows you to map certain file extensions to "handlers",
    # actions unrelated to filetype. These can be either built into the server
    # or added with the Action command (see below)
    # If you want to use server side includes, or CGI outside
    # ScriptAliased directories, uncomment the following lines.
    # To use CGI scripts:
    #AddHandler cgi-script .cgi
    # To use server-parsed HTML files
    #AddType text/html .shtml
    #AddHandler server-parsed .shtml
    # Uncomment the following line to enable Apache's send-asis HTTP file
    # feature
    #AddHandler send-as-is asis
    # If you wish to use server-parsed imagemap files, use
    #AddHandler imap-file map
    # To enable type maps, you might want to use
    #AddHandler type-map var
    </IfModule>
    # End of document types.
    # Action lets you define media types that will execute a script whenever
    # a matching file is called. This eliminates the need for repeated URL
    # pathnames for oft-used CGI file processors.
    # Format: Action media/type /cgi-script/location
    # Format: Action handler-name /cgi-script/location
    # MetaDir: specifies the name of the directory in which Apache can find
    # meta information files. These files contain additional HTTP headers
    # to include when sending the document
    #MetaDir .web
    # MetaSuffix: specifies the file name suffix for the file containing the
    # meta information.
    #MetaSuffix .meta
    # Customizable error response (Apache style)
    # these come in three flavors
    # 1) plain text
    #ErrorDocument 500 "The server made a boo boo.
    # n.b. the single leading (") marks it as text, it does not get output
    # 2) local redirects
    #ErrorDocument 404 /missing.html
    # to redirect to local URL /missing.html
    #ErrorDocument 404 /cgi-bin/missing_handler.pl
    # N.B.: You can redirect to a script or a document using server-side-includes.
    # 3) external redirects
    #ErrorDocument 402 http://some.other_server.com/subscription_info.html
    # N.B.: Many of the environment variables associated with the original
    # request will not be available to such a script.
    # Customize behaviour based on the browser
    <IfModule mod_setenvif.c>
    # The following directives modify normal HTTP response behavior.
    # The first directive disables keepalive for Netscape 2.x and browsers that
    # spoof it. There are known problems with these browser implementations.
    # The second directive is for Microsoft Internet Explorer 4.0b2
    # which has a broken HTTP/1.1 implementation and does not properly
    # support keepalive when it is used on 301 or 302 (redirect) responses.
    BrowserMatch "Mozilla/2" nokeepalive
    BrowserMatch "MSIE 4\.0b2;" nokeepalive downgrade-1.0 force-response-1.0
    # The following directive disables HTTP/1.1 responses to browsers which
    # are in violation of the HTTP/1.0 spec by not being able to grok a
    # basic 1.1 response.
    BrowserMatch "RealPlayer 4\.0" force-response-1.0
    BrowserMatch "Java/1\.0" force-response-1.0
    BrowserMatch "JDK/1\.0" force-response-1.0
    </IfModule>
    # End of browser customization directives
    # Allow server status reports, with the URL of http://servername/server-status
    # Change the ".your_domain.com" to match your domain to enable.
    <Location /server-status>
    SetHandler server-status
    Order deny,allow
    Deny from all
    Allow from localhost IFLMUD5DLHY4G.i-flex.com IFLMUD5DLHY4G
    </Location>
    # Allow remote server configuration reports, with the URL of
    # http://servername/server-info (requires that mod_info.c be loaded).
    # Change the ".your_domain.com" to match your domain to enable.
    #<Location /server-info>
    # SetHandler server-info
    # Order deny,allow
    # Deny from all
    # Allow from .your_domain.com
    #</Location>
    # There have been reports of people trying to abuse an old bug from pre-1.1
    # days. This bug involved a CGI script distributed as a part of Apache.
    # By uncommenting these lines you can redirect these attacks to a logging
    # script on phf.apache.org. Or, you can record them yourself, using the script
    # support/phf_abuse_log.cgi.
    #<Location /cgi-bin/phf*>
    # Deny from all
    # ErrorDocument 403 http://phf.apache.org/phf_abuse_log.cgi
    #</Location>
    # Proxy Server directives. Uncomment the following lines to
    # enable the proxy server:
    #<IfModule mod_proxy.c>
    # ProxyRequests On
    # <Directory proxy:*>
    # Order deny,allow
    # Deny from all
    # Allow from .your_domain.com
    # </Directory>
    # Enable/disable the handling of HTTP/1.1 "Via:" headers.
    # ("Full" adds the server version; "Block" removes all outgoing Via: headers)
    # Set to one of: Off | On | Full | Block
    # ProxyVia On
    # To enable the cache as well, edit and uncomment the following lines:
    # (no cacheing without CacheRoot)
    # CacheRoot "D:\product\10.1.3\OracleAS_1\Apache\Apache\proxy"
    # CacheSize 5
    # CacheGcInterval 4
    # CacheMaxExpire 24
    # CacheLastModifiedFactor 0.1
    # CacheDefaultExpire 1
    # NoCache a_domain.com another_domain.edu joes.garage_sale.com
    #</IfModule>
    # End of proxy directives.
    ### Section 3: Virtual Hosts
    # VirtualHost: If you want to maintain multiple domains/hostnames on your
    # machine you can setup VirtualHost containers for them. Most configurations
    # use only name-based virtual hosts so the server doesn't need to worry about
    # IP addresses. This is indicated by the asterisks in the directives below.
    # Please see the documentation at <URL:http://www.apache.org/docs/vhosts/>
    # for further details before you try to setup virtual hosts.
    # You may use the command line option '-S' to verify your virtual host
    # configuration.
    # Use name-based virtual hosting.
    #NameVirtualHost *
    #NameVirtualHost 12.34.56.78:80
    #NameVirtualHost 12.34.56.78
    # VirtualHost example:
    # Almost any Apache directive may go into a VirtualHost container.
    # The first VirtualHost section is used for requests without a known
    # server name.
    #<VirtualHost *>
    # ServerAdmin [email protected]
    # DocumentRoot /www/docs/dummy-host.example.com
    # ServerName dummy-host.example.com
    # ErrorLog logs/dummy-host.example.com-error_log
    # CustomLog logs/dummy-host.example.com-access_log common
    #</VirtualHost>
    #<VirtualHost default:*>
    #</VirtualHost>
    # Required for cgi perl scripts that are run from /cgi-bin/.
    SetEnv PERL5LIB "D:\product\10.1.3\OracleAS_1\perl\5.8.3\lib;D:\product\10.1.3\OracleAS_1\perl\site\5.8.3\lib"
    <IfModule mod_perl.c>
    # Perl Directives
    # PerlWarn On
    # PerlFreshRestart On
    # PerlSetEnv PERL5OPT Tw
    # PerlSetEnv PERL5LIB "D:\product\10.1.3\OracleAS_1\perl\5.8.3\lib;D:\product\10.1.3\OracleAS_1\perl\site\5.8.3\lib"
    PerlModule Apache
    # PerlModule Apache::Status
    PerlModule Apache::Registry
    # PerlModule Apache::CGI
    # PerlModule Apache::DBI
    # PerlRequire
    <Location /perl>
    SetHandler perl-script
    PerlHandler Apache::Registry
    AddHandler perl-script .pl
    Options +ExecCGI
    PerlSendHeader On
    </Location>
    # <Location /perl-status>
    # SetHandler perl-script
    # PerlHandler Apache::Status
    # order deny,allow
    # deny from all
    # allow from localhost
    # </Location>
    </IfModule>
    #Protect WEB-INF directory
    <DirectoryMatch /WEB-INF/>
    Order deny,allow
    Deny from all
    </DirectoryMatch>
    # Setup of FastCGI module
    <IfModule mod_fastcgi.c>
    Alias /fastcgi/ "D:\product\10.1.3\OracleAS_1\Apache\Apache\fastcgi/"
    ScriptAlias /fcgi-bin/ "D:\product\10.1.3\OracleAS_1\Apache\Apache\fcgi-bin/"
    <Directory "D:\product\10.1.3\OracleAS_1\Apache\Apache\fcgi-bin">
    AllowOverride None
    Options None
    Order allow,deny
    Allow from all
    SetHandler fastcgi-script
    <IfModule mod_ossl.c>
    SSLOptions +StdEnvVars
    </IfModule>
    </Directory>
    </IfModule>
    # Include the mod_oc4j configuration file
    include "D:\product\10.1.3\OracleAS_1\Apache\Apache\conf\mod_oc4j.conf"
    # Include the mod_dms configuration file
    include "D:\product\10.1.3\OracleAS_1\Apache\Apache\conf\dms.conf"
    # Loading rewrite_module here so it loads before mod_oc4j
    LoadModule rewrite_module modules/ApacheModuleRewrite.dll
    # Include the SSL definitions and Virtual Host container
    include "D:\product\10.1.3\OracleAS_1\Apache\Apache\conf\ssl.conf"
    # Include the mod_osso configuration file
    #include "D:\product\10.1.3\OracleAS_1\Apache\Apache\conf\mod_osso.conf"
    # Include the Oracle configuration file for custom settings
    include "D:\product\10.1.3\OracleAS_1\Apache\Apache\conf\oracle_apache.conf"
    my ssl.conf is as follows:
    <IfDefine SSL>
    ## SSL Global Context
    ## All SSL configuration in this context applies both to
    ## the main server and all SSL-enabled virtual hosts.
    # Pass Phrase Dialog:
    # Configure the pass phrase gathering process.
    # The filtering dialog program (`builtin' is a internal
    # terminal dialog) has to provide the pass phrase on stdout.
    SSLPassPhraseDialog builtin
    # Inter-Process Session Cache:
    # Configure the SSL Session Cache: First either `none'
    # or `dbm:/path/to/file' for the mechanism to use and
    # second the expiring timeout (in seconds).
    #SSLSessionCache none
    #SSLSessionCache dbm:logs\ssl_scache
    #SSLSessionCache shmht:logs\ssl_scache(512000)
    SSLSessionCache shmcb:logs\ssl_scache(512000)
    # SessionCache Timeout:
    # This directive sets the timeout in seconds for the information stored
    # in the global/inter-process SSL Session Cache. It can be set as low as
    # 15 for testing, but should be set to higher values like 300 in real life.
    SSLSessionCacheTimeout 300
    # Semaphore:
    # Configure the path to the mutual explusion semaphore the
    # SSL engine uses internally for inter-process synchronization.
    SSLMutex sem
    # Logging:
    # The home of the dedicated SSL protocol logfile. Errors are
    # additionally duplicated in the general error log file. Put
    # this somewhere where it cannot be used for symlink attacks on
    # a real server (i.e. somewhere where only root can write).
    # Log levels are (ascending order: higher ones include lower ones):
    # none, error, warn, info, trace, debug.
    SSLLog logs\ssl_engine_log
    SSLLogLevel warn
    ## SSL Virtual Host Context
    # NOTE: this value should match the SSL Listen directive set previously in this
    # file otherwise your virtual host will not respond to SSL requests.
    # Some MIME-types for downloading Certificates and CRLs
    AddType application/x-x509-ca-cert .crt
    AddType application/x-pkcs7-crl .crl
    ## SSL Support
    ## When we also provide SSL we have to listen to the
    ## standard HTTP port (see above) and to the HTTPS port
    # NOTE: if virtual hosts are used and you change a port value below
    # from the original value, be sure to update the default port used
    # for your virtual hosts as well.
    Listen 443
    <VirtualHost IFLMUD5DLHY4G.i-flex.com:443>
    # General setup for the virtual host
    DocumentRoot "D:\product\10.1.3\OracleAS_1\Apache\Apache\htdocs"
    ServerName IFLMUD5DLHY4G.i-flex.com
    #ServerAdmin [email protected]
    ErrorLog "|D:\product\10.1.3\OracleAS_1\Apache\Apache\bin\rotatelogs logs/error_log 43200"
    TransferLog "|D:\product\10.1.3\OracleAS_1\Apache\Apache\bin\rotatelogs logs/access_log 43200"
    Port 443
    # SSL Engine Switch:
    # Enable/Disable SSL for this virtual host.
    SSLEngine on
    # SSL Cipher Suite:
    # List the ciphers that the client is permitted to negotiate.
    SSLCipherSuite ALL:!ADH:!EXPORT56:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP
    # Server Wallet:
    # The server wallet contains the server's certificate, private key
    # and trusted certificates. Set SSLWallet at the wallet directory
    # using the syntax: file:<path-to-wallet-directory>
    SSLWallet D:\product\10.1.3\OracleAS_1\Apache\Apache\conf\ssl.wlt\default\ewallet.p12
    #SSLWalletPassword iflex2007
    # Certificate Revocation Lists (CRL):
    # Set the CA revocation path where to find CA CRLs for client
    # authentication or alternatively one huge file containing all
    # of them (file must be PEM encoded)
    # Note: Inside SSLCARevocationPath you need hash symlinks
    # to point to the certificate files. Use the provided
    # Makefile to update the hash symlinks after changes.
    #SSLCARevocationPath conf\ssl.crl
    #SSLCARevocationFile conf\ssl.crl\ca-bundle.crl
    # Client Authentication (Type):
    # Client certificate verification type and depth. Types are
    # none, optional and require
    SSLVerifyClient optional
    # Access Control:
    # With SSLRequire you can do per-directory access control based
    # on arbitrary complex boolean expressions containing server
    # variable checks and other lookup directives. The syntax is a
    # mixture between C and Perl. See the mod_ssl documentation
    # for more details.
    #<Location />
    #SSLRequire ( %{SSL_CIPHER} !~ m/^(EXP|NULL)-/ \
    # and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
    # and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
    # and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
    # and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20 ) \
    # or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/
    #</Location>
    # SSL Engine Options:
    # Set various options for the SSL engine.
    # o FakeBasicAuth:
    # Translate the client X.509 into a Basic Authorisation. This means that
    # the standard Auth/DBMAuth methods can be used for access control. The
    # user name is the `one line' version of the client's X.509 certificate.
    # Note that no password is obtained from the user. Every entry in the user
    # file needs this password: `xxj31ZMTZzkVA'.
    # o ExportCertData:
    # This exports two additional environment variables: SSL_CLIENT_CERT and
    # SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
    # server (always existing) and the client (only existing when client
    # authentication is used). This can be used to import the certificates
    # into CGI scripts.
    # o StdEnvVars:
    # This exports the standard SSL/TLS related `SSL_*' environment variables.
    # Per default this exportation is switched off for performance reasons,
    # because the extraction step is an expensive operation and is usually
    # useless for serving static content. So one usually enables the
    # exportation for CGI and SSI requests only.
    # o CompatEnvVars:
    # This exports obsolete environment variables for backward compatibility
    # to Apache-SSL 1.x, mod_ssl 2.0.x, Sioux 1.0 and Stronghold 2.x. Use this
    # to provide compatibility to existing CGI scripts.
    # o StrictRequire:
    # This denies access when "SSLRequireSSL" or "SSLRequire" applied even
    # under a "Satisfy any" situation, i.e. when it applies access is denied
    # and no other module can change it.
    # o OptRenegotiate:
    # This enables optimized SSL connection renegotiation handling when SSL
    # directives are used in per-directory context.
    #SSLOptions FakeBasicAuth ExportCertData CompatEnvVars StrictRequire
    <Files ~ "\.(cgi|shtml)$">
    SSLOptions +StdEnvVars
    </Files>
    <Directory "D:\product\10.1.3\OracleAS_1\Apache\Apache\cgi-bin">
    SSLOptions +StdEnvVars
    </Directory>
    SetEnvIf User-Agent "MSIE" nokeepalive ssl-unclean-shutdown
    # Per-Server Logging:
    # The home of a custom SSL log file. Use this when you want a
    # compact non-error SSL logfile on a virtual host basis.
    CustomLog "|D:\product\10.1.3\OracleAS_1\Apache\Apache\bin\rotatelogs logs/ssl_request_log 43200" \
    "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
    </VirtualHost>
    </IfDefine>
    Please help me rectifying this error.
    Thanks a lot in advance.

    Hi,
    Found a note explaining the significance of these errors.
    It says:
    "NZE-28862: SSL connection failed
    Cause: This error occurred because the peer closed the connection.
    Action: Enable Oracle Net tracing on both sides and examine the trace output. Contact Oracle Customer support with the trace output."
    For further details you may refer the Note: 244527.1 - Explanation of "SSL call to NZ function nzos_Handshake failed" error codes
    Thanks & Regards,
    Sindhiya V.

  • Issue in applying SSL selectively to Login JSP Page--Session getting lost.

    Hi,
    I am facing some issues with SSL configuration on my web site running on tomcat 5.5. I am using jdk 1.5 and form based authentication with JAAS framework.
    The SSL configuration is working perfectly when applied to complete web site, but starts giving problem when applied selectively to some JSP pages. At present I am trying to apply SSL just on the login page.
    When the login screen loads up, the URL in the browser has a protocol "*https*", as expected, but it doesn't gets changed to "*http*" once the user has successfully logged in. Why is the automatic change from https to http not ocurring?
    Also I want to know which is the default page, tomcat will direct the logged in user to, once successfully authenticated using form based login; Is there any way to change this default page to some other page. It looks like that tomcat automatically directs to index.html , once the user has been successfully authenticated, but I am not so sure. My index.html page is having 4 frames; the source of these frames are different JSP pages, which are not under SSL.
    My aim is to apply SSL just on login.jsp so that password doesn't travel in clear text. Once the user is authenticated he should see index.html and the address bar's URL should change it's protocol from https to http.
    Please, find below the code in my web.xml
    <security-constraint>
    <web-resource-collection>
    <web-resource-name>CWA Application</web-resource-name>
    <url-pattern>/about.jsp</url-pattern>
    <url-pattern>/admin_listds.jsp</url-pattern>
    <http-method>DELETE</http-method>
    <http-method>GET</http-method>
    <http-method>POST</http-method>
    <http-method>PUT</http-method>
    </web-resource-collection>
    <auth-constraint>
    <role-name>*</role-name>
    </auth-constraint>
    <user-data-constraint>
    <transport-guarantee>NONE</transport-guarantee>
    </user-data-constraint>
    </security-constraint>
    <security-constraint>
    <web-resource-collection>
    <url-pattern>/*login.jsp*</url-pattern>
    <http-method>GET</http-method>
    <http-method>POST</http-method>
    </web-resource-collection>
    <auth-constraint>
    <role-name>*</role-name>
    </auth-constraint>
    <user-data-constraint>
    <transport-guarantee>CONFIDENTIAL</transport-guarantee>
    </user-data-constraint>
    </security-constraint>
    <login-config>
    <auth-method>FORM</auth-method>
    <realm-name>CWA Application</realm-name>
    <form-login-config>
    <form-login-page>/login.jsp</form-login-page>
    <form-error-page>/login.jsp?error=true</form-error-page>
    </form-login-config>
    </login-config>
    <welcome-file-list>
    <welcome-file>login.jsp</welcome-file>
    </welcome-file-list>
    My login. jsp has below code:
    <form name="login" method="POST" action='<%= response.encodeURL(*"j_security_check*") %>' >
    <tr>
    <td width="100%">
    <table width="260" border="0" cellspacing="0" cellpadding="1">
    <tr>
    <td align="left" valign="top" rowspan="4"><img src="images/space.gif" width="15" height="5"></td>
    <td align="right" class="login-user" nowrap ><p>User name: </p></td>
    <td align="left" valign="top"><input maxLength="64" name="j_username" size="20"></td>
    </tr>
    <tr>
    <td align="right" nowrap class="login-user"><p>Password: </p>
    </td>
    <td align="left" valign="top">
    <input maxLength=\"64\" tabindex="2" type="password" name="j_password" size="20">
    </td>
    </tr>
    </form>
    The entries in my server.xml are following:
    <Connector port="8080" maxHttpHeaderSize="8192"
    maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
    enableLookups="false" redirectPort="8443" acceptCount="100"
    connectionTimeout="20000" disableUploadTimeout="true" />
    <Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
    maxThreads="150" scheme="https" secure="true"
    keystoreFile="${java.home}\lib\security\cacerts" keystorePass="changeit"
    clientAuth="false" sslProtocol="TLS" />
    I have gone through the http://forums.sun.com/thread.jspa?threadID=197150 and tried implementing it; The filter as explained in the thread does gets called but the session values are still lost.
    Please note I am using javascript to go from secure "https" to "http" once the user has successfully logged in The javascript code is as below:
    top.location.href="http://localhost:8080/qtv/index.html." ;
    If I use response.sendRedirect("http://localhost:8080/qtv/index.html") for going to non-secure mode, the index.html page does not gets loaded properly. (Please note that my index.html is made of *4 frames*, as explained earlier. This is a legacy code and frames can't be removed).
    The reason for index.html not getting loaded properly is that the Address bar URL does NOT change its URL and protocol from https (https://localhost:8443/qtv/index.html ) to "*http*" (http://localhost:8080/qtv/index.html) when esponse.sendRedirect() is used ;this is the default behaviour of response.sendRedirect(). And because the protocol in address bar is https, index.html is not able to load the other JSP's in it's frames because of cross-frame-scripting security issues (The other JSP's to be loaded in frames are are NOT secure as discussed earlier).
    Please let know if any way out.
    Thanks,
    Masaai

    Hi
    try to set the maximum interval between requests
    eg:
    session.setMaxInactiveInterval(6000);
    vis

  • ASA5520 AnyConnect SSL VPN Connected but unable to ping my inside LAN

    Hi there, please forgive if I have missed any forum protocols as this is my first post.
    I am trying to configure Anyconnect SSL VPN. I am able to connect to the VPN on a laptop, witch is able to download the anyconnect client from the ASA. I am unable to ping any of my IP's that are on the inside of my ASA. Before posting here I have spent many hours on forums and watching videos on anyconnect SSL VPN creation and I am following it to the T but still no ping. Any help would be very much appreciated.
    Inside              192.168.1.254/24
    Outside           dhcp
    VPN Pool        192.168.250.1-50/24
    Inside LAN     192.168.1.0/24
    : Saved
    ASA Version 8.4(4)1
    interface GigabitEthernet0/0
    nameif outside
    security-level 0
    ip address dhcp setroute
    interface GigabitEthernet0/1
    nameif inside
    security-level 99
    ip address 192.168.1.254 255.255.255.0
    interface GigabitEthernet0/2
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif management
    security-level 99
    ip address 192.168.100.1 255.255.255.0
    ftp mode passive
    dns server-group DefaultDNS
    domain-name dock.local
    same-security-traffic permit inter-interface
    object network inside-network-object
    subnet 192.168.1.0 255.255.255.0
    object network management-network-object
    subnet 192.168.100.0 255.255.255.0
    object network NETWORK_OBJ_192.168.250.0_25
    subnet 192.168.250.0 255.255.255.128
    object-group network AllInside-networks
    network-object object inside-network-object
    network-object object management-network-object
    access-list inside_access_in extended permit ip any any
    access-list outside_access_in extended permit icmp any any echo-reply
    access-list split_tunnel standard permit 192.168.1.0 255.255.255.0
    access-list split_tunnel standard permit 192.168.100.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    mtu management 1500
    ip local pool vpn_pool 192.168.250.1-192.168.250.100 mask 255.255.255.0
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-647.bin
    no asdm history enable
    arp timeout 14400
    nat (inside,outside) source dynamic AllInside-networks interface
    nat (inside,any) source static any any destination static NETWORK_OBJ_192.168.250.0_25 NETWORK_OBJ_192.168.250.0_25 no-proxy-arp route-lookup
    access-group outside_access_in in interface outside
    access-group inside_access_in in interface inside
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    http server enable 4433
    http 192.168.100.0 255.255.255.0 management
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    telnet timeout 5
    ssh 192.168.1.0 255.255.255.0 inside
    ssh 192.168.100.0 255.255.255.0 management
    ssh timeout 5
    ssh key-exchange group dh-group1-sha1
    console timeout 0
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl encryption rc4-sha1 aes128-sha1 aes256-sha1 3des-sha1
    webvpn
    enable outside
    anyconnect image disk0:/anyconnect-win-3.1.03103-k9.pkg 1
    anyconnect enable
    tunnel-group-list enable
    group-policy GroupPolicy_anyconnect internal
    group-policy GroupPolicy_anyconnect attributes
    wins-server none
    dns-server value 8.8.8.8
    vpn-tunnel-protocol ssl-client ssl-clientless
    split-tunnel-policy tunnelall
    split-tunnel-network-list value split_tunnel
    default-domain value dock.local
    username test password JAasdf434ey521ZCT encrypted privilege 15
    tunnel-group anyconnect type remote-access
    tunnel-group anyconnect general-attributes
    address-pool vpn_pool
    default-group-policy GroupPolicy_anyconnect
    tunnel-group anyconnect webvpn-attributes
    group-alias anyconnect enable
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http
    https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email
    [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:24bcba3c4124ab371297d52260135924
    : end :

    : Saved
    ASA Version 8.4(4)1
    interface GigabitEthernet0/0
    nameif outside
    security-level 0
    ip address dhcp setroute
    interface GigabitEthernet0/1
    nameif inside
    security-level 99
    ip address 192.168.1.254 255.255.255.0
    interface GigabitEthernet0/2
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif management
    security-level 99
    ip address 192.168.100.1 255.255.255.0
    ftp mode passive
    dns server-group DefaultDNS
    domain-name dock.local
    same-security-traffic permit inter-interface
    object network inside-network-object
    subnet 192.168.1.0 255.255.255.0
    object network management-network-object
    subnet 192.168.100.0 255.255.255.0
    object network NETWORK_OBJ_192.168.250.0_25
    subnet 192.168.250.0 255.255.255.0
    object-group network AllInside-networks
    network-object object inside-network-object
    network-object object management-network-object
    access-list inside_access_in extended permit ip any any
    access-list outside_access_in extended permit icmp any any echo-reply
    access-list split_tunnel standard permit 192.168.1.0 255.255.255.0
    access-list split_tunnel standard permit 192.168.100.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    mtu management 1500
    ip local pool Anyconnect-pool 192.168.250.1-192.168.250.100 mask 255.255.255.0
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-647.bin
    no asdm history enable
    arp timeout 14400
    nat (inside,outside) source dynamic AllInside-networks interface
    nat (inside,outside) source static inside-network-object inside-network-object destination static NETWORK_OBJ_192.168.250.0_25 NETWORK_OBJ_192.168.250.0_25
    nat (inside,outside) source static management-network-object management-network-object destination static NETWORK_OBJ_192.168.250.0_25 NETWORK_OBJ_192.168.250.0_25
    access-group outside_access_in in interface outside
    access-group inside_access_in in interface inside
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    http server enable
    http 192.168.100.2 255.255.255.255 management
    http 192.168.100.0 255.255.255.0 management
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    telnet timeout 5
    ssh 192.168.1.0 255.255.255.0 inside
    ssh 192.168.100.0 255.255.255.0 management
    ssh timeout 5
    ssh key-exchange group dh-group1-sha1
    console timeout 0
    management-access inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl encryption rc4-sha1 aes128-sha1 aes256-sha1 3des-sha1
    webvpn
    enable outside
    anyconnect image disk0:/anyconnect-win-3.1.03103-k9.pkg 1
    anyconnect enable
    tunnel-group-list enable
    group-policy GroupPolicy_Anyconnect_VPN internal
    group-policy GroupPolicy_Anyconnect_VPN attributes
    wins-server none
    dns-server value 8.8.8.8
    vpn-tunnel-protocol ssl-client
    split-tunnel-policy tunnelall
    split-tunnel-network-list value split_tunnel
    default-domain value dock.local
    username sander password f/J.5nLef/EqyPfy encrypted
    username aveha password JA8X3IiqPvFFsZCT encrypted privilege 15
    tunnel-group Anyconnect_VPN type remote-access
    tunnel-group Anyconnect_VPN general-attributes
    address-pool Anyconnect-pool
    default-group-policy GroupPolicy_Anyconnect_VPN
    tunnel-group Anyconnect_VPN webvpn-attributes
    group-alias Anyconnect_VPN enable
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http
    https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email
    [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:4636fa566ffc11b0f7858b760d974dee
    : end:

  • Weblogic app server wsdl web service call with SSL Validation error = 16

    Weblogic app server wsdl web service call with SSL Validation error = 16
    I need to make wsdl web service call in my weblogic app server. The web service is provided by a 3rd party vendor. I keep getting error
    Cannot complete the certificate chain: No trusted cert found
    Certificate chain received from ws-eq.demo.xxx.com - xx.xxx.xxx.156 was not trusted causing SSL handshake failure
    Validation error = 16
    From the SSL debug log, I can see 3 verisign hierarchy certs are correctly loaded (see 3 lines in the log message starting with “adding as trusted cert”). But somehow after first handshake, I got error “Cannot complete the certificate chain: No trusted cert found”.
    Here is how I load trustStore and keyStore in my java program:
         System.setProperty("javax.net.ssl.trustStore",”cacerts”);
         System.setProperty("javax.net.ssl.trustStorePassword", trustKeyPasswd);
         System.setProperty("javax.net.ssl.trustStoreType","JKS");
    System.setProperty("javax.net.ssl.keyStoreType","JKS");
    System.setProperty("javax.net.ssl.keyStore", keyStoreName);
         System.setProperty("javax.net.ssl.keyStorePassword",clientCertPwd);      System.setProperty("com.sun.xml.ws.transport.http.client.HttpTransportPipe.dump","true");
    Here is how I create cacerts using verisign hierarchy certs (in this order)
    1.6.0_29/jre/bin/keytool -import -trustcacerts -keystore cacerts -storepass changeit -file VerisignClass3G5PCA3Root.txt -alias "Verisign Class3 G5P CA3 Root"
    1.6.0_29/jre/bin/keytool -import -trustcacerts -keystore cacerts -storepass changeit -file VerisignC3G5IntermediatePrimary.txt -alias "Verisign C3 G5 Intermediate Primary"
    1.6.0_29/jre/bin/keytool -import -trustcacerts -keystore cacerts -storepass changeit -file VerisignC3G5IntermediateSecondary.txt -alias "Verisign C3 G5 Intermediate Secondary"
    Because my program is a weblogic app server, when I start the program, I have java command line options set as:
    -Dweblogic.security.SSL.trustedCAKeyStore=SSLTrust.jks
    -Dweblogic.security.SSL.ignoreHostnameVerification=true
    -Dweblogic.security.SSL.enforceConstraints=strong
    That SSLTrust.jks is the trust certificate from our web server which sits on a different box. In our config.xml file, we also refer to the SSLTrust.jks file when we bring up the weblogic app server.
    In addition, we have working logic to use some other wsdl web services from the same vendor on the same SOAP server. In the working web service call flows, we use clientgen to create client stub, and use SSLContext and WLSSLAdapter to load trustStore and keyStore, and then bind the SSLContext and WLSSLAdapter objects to the webSerive client object and make the webservie call. For the new wsdl file, I am told to use wsimport to create client stub. In the client code created, I don’t see any way that I can bind SSLContext and WLSSLAdapter objects to the client object, so I have to load certs by settting system pramaters. Here I attached the the wsdl file.
    I have read many articles. It seems as long as I can install the verisign certs correctly to web logic server, I should have fixed the problem. Now the questions are:
    1.     Do I create “cacerts” the correct order with right keeltool options?
    2.     Since command line option “-Dweblogic.security.SSL.trustedCAKeyStore” is used for web server jks certificate, will that cause any problem for me?
    3.     Is it possible to use wsimport to generate client stub that I can bind SSLContext and WLSSLAdapter objects to it?
    4.     Do I need to put the “cacerts” to some specific weblogic directory?
    ---------------------------------wsdl file
    <wsdl:definitions name="TokenServices" targetNamespace="http://tempuri.org/" xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap12="http://schemas.xmlsoap.org/wsdl/soap12/" xmlns:tns="http://tempuri.org/" xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/08/addressing" xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy" xmlns:wsap="http://schemas.xmlsoap.org/ws/2004/08/addressing/policy" xmlns:wsaw="http://www.w3.org/2006/05/addressing/wsdl" xmlns:msc="http://schemas.microsoft.com/ws/2005/12/wsdl/contract" xmlns:wsa10="http://www.w3.org/2005/08/addressing" xmlns:wsx="http://schemas.xmlsoap.org/ws/2004/09/mex" xmlns:wsam="http://www.w3.org/2007/05/addressing/metadata">
         <wsp:Policy wsu:Id="TokenServices_policy">
              <wsp:ExactlyOne>
                   <wsp:All>
                        <sp:TransportBinding xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
                             <wsp:Policy>
                                  <sp:TransportToken>
                                       <wsp:Policy>
                                            <sp:HttpsToken RequireClientCertificate="true"/>
                                       </wsp:Policy>
                                  </sp:TransportToken>
                                  <sp:AlgorithmSuite>
                                       <wsp:Policy>
                                            <sp:Basic256/>
                                       </wsp:Policy>
                                  </sp:AlgorithmSuite>
                                  <sp:Layout>
                                       <wsp:Policy>
                                            <sp:Strict/>
                                       </wsp:Policy>
                                  </sp:Layout>
                             </wsp:Policy>
                        </sp:TransportBinding>
                        <wsaw:UsingAddressing/>
                   </wsp:All>
              </wsp:ExactlyOne>
         </wsp:Policy>
         <wsdl:types>
              <xsd:schema targetNamespace="http://tempuri.org/Imports">
                   <xsd:import schemaLocation="xsd0.xsd" namespace="http://tempuri.org/"/>
                   <xsd:import schemaLocation="xsd1.xsd" namespace="http://schemas.microsoft.com/2003/10/Serialization/"/>
              </xsd:schema>
         </wsdl:types>
         <wsdl:message name="ITokenServices_GetUserToken_InputMessage">
              <wsdl:part name="parameters" element="tns:GetUserToken"/>
         </wsdl:message>
         <wsdl:message name="ITokenServices_GetUserToken_OutputMessage">
              <wsdl:part name="parameters" element="tns:GetUserTokenResponse"/>
         </wsdl:message>
         <wsdl:message name="ITokenServices_GetSSOUserToken_InputMessage">
              <wsdl:part name="parameters" element="tns:GetSSOUserToken"/>
         </wsdl:message>
         <wsdl:message name="ITokenServices_GetSSOUserToken_OutputMessage">
              <wsdl:part name="parameters" element="tns:GetSSOUserTokenResponse"/>
         </wsdl:message>
         <wsdl:portType name="ITokenServices">
              <wsdl:operation name="GetUserToken">
                   <wsdl:input wsaw:Action="http://tempuri.org/ITokenServices/GetUserToken" message="tns:ITokenServices_GetUserToken_InputMessage"/>
                   <wsdl:output wsaw:Action="http://tempuri.org/ITokenServices/GetUserTokenResponse" message="tns:ITokenServices_GetUserToken_OutputMessage"/>
              </wsdl:operation>
              <wsdl:operation name="GetSSOUserToken">
                   <wsdl:input wsaw:Action="http://tempuri.org/ITokenServices/GetSSOUserToken" message="tns:ITokenServices_GetSSOUserToken_InputMessage"/>
                   <wsdl:output wsaw:Action="http://tempuri.org/ITokenServices/GetSSOUserTokenResponse" message="tns:ITokenServices_GetSSOUserToken_OutputMessage"/>
              </wsdl:operation>
         </wsdl:portType>
         <wsdl:binding name="TokenServices" type="tns:ITokenServices">
              <wsp:PolicyReference URI="#TokenServices_policy"/>
              <soap12:binding transport="http://schemas.xmlsoap.org/soap/http"/>
              <wsdl:operation name="GetUserToken">
                   <soap12:operation soapAction="http://tempuri.org/ITokenServices/GetUserToken" style="document"/>
                   <wsdl:input>
                        <soap12:body use="literal"/>
                   </wsdl:input>
                   <wsdl:output>
                        <soap12:body use="literal"/>
                   </wsdl:output>
              </wsdl:operation>
              <wsdl:operation name="GetSSOUserToken">
                   <soap12:operation soapAction="http://tempuri.org/ITokenServices/GetSSOUserToken" style="document"/>
                   <wsdl:input>
                        <soap12:body use="literal"/>
                   </wsdl:input>
                   <wsdl:output>
                        <soap12:body use="literal"/>
                   </wsdl:output>
              </wsdl:operation>
         </wsdl:binding>
         <wsdl:service name="TokenServices">
              <wsdl:port name="TokenServices" binding="tns:TokenServices">
                   <soap12:address location="https://ws-eq.demo.i-deal.com/PhxEquity/TokenServices.svc"/>
                   <wsa10:EndpointReference>
                        <wsa10:Address>https://ws-eq.demo.xxx.com/PhxEquity/TokenServices.svc</wsa10:Address>
                   </wsa10:EndpointReference>
              </wsdl:port>
         </wsdl:service>
    </wsdl:definitions>
    ----------------------------------application log
    adding as trusted cert:
    Subject: CN=VeriSign Class 3 International Server CA - G3, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US
    Issuer: CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="(c) 2006 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US
    Algorithm: RSA; Serial number: 0x641be820ce020813f32d4d2d95d67e67
    Valid from Sun Feb 07 19:00:00 EST 2010 until Fri Feb 07 18:59:59 EST 2020
    adding as trusted cert:
    Subject: OU=Class 3 Public Primary Certification Authority, O="VeriSign, Inc.", C=US
    Issuer: OU=Class 3 Public Primary Certification Authority, O="VeriSign, Inc.", C=US
    Algorithm: RSA; Serial number: 0x3c9131cb1ff6d01b0e9ab8d044bf12be
    Valid from Sun Jan 28 19:00:00 EST 1996 until Wed Aug 02 19:59:59 EDT 2028
    adding as trusted cert:
    Subject: CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="(c) 2006 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US
    Issuer: OU=Class 3 Public Primary Certification Authority, O="VeriSign, Inc.", C=US
    Algorithm: RSA; Serial number: 0x250ce8e030612e9f2b89f7054d7cf8fd
    Valid from Tue Nov 07 19:00:00 EST 2006 until Sun Nov 07 18:59:59 EST 2021
    <Mar 7, 2013 6:59:21 PM EST> <Debug> <SecuritySSL> <BEA-000000> <Ignoring not supported JCE Cipher: SunPKCS11-Solaris version 1.6 for algorithm DESede/CBC/NoPadding>
    <Mar 7, 2013 6:59:21 PM EST> <Debug> <SecuritySSL> <BEA-000000> <Will use default Cipher for algorithm DESede>
    <Mar 7, 2013 6:59:21 PM EST> <Debug> <SecuritySSL> <BEA-000000> <Using JCE Cipher: SunJCE version 1.6 for algorithm RSA/ECB/NoPadding>
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <SSLSetup: loading trusted CA certificates>
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <Filtering JSSE SSLSocket>
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <SSLIOContextTable.addContext(ctx): 28395435>
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <SSLSocket will be Muxing>
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <write HANDSHAKE, offset = 0, length = 115>
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <isMuxerActivated: false>
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <25779276 SSL3/TLS MAC>
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <25779276 received HANDSHAKE>
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <HANDSHAKEMESSAGE: ServerHello>
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <HANDSHAKEMESSAGE: Certificate>
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <Cannot complete the certificate chain: No trusted cert found>
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <Validating certificate 0 in the chain: Serial number: 2400410601231772600606506698552332774
    Issuer:C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 International Server CA - G3
    Subject:C=US, ST=New York, L=New York, O=xxx LLC, OU=GTIG, CN=ws-eq.demo.xxx.com
    Not Valid Before:Tue Dec 18 19:00:00 EST 2012
    Not Valid After:Wed Jan 07 18:59:59 EST 2015
    Signature Algorithm:SHA1withRSA
    >
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <Validating certificate 1 in the chain: Serial number: 133067699711757643302127248541276864103
    Issuer:C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G5
    Subject:C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 International Server CA - G3
    Not Valid Before:Sun Feb 07 19:00:00 EST 2010
    Not Valid After:Fri Feb 07 18:59:59 EST 2020
    Signature Algorithm:SHA1withRSA
    >
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <validationCallback: validateErr = 16>
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> < cert[0] = Serial number: 2400410601231772600606506698552332774
    Issuer:C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 International Server CA - G3
    Subject:C=US, ST=New York, L=New York, O=xxx LLC, OU=GTIG, CN=ws-eq.demo.xxx.com
    Not Valid Before:Tue Dec 18 19:00:00 EST 2012
    Not Valid After:Wed Jan 07 18:59:59 EST 2015
    Signature Algorithm:SHA1withRSA
    >
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> < cert[1] = Serial number: 133067699711757643302127248541276864103
    Issuer:C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G5
    Subject:C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 International Server CA - G3
    Not Valid Before:Sun Feb 07 19:00:00 EST 2010
    Not Valid After:Fri Feb 07 18:59:59 EST 2020
    Signature Algorithm:SHA1withRSA
    >
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <weblogic user specified trustmanager validation status 16>
    <Mar 7, 2013 6:59:22 PM EST> <Warning> <Security> <BEA-090477> <Certificate chain received from ws-eq.demo.xxx.com - xx.xxx.xxx.156 was not trusted causing SSL handshake failure.>
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <Validation error = 16>
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <Certificate chain is untrusted>
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <SSLTrustValidator returns: 16>
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <Trust status (16): CERT_CHAIN_UNTRUSTED>
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <NEW ALERT with Severity: FATAL, Type: 42
    java.lang.Exception: New alert stack
         at com.certicom.tls.record.alert.Alert.<init>(Unknown Source)
         at com.certicom.tls.record.handshake.HandshakeHandler.fireAlert(Unknown Source)
         at com.certicom.tls.record.handshake.ClientStateReceivedServerHello.handle(Unknown Source)
         at com.certicom.tls.record.handshake.HandshakeHandler.handleHandshakeMessage(Unknown Source)
         at com.certicom.tls.record.handshake.HandshakeHandler.handleHandshakeMessages(Unknown Source)
         at com.certicom.tls.record.MessageInterpreter.interpretContent(Unknown Source)
         at com.certicom.tls.record.MessageInterpreter.decryptMessage(Unknown Source)
         at com.certicom.tls.record.ReadHandler.processRecord(Unknown Source)
         at com.certicom.tls.record.ReadHandler.readRecord(Unknown Source)
         at com.certicom.tls.record.ReadHandler.readUntilHandshakeComplete(Unknown Source)
         at com.certicom.tls.interfaceimpl.TLSConnectionImpl.completeHandshake(Unknown Source)
         at com.certicom.tls.record.WriteHandler.write(Unknown Source)
         at com.certicom.io.OutputSSLIOStreamWrapper.write(Unknown Source)
         at java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:65)
         at java.io.BufferedOutputStream.flush(BufferedOutputStream.java:123)
         at java.io.FilterOutputStream.flush(FilterOutputStream.java:123)
         at weblogic.net.http.HttpURLConnection.writeRequests(HttpURLConnection.java:154)
         at weblogic.net.http.HttpURLConnection.getInputStream(HttpURLConnection.java:358)
         at weblogic.net.http.SOAPHttpsURLConnection.getInputStream(SOAPHttpsURLConnection.java:37)
         at weblogic.wsee.util.is.InputSourceUtil.loadURL(InputSourceUtil.java:100)
         at weblogic.wsee.util.dom.DOMParser.getWebLogicDocumentImpl(DOMParser.java:118)
         at weblogic.wsee.util.dom.DOMParser.getDocument(DOMParser.java:65)
         at weblogic.wsee.wsdl.WsdlReader.getDocument(WsdlReader.java:311)
         at weblogic.wsee.wsdl.WsdlReader.getDocument(WsdlReader.java:305)
         at weblogic.wsee.jaxws.spi.WLSProvider.readWSDL(WLSProvider.java:296)
         at weblogic.wsee.jaxws.spi.WLSProvider.createServiceDelegate(WLSProvider.java:77)
         at weblogic.wsee.jaxws.spi.WLSProvider.createServiceDelegate(WLSProvider.java:62)
         at javax.xml.ws.Service.<init>(Service.java:56)
         at ideal.ws2j.eqtoken.TokenServices.<init>(TokenServices.java:64)
         at com.citi.ilrouter.util.IpreoEQSSOClient.invokeRpcPortalToken(IpreoEQSSOClient.java:165)
         at com.citi.ilrouter.servlets.T3LinkServlet.doPost(T3LinkServlet.java:168)
         at com.citi.ilrouter.servlets.T3LinkServlet.doGet(T3LinkServlet.java:206)
         at javax.servlet.http.HttpServlet.service(HttpServlet.java:707)
         at javax.servlet.http.HttpServlet.service(HttpServlet.java:820)
         at weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:227)
         at weblogic.servlet.internal.StubSecurityHelper.invokeServlet(StubSecurityHelper.java:125)
         at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:292)
         at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:175)
         at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.run(Unknown Source)
         at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321)
         at weblogic.security.service.SecurityManager.runAs(Unknown Source)
         at weblogic.servlet.internal.WebAppServletContext.securedExecute(Unknown Source)
         at weblogic.servlet.internal.WebAppServletContext.execute(Unknown Source)
         at weblogic.servlet.internal.ServletRequestImpl.run(Unknown Source)
         at weblogic.work.ExecuteThread.execute(ExecuteThread.java:201)
         at weblogic.work.ExecuteThread.run(ExecuteThread.java:173)
    >
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <write ALERT, offset = 0, length = 2>
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <close(): 6457753>
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <close(): 6457753>
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <SSLIOContextTable.removeContext(ctx): 22803607>
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <Filtering JSSE SSLSocket>
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <SSLIOContextTable.addContext(ctx): 14640403>
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <SSLSocket will be Muxing>
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <write HANDSHAKE, offset = 0, length = 115>
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <isMuxerActivated: false>
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <23376797 SSL3/TLS MAC>
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <23376797 received HANDSHAKE>
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <HANDSHAKEMESSAGE: ServerHello>
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <HANDSHAKEMESSAGE: Certificate>
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <Cannot complete the certificate chain: No trusted cert found>
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <Validating certificate 0 in the chain: Serial number: 2400410601231772600606506698552332774
    Issuer:C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 International Server CA - G3
    Subject:C=US, ST=New York, L=New York, O=xxx LLC, OU=GTIG, CN=ws-eq.demo.xxx.com
    Not Valid Before:Tue Dec 18 19:00:00 EST 2012
    Not Valid After:Wed Jan 07 18:59:59 EST 2015
    Signature Algorithm:SHA1withRSA
    >
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <Validating certificate 1 in the chain: Serial number: 133067699711757643302127248541276864103
    Issuer:C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G5
    Subject:C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 International Server CA - G3
    Not Valid Before:Sun Feb 07 19:00:00 EST 2010
    Not Valid After:Fri Feb 07 18:59:59 EST 2020
    Signature Algorithm:SHA1withRSA
    >
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <validationCallback: validateErr = 16>
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> < cert[0] = Serial number: 2400410601231772600606506698552332774
    Issuer:C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 International Server CA - G3
    Subject:C=US, ST=New York, L=New York, O=xxx LLC, OU=GTIG, CN=ws-eq.demo.xxx.com
    Not Valid Before:Tue Dec 18 19:00:00 EST 2012
    Not Valid After:Wed Jan 07 18:59:59 EST 2015
    Signature Algorithm:SHA1withRSA
    >
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> < cert[1] = Serial number: 133067699711757643302127248541276864103
    Issuer:C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G5
    Subject:C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 International Server CA - G3
    Not Valid Before:Sun Feb 07 19:00:00 EST 2010
    Not Valid After:Fri Feb 07 18:59:59 EST 2020
    Signature Algorithm:SHA1withRSA
    >
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <weblogic user specified trustmanager validation status 16>
    <Mar 7, 2013 6:59:22 PM EST> <Warning> <Security> <BEA-090477> <Certificate chain received from ws-eq.demo.xxx.com - 12.29.210.156 was not trusted causing SSL handshake failure.>
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <Validation error = 16>
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <Certificate chain is untrusted>
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <SSLTrustValidator returns: 16>
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <Trust status (16): CERT_CHAIN_UNTRUSTED>
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <NEW ALERT with Severity: FATAL, Type: 42
    java.lang.Exception: New alert stack
         at com.certicom.tls.record.alert.Alert.<init>(Unknown Source)
         at com.certicom.tls.record.handshake.HandshakeHandler.fireAlert(Unknown Source)
         at com.certicom.tls.record.handshake.ClientStateReceivedServerHello.handle(Unknown Source)
         at com.certicom.tls.record.handshake.HandshakeHandler.handleHandshakeMessage(Unknown Source)
         at com.certicom.tls.record.handshake.HandshakeHandler.handleHandshakeMessages(Unknown Source)
         at com.certicom.tls.record.MessageInterpreter.interpretContent(Unknown Source)
         at com.certicom.tls.record.MessageInterpreter.decryptMessage(Unknown Source)
         at com.certicom.tls.record.ReadHandler.processRecord(Unknown Source)
         at com.certicom.tls.record.ReadHandler.readRecord(Unknown Source)
         at com.certicom.tls.record.ReadHandler.readUntilHandshakeComplete(Unknown Source)
         at com.certicom.tls.interfaceimpl.TLSConnectionImpl.completeHandshake(Unknown Source)
         at com.certicom.tls.record.WriteHandler.write(Unknown Source)
         at com.certicom.io.OutputSSLIOStreamWrapper.write(Unknown Source)
         at java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:65)
         at java.io.BufferedOutputStream.flush(BufferedOutputStream.java:123)
         at java.io.FilterOutputStream.flush(FilterOutputStream.java:123)
         at weblogic.net.http.HttpURLConnection.writeRequests(HttpURLConnection.java:154)
         at weblogic.net.http.HttpURLConnection.getInputStream(HttpURLConnection.java:358)
         at weblogic.net.http.SOAPHttpsURLConnection.getInputStream(SOAPHttpsURLConnection.java:37)
         at weblogic.wsee.util.is.InputSourceUtil.loadURL(InputSourceUtil.java:100)
         at weblogic.wsee.util.dom.DOMParser.getWebLogicDocumentImpl(DOMParser.java:118)
         at weblogic.wsee.util.dom.DOMParser.getDocument(DOMParser.java:65)
         at weblogic.wsee.wsdl.WsdlReader.getDocument(WsdlReader.java:311)
         at weblogic.wsee.wsdl.WsdlReader.getDocument(WsdlReader.java:305)
         at weblogic.wsee.jaxws.spi.WLSProvider.readWSDL(WLSProvider.java:296)
         at weblogic.wsee.jaxws.spi.WLSProvider.createServiceDelegate(WLSProvider.java:77)
         at weblogic.wsee.jaxws.spi.WLSProvider.createServiceDelegate(WLSProvider.java:62)
         at javax.xml.ws.Service.<init>(Service.java:56)
         at ideal.ws2j.eqtoken.TokenServices.<init>(TokenServices.java:64)
         at com.citi.ilrouter.util.IpreoEQSSOClient.invokeRpcPortalToken(IpreoEQSSOClient.java:165)
         at com.citi.ilrouter.servlets.T3LinkServlet.doPost(T3LinkServlet.java:168)
         at com.citi.ilrouter.servlets.T3LinkServlet.doGet(T3LinkServlet.java:206)
         at javax.servlet.http.HttpServlet.service(HttpServlet.java:707)
         at javax.servlet.http.HttpServlet.service(HttpServlet.java:820)
         at weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:227)
         at weblogic.servlet.internal.StubSecurityHelper.invokeServlet(StubSecurityHelper.java:125)
         at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:292)
         at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:175)
         at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.run(Unknown Source)
         at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321)
         at weblogic.security.service.SecurityManager.runAs(Unknown Source)
         at weblogic.servlet.internal.WebAppServletContext.securedExecute(Unknown Source)
         at weblogic.servlet.internal.WebAppServletContext.execute(Unknown Source)
         at weblogic.servlet.internal.ServletRequestImpl.run(Unknown Source)
         at weblogic.work.ExecuteThread.execute(ExecuteThread.java:201)
         at weblogic.work.ExecuteThread.run(ExecuteThread.java:173)
    >
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <write ALERT, offset = 0, length = 2>
    <Mar 7, 2013 6:59:22 PM EST> <Debug> <SecuritySSL> <BEA-000000> <close(): 16189141>

    I received a workaround by an internal message.
    The how to guide is :
    -Download the wsdl file (with bindings, not the one from ESR)
    -Correct it in order that the schema corresponds to the answer (remove minOccurs or other things like this)
    -Deploy the wsdl file on you a server (java web project for exemple). you can deploy on your local
    -Create a new logicial destination that point to the wsdl file modified
    -Change the metadata destination in your web dynpro project for the corresponding model and keep the execution desitnation as before.
    Then the received data is check by the metadata logical destination but the data is retrieved from the correct server.

  • Connecting Java client to SSL server with existing certificates

    I am currently trying to connect my Java client to an existing server application
    written in C++. I have been provided the needed certificates (root.pem, server.pem,
    and client.pem). My code simply creates a SSLSocket and then attempts to read
    from it. Something goes wrong during the handshake process and I get a SSLHandshakeException. The certificates have been added to the keystore
    I am using, and I do not know any other action to take.
    Here is the debug output:
    setting up default SSLSocketFactory
    use default SunJSSE impl class: com.sun.net.ssl.internal.ssl.SSLSocketFactoryImpl
    class com.sun.net.ssl.internal.ssl.SSLSocketFactoryImpl is loaded
    keyStore is :
    keyStore type is : jks
    keyStore provider is :
    init keystore
    init keymanager of type SunX509
    trustStore is: keystore.jks
    trustStore type is : jks
    trustStore provider is :
    init truststore
    adding as trusted cert:
    Subject: [email protected], CN=Employee, OU=test, O=company-USA, L=City, ST=AL, C=US
    Issuer: [email protected], CN=company Employee, OU=test, O="company, Inc.", L=City, ST=AL, C=US
    Algorithm: RSA; Serial number: 0xb40b909f74d167aa
    Valid from Tue Sep 12 09:42:01 CDT 2006 until Thu Oct 12 09:42:01 CDT 2006
    adding as trusted cert:
    Subject: [email protected], CN=Employee, OU=test, O="company, Inc.", L=City, ST=AL, C=US
    Issuer: [email protected], CN=ISAC Employee, OU=test, O="company, Inc.", L=City, ST=AL, C=US
    Algorithm: RSA; Serial number: 0xb40b909f74d167ab
    Valid from Tue Sep 12 09:49:12 CDT 2006 until Thu Oct 12 09:49:12 CDT 2006
    adding as trusted cert:
    Subject: [email protected], CN=company Employee, OU=test, O="company, Inc.", L=City, ST=AL, C=US
    Issuer: [email protected], CN=company, OU=test, O="company, Inc.", L=City, ST=AL, C=US
    Algorithm: RSA; Serial number: 0xf6e3ada87dc4004f
    Valid from Tue Sep 12 09:40:32 CDT 2006 until Thu Oct 12 09:40:32 CDT 2006
    init context
    trigger seeding of SecureRandom
    done seeding SecureRandom
    instantiated an instance of class com.sun.net.ssl.internal.ssl.SSLSocketFactoryImpl
    SSL socket created
    %% No cached client session
    *** ClientHello, TLSv1
    RandomCookie: GMT: 1158089181 bytes = { 138, 112, 170, 91, 246, 86, 216, 146, 160, 188, 243, 154, 238, 132, 33, 219, 251, 3, 93, 25, 191, 247, 41, 14, 99, 135, 130, 23 }
    Session ID: {}
    Cipher Suites: [SSL_RSA_WITH_RC4_128_MD5, SSL_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_256_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_DES_CBC_SHA, SSL_DHE_RSA_WITH_DES_CBC_SHA, SSL_DHE_DSS_WITH_DES_CBC_SHA, SSL_RSA_EXPORT_WITH_RC4_40_MD5, SSL_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA]
    Compression Methods: { 0 }
    [write] MD5 and SHA1 hashes: len = 79
    0000: 01 00 00 4B 03 01 45 07 0A DD 8A 70 AA 5B F6 56 ...K..E....p.[.V
    0010: D8 92 A0 BC F3 9A EE 84 21 DB FB 03 5D 19 BF F7 ........!...]...
    0020: 29 0E 63 87 82 17 00 00 24 00 04 00 05 00 2F 00 ).c.....$...../.
    0030: 35 00 33 00 39 00 32 00 38 00 0A 00 16 00 13 00 5.3.9.2.8.......
    0040: 09 00 15 00 12 00 03 00 08 00 14 00 11 01 00 ...............
    Client Thread, WRITE: TLSv1 Handshake, length = 79
    [write] MD5 and SHA1 hashes: len = 107
    0000: 01 03 01 00 42 00 00 00 20 00 00 04 01 00 80 00 ....B... .......
    0010: 00 05 00 00 2F 00 00 35 00 00 33 00 00 39 00 00 ..../..5..3..9..
    0020: 32 00 00 38 00 00 0A 07 00 C0 00 00 16 00 00 13 2..8............
    0030: 00 00 09 06 00 40 00 00 15 00 00 12 00 00 03 02 .....@..........
    0040: 00 80 00 00 08 00 00 14 00 00 11 45 07 0A DD 8A ...........E....
    0050: 70 AA 5B F6 56 D8 92 A0 BC F3 9A EE 84 21 DB FB p.[.V........!..
    0060: 03 5D 19 BF F7 29 0E 63 87 82 17 .]...).c...
    Client Thread, WRITE: SSLv2 client hello message, length = 107
    [Raw write]: length = 109
    0000: 80 6B 01 03 01 00 42 00 00 00 20 00 00 04 01 00 .k....B... .....
    0010: 80 00 00 05 00 00 2F 00 00 35 00 00 33 00 00 39 ....../..5..3..9
    0020: 00 00 32 00 00 38 00 00 0A 07 00 C0 00 00 16 00 ..2..8..........
    0030: 00 13 00 00 09 06 00 40 00 00 15 00 00 12 00 00 .......@........
    0040: 03 02 00 80 00 00 08 00 00 14 00 00 11 45 07 0A .............E..
    0050: DD 8A 70 AA 5B F6 56 D8 92 A0 BC F3 9A EE 84 21 ..p.[.V........!
    0060: DB FB 03 5D 19 BF F7 29 0E 63 87 82 17 ...]...).c...
    Client Thread, received EOFException: error
    Client Thread, handling exception: javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake
    Client Thread, SEND TLSv1 ALERT: fatal, description = handshake_failure
    Client Thread, WRITE: TLSv1 Alert, length = 2
    [Raw write]: length = 7
    0000: 15 03 01 00 02 02 28 ......(
    Client Thread, called closeSocket()
    Error: Remote host closed connection during handshake
    Thread-4, handling exception: javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake

    (I am the original poster of this message, I had to create a new username though).
    The original problem had to do with incompatibilities with the protocol and/or cipher suites
    used. Now, the client and server perform most of the handshake process, but something
    goes wrong as the server requests the client certificate. In other words, the server requires
    mutual authentication, but for some reason it seems like my JSSE client won't send over
    it's client certificate. I don't get any type of bad certificate exceptions, so I'm not sure
    where the source of the error lies.
    Updated output:
    setting up default SSLSocketFactory
    use default SunJSSE impl class: com.sun.net.ssl.internal.ssl.SSLSocketFactoryImpl
    class com.sun.net.ssl.internal.ssl.SSLSocketFactoryImpl is loaded
    keyStore is : keystore
    keyStore type is : jks
    keyStore provider is :
    init keystore
    init keymanager of type SunX509
    trustStore is: truststore
    trustStore type is : jks
    trustStore provider is :
    init truststore
    adding as trusted cert:
    Subject: [email protected], CN=Employee, OU=default, O="default Inc.", L=default, ST=AL, C=US
    Issuer: [email protected], CN=default Employee, OU=default, O="default, Inc.", L=default, ST=AL, C=US
    Algorithm: RSA; Serial number: 0xb40b909f74d167ab
    Valid from Tue Sep 12 09:49:12 CDT 2006 until Thu Oct 12 09:49:12 CDT 2006
    adding as trusted cert:
    Subject: [email protected], CN=default-Server, OU=HawkEye, O=default, L=default, ST=AL, C=US
    Issuer: [email protected], CN=default Employee, OU=default, O="default, Inc.", L=default, ST=AL, C=US
    Algorithm: RSA; Serial number: 0xb40b909f74d167ac
    Valid from Tue Sep 12 14:42:28 CDT 2006 until Thu Oct 12 14:42:28 CDT 2006
    adding as trusted cert:
    Subject: [email protected], CN=default Employee, OU=default, O="default, Inc.", L=default, ST=AL, C=US
    Issuer: [email protected], CN=default Employee, OU=default, O="default, Inc.", L=default, ST=AL, C=US
    Algorithm: RSA; Serial number: 0xf6e3ada87dc4004f
    Valid from Tue Sep 12 09:40:32 CDT 2006 until Thu Oct 12 09:40:32 CDT 2006
    init context
    trigger seeding of SecureRandom
    done seeding SecureRandom
    instantiated an instance of class com.sun.net.ssl.internal.ssl.SSLSocketFactoryImpl
    %% No cached client session
    *** ClientHello, TLSv1
    RandomCookie: GMT: 1158242806 bytes = { 71, 195, 185, 44, 86, 96, 14, 11, 171, 76, 105, 135, 136, 114, 53, 54, 137, 75, 202, 254, 112, 208, 240, 91, 199, 246, 175, 207 }
    Session ID: {}
    Cipher Suites: [SSL_RSA_WITH_RC4_128_MD5, SSL_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_256_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_DES_CBC_SHA, SSL_DHE_RSA_WITH_DES_CBC_SHA, SSL_DHE_DSS_WITH_DES_CBC_SHA, SSL_RSA_EXPORT_WITH_RC4_40_MD5, SSL_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA]
    Compression Methods: { 0 }
    Client Thread, WRITE: TLSv1 Handshake, length = 79
    Client Thread, READ: TLSv1 Handshake, length = 74
    *** ServerHello, TLSv1
    RandomCookie: GMT: 1158242807 bytes = { 63, 93, 48, 73, 98, 251, 160, 215, 61, 110, 246, 12, 5, 209, 95, 194, 152, 193, 0, 181, 135, 26, 150, 174, 52, 92, 56, 250 }
    Session ID: {83, 31, 134, 30, 76, 200, 183, 120, 7, 94, 26, 65, 186, 91, 197, 25, 10, 193, 94, 220, 198, 250, 162, 153, 6, 89, 12, 250, 66, 105, 249, 211}
    Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA
    Compression Method: 0
    %% Created: [Session-1, TLS_RSA_WITH_AES_128_CBC_SHA]
    ** TLS_RSA_WITH_AES_128_CBC_SHA
    Client Thread, READ: TLSv1 Handshake, length = 1903
    *** Certificate chain
    chain [0] = [
    Version: V3
    Subject: [email protected], CN=Employee, OU=default, O="default, Inc.", L=default, ST=AL, C=US
    Signature Algorithm: SHA1withRSA, OID = 1.2.840.113549.1.1.5
    Key: Sun RSA public key, 1024 bits
    modulus: 164546130673614659100546464587508805401937082626997447139358150641653094778762702643605529386963945060462618417820295217144739538713137107756847225226998964727905246706969036839701385553183842454061172884072035749790213037240682893878786969498404371282074360019097248835858617183835587887295684928062301303789
    public exponent: 65537
    Validity: [From: Tue Sep 12 09:49:12 CDT 2006,
                   To: Thu Oct 12 09:49:12 CDT 2006]
    Issuer: [email protected], CN=default Employee, OU=default, O="default, Inc.", L=default, ST=AL, C=US
    SerialNumber: [    b40b909f 74d167ab]
    Certificate Extensions: 4
    [1]: ObjectId: 2.16.840.1.113730.1.13 Criticality=false
    Extension unknown: DER encoded OCTET string =
    0000: 04 1F 16 1D 4F 70 65 6E 53 53 4C 20 47 65 6E 65 ....OpenSSL Gene
    0010: 72 61 74 65 64 20 43 65 72 74 69 66 69 63 61 74 rated Certificat
    0020: 65 e
    [2]: ObjectId: 2.5.29.14 Criticality=false
    SubjectKeyIdentifier [
    KeyIdentifier [
    0000: C8 EA 02 93 42 9E 44 D1 55 7D 2D 32 4B 9B 1C 6D ....B.D.U.-2K..m
    0010: 63 6B 73 82 cks.
    [3]: ObjectId: 2.5.29.35 Criticality=false
    AuthorityKeyIdentifier [
    KeyIdentifier [
    0000: 2C BC 66 DC 06 BA 62 79 3B 1A 20 92 E0 81 71 A0 ,.f...by;. ...q.
    0010: 0D 05 3C 95 ..<.
    [[email protected], CN=default Employee, OU=default, O="default, Inc.", L=default, ST=AL, C=US]
    SerialNumber: [    f6e3ada8 7dc4004f]
    [4]: ObjectId: 2.5.29.19 Criticality=false
    BasicConstraints:[
    CA:false
    PathLen: undefined
    Algorithm: [SHA1withRSA]
    Signature:
    0000: BF 60 5A 67 3E E6 F0 92 4F E4 81 6D 71 0A 2E E8 .`Zg>...O..mq...
    0010: F3 59 A1 87 7B D1 3A 7A CB FF D6 39 63 79 B6 82 .Y....:z...9cy..
    0020: 2A 22 D0 46 51 30 6B 2A 61 6B A0 4C F0 3B CE 5B *".FQ0k*ak.L.;.[
    0030: 9C 1D 46 CB D7 C2 B2 23 E2 A5 06 CD 12 F8 A9 CB ..F....#........
    0040: B5 A2 43 B1 06 4C 42 B5 67 F2 DF 50 6B BC 8A 5E ..C..LB.g..Pk..^
    0050: 95 0D F3 2A 73 A8 5A C8 55 77 D7 36 74 16 9E 05 ...*s.Z.Uw.6t...
    0060: 85 C6 DC 3C 44 D3 06 5E 47 0C 1F 80 40 30 C7 D8 ...<D..^G...@0..
    0070: 8C 27 FF B9 0C 71 EB D4 31 5C 1F 15 A1 23 6F A2 .'...q..1\...#o.
    chain [1] = [
    Version: V3
    Subject: [email protected], CN=default Employee, OU=default, O="default, Inc.", L=default, ST=AL, C=US
    Signature Algorithm: SHA1withRSA, OID = 1.2.840.113549.1.1.5
    Key: Sun RSA public key, 1024 bits
    modulus: 140862286957037297158683104484469503810921697537964422595574798580128510755934413463045842414762254029728885690233847950678735782281077619629628663140568366247472189890316085560712610474766899389736269383565795688749374256479726939861138704211990111677657317335172626254520371267441364353295155431963634875809
    public exponent: 65537
    Validity: [From: Tue Sep 12 09:40:32 CDT 2006,
                   To: Thu Oct 12 09:40:32 CDT 2006]
    Issuer: [email protected], CN=default Employee, OU=default, O="default, Inc.", L=default, ST=AL, C=US
    SerialNumber: [    f6e3ada8 7dc4004f]
    Certificate Extensions: 3
    [1]: ObjectId: 2.5.29.14 Criticality=false
    SubjectKeyIdentifier [
    KeyIdentifier [
    0000: 2C BC 66 DC 06 BA 62 79 3B 1A 20 92 E0 81 71 A0 ,.f...by;. ...q.
    0010: 0D 05 3C 95 ..<.
    [2]: ObjectId: 2.5.29.35 Criticality=false
    AuthorityKeyIdentifier [
    KeyIdentifier [
    0000: 2C BC 66 DC 06 BA 62 79 3B 1A 20 92 E0 81 71 A0 ,.f...by;. ...q.
    0010: 0D 05 3C 95 ..<.
    [[email protected], CN=default Employee, OU=default, O="default, Inc.", L=default, ST=AL, C=US]
    SerialNumber: [    f6e3ada8 7dc4004f]
    [3]: ObjectId: 2.5.29.19 Criticality=false
    BasicConstraints:[
    CA:true
    PathLen:2147483647
    Algorithm: [SHA1withRSA]
    Signature:
    0000: AB 84 38 1F 7B 71 D8 87 FF 24 DB C2 7E DC D0 0B ..8..q...$......
    0010: 60 60 14 A8 F8 D5 46 AD 6B FC 33 90 6F 43 08 17 ``....F.k.3.oC..
    0020: AE 2B EE 6C 2B 29 85 E2 A6 67 EE 5D A4 61 F3 9E .+.l+)...g.].a..
    0030: E7 CA B1 27 F9 11 36 ED 93 05 7B E1 20 90 57 B5 ...'..6..... .W.
    0040: C6 F9 8A 9D 50 CD B3 4A 54 DC 1B 52 EC EA 7A 0B ....P..JT..R..z.
    0050: B6 E6 95 FD DD 80 BE 66 F0 77 F4 E7 9A 8A A3 EF .......f.w......
    0060: 9B 68 57 0C 9C 4B 4C C0 24 C5 34 16 D3 8E 45 27 .hW..KL.$.4...E'
    0070: CA 23 F1 E0 C5 5E FB FB AA 1C 21 6E CB 5B 57 D9 .#...^....!n.[W.
    Found trusted certificate:
    Version: V3
    Subject: [email protected], CN=Employee, OU=default, O="default, Inc.", L=default, ST=AL, C=US
    Signature Algorithm: SHA1withRSA, OID = 1.2.840.113549.1.1.5
    Key: Sun RSA public key, 1024 bits
    modulus: 164546130673614659100546464587508805401937082626997447139358150641653094778762702643605529386963945060462618417820295217144739538713137107756847225226998964727905246706969036839701385553183842454061172884072035749790213037240682893878786969498404371282074360019097248835858617183835587887295684928062301303789
    public exponent: 65537
    Validity: [From: Tue Sep 12 09:49:12 CDT 2006,
                   To: Thu Oct 12 09:49:12 CDT 2006]
    Issuer: [email protected], CN=default Employee, OU=default, O="default, Inc.", L=default, ST=AL, C=US
    SerialNumber: [    b40b909f 74d167ab]
    Certificate Extensions: 4
    [1]: ObjectId: 2.16.840.1.113730.1.13 Criticality=false
    Extension unknown: DER encoded OCTET string =
    0000: 04 1F 16 1D 4F 70 65 6E 53 53 4C 20 47 65 6E 65 ....OpenSSL Gene
    0010: 72 61 74 65 64 20 43 65 72 74 69 66 69 63 61 74 rated Certificat
    0020: 65 e
    [2]: ObjectId: 2.5.29.14 Criticality=false
    SubjectKeyIdentifier [
    KeyIdentifier [
    0000: C8 EA 02 93 42 9E 44 D1 55 7D 2D 32 4B 9B 1C 6D ....B.D.U.-2K..m
    0010: 63 6B 73 82 cks.
    [3]: ObjectId: 2.5.29.35 Criticality=false
    AuthorityKeyIdentifier [
    KeyIdentifier [
    0000: 2C BC 66 DC 06 BA 62 79 3B 1A 20 92 E0 81 71 A0 ,.f...by;. ...q.
    0010: 0D 05 3C 95 ..<.
    [[email protected], CN=default Employee, OU=default, O="default, Inc.", L=default, ST=AL, C=US]
    SerialNumber: [    f6e3ada8 7dc4004f]
    [4]: ObjectId: 2.5.29.19 Criticality=false
    BasicConstraints:[
    CA:false
    PathLen: undefined
    Algorithm: [SHA1withRSA]
    Signature:
    0000: BF 60 5A 67 3E E6 F0 92 4F E4 81 6D 71 0A 2E E8 .`Zg>...O..mq...
    0010: F3 59 A1 87 7B D1 3A 7A CB FF D6 39 63 79 B6 82 .Y....:z...9cy..
    0020: 2A 22 D0 46 51 30 6B 2A 61 6B A0 4C F0 3B CE 5B *".FQ0k*ak.L.;.[
    0030: 9C 1D 46 CB D7 C2 B2 23 E2 A5 06 CD 12 F8 A9 CB ..F....#........
    0040: B5 A2 43 B1 06 4C 42 B5 67 F2 DF 50 6B BC 8A 5E ..C..LB.g..Pk..^
    0050: 95 0D F3 2A 73 A8 5A C8 55 77 D7 36 74 16 9E 05 ...*s.Z.Uw.6t...
    0060: 85 C6 DC 3C 44 D3 06 5E 47 0C 1F 80 40 30 C7 D8 ...<D..^G...@0..
    0070: 8C 27 FF B9 0C 71 EB D4 31 5C 1F 15 A1 23 6F A2 .'...q..1\...#o.
    Client Thread, READ: TLSv1 Handshake, length = 13
    *** CertificateRequest
    Cert Types: RSA, DSS,
    Cert Authorities:
    *** ServerHelloDone
    *** Certificate chain
    *** ClientKeyExchange, RSA PreMasterSecret, TLSv1
    Random Secret: { 3, 1, 27, 159, 38, 131, 132, 24, 47, 148, 161, 90, 7, 39, 189, 28, 178, 156, 20, 151, 220, 192, 239, 182, 115, 234, 99, 225, 68, 250, 199, 173, 96, 181, 78, 180, 238, 37, 243, 72, 19, 91, 249, 11, 49, 83, 1, 150 }
    Client Thread, WRITE: TLSv1 Handshake, length = 141
    SESSION KEYGEN:
    PreMaster Secret:
    0000: 03 01 1B 9F 26 83 84 18 2F 94 A1 5A 07 27 BD 1C ....&.../..Z.'..
    0010: B2 9C 14 97 DC C0 EF B6 73 EA 63 E1 44 FA C7 AD ........s.c.D...
    0020: 60 B5 4E B4 EE 25 F3 48 13 5B F9 0B 31 53 01 96 `.N..%.H.[..1S..
    CONNECTION KEYGEN:
    Client Nonce:
    0000: 45 09 62 F6 47 C3 B9 2C 56 60 0E 0B AB 4C 69 87 E.b.G..,V`...Li.
    0010: 88 72 35 36 89 4B CA FE 70 D0 F0 5B C7 F6 AF CF .r56.K..p..[....
    Server Nonce:
    0000: 45 09 62 F7 3F 5D 30 49 62 FB A0 D7 3D 6E F6 0C E.b.?]0Ib...=n..
    0010: 05 D1 5F C2 98 C1 00 B5 87 1A 96 AE 34 5C 38 FA .._.........4\8.
    Master Secret:
    0000: 0E 63 38 16 86 A1 84 72 33 2C D7 07 D7 C3 AC E0 .c8....r3,......
    0010: AD 5B CD 3B 2E 2A 02 91 1E FE 17 97 4E 3B 56 C3 .[.;.*......N;V.
    0020: 5D 0F 7A 99 90 0D 3D 4E 5F 39 C5 EB 6E AD DA 71 ].z...=N_9..n..q
    Client MAC write Secret:
    0000: 99 32 FA 60 0B 88 36 CD 88 02 D5 4A CA D2 A6 49 .2.`..6....J...I
    0010: 69 60 42 B6 i`B.
    Server MAC write Secret:
    0000: 43 3F 85 72 FB 6D 28 1C BA 1E 8A 26 56 DE 18 FB C?.r.m(....&V...
    0010: 01 83 20 7F .. .
    Client write key:
    0000: 6F 58 29 AB B3 8C F5 75 3C 70 04 DF 9D 01 43 F5 oX)....u<p....C.
    Server write key:
    0000: 4A D7 E9 63 53 32 78 DF E0 99 89 60 A4 1A 3C E7 J..cS2x....`..<.
    Client write IV:
    0000: 24 FB 0E 12 AB D2 70 6D 80 B1 B2 BC 78 1A 55 88 $.....pm....x.U.
    Server write IV:
    0000: E4 75 62 25 46 95 0F 7A 44 16 E2 39 38 AD 29 CD .ub%F..zD..98.).
    HawkEye Client Thread, WRITE: TLSv1 Change Cipher Spec, length = 1
    *** Finished
    verify_data: { 98, 254, 245, 75, 252, 23, 91, 164, 67, 197, 69, 44 }
    Client Thread, WRITE: TLSv1 Handshake, length = 48
    Client Thread, READ: TLSv1 Alert, length = 2
    Client Thread, RECV TLSv1 ALERT: fatal, handshake_failure
    Client Thread, called closeSocket()
    Client Thread, handling exception: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
    Error: Received fatal alert: handshake_failure
    Thread-4, handling exception: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure

  • Cisco ASA 5505 AnyConnect SSL VPN problem

    Hi!
    I have a small network, wiht ASA 5505, 8.4:
    Inside network: 192.168.2.0/24
    Outside: Static IP
    I would like to deploy a SSL AnyConnect setup.
    The state:
    -I give the correct IP from my predefined VPN pool (10.10.10.0/24).
    But, could not reach any resource, could not ping too. My host has given 10.10.10.1 IP, and I had a GW: 10.10.10.2. Where is this GW from?
    Could you help me?
    Here is my config (I omitted my PUBLIC IP, and GW): 
    Result of the command: "show running-config"
    : Saved
    ASA Version 8.4(4)1
    hostname valamiASA
    domain-name valami.local
    enable password OeyyCrIqfUEmzen8 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    switchport access vlan 12
    interface Vlan1
    description LAN
    no forward interface Vlan12
    nameif inside
    security-level 100
    ip address 192.168.2.1 255.255.255.0
    interface Vlan2
    description WAN
    nameif outside
    security-level 0
    ip address MY_STATIC_IP 255.255.255.248
    interface Vlan12
    description Vendegeknek a valamiHotSpot WiFi-hez
    nameif guest
    security-level 100
    ip address 192.168.4.1 255.255.255.0
    management-only
    ftp mode passive
    clock timezone GMT 0
    dns domain-lookup inside
    dns domain-lookup outside
    dns domain-lookup guest
    dns server-group DefaultDNS
    name-server 62.112.192.4
    name-server 195.70.35.66
    domain-name valami.local
    same-security-traffic permit intra-interface
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network inside-net
    subnet 192.168.2.0 255.255.255.0
    object network guest-net
    subnet 192.168.3.0 255.255.255.0
    object network NETWORK_OBJ_192.168.2.128_25
    subnet 192.168.2.128 255.255.255.128
    object-group protocol DM_INLINE_PROTOCOL_3
    protocol-object ip
    protocol-object icmp
    object-group protocol DM_INLINE_PROTOCOL_1
    protocol-object ip
    protocol-object icmp
    object-group protocol DM_INLINE_PROTOCOL_2
    protocol-object ip
    protocol-object icmp
    access-list global_access extended permit object-group DM_INLINE_PROTOCOL_3 any any
    access-list AnyConnect_Client_Local_Print extended deny ip any any
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq lpd
    access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 631
    access-list AnyConnect_Client_Local_Print remark Windows' printing port
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 9100
    access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.251 eq 5353
    access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Name Resolution protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.252 eq 5355
    access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 137
    access-list AnyConnect_Client_Local_Print extended permit udp any any eq netbios-ns
    access-list inside_access_in extended permit object-group DM_INLINE_PROTOCOL_2 any any
    access-list outside_access_in extended permit object-group DM_INLINE_PROTOCOL_1 any any
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    mtu guest 1500
    ip local pool valami_vpn_pool 10.10.10.1-10.10.10.10 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any inside
    no asdm history enable
    arp timeout 14400
    object network inside-net
    nat (inside,outside) dynamic interface
    object network guest-net
    nat (guest,outside) dynamic interface
    access-group inside_access_in in interface inside
    access-group outside_access_in in interface outside
    access-group global_access global
    route outside 0.0.0.0 0.0.0.0 MY_STATIC_GW 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa local authentication attempts max-fail 16
    http server enable
    http 192.168.2.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    telnet timeout 5
    ssh timeout 5
    ssh key-exchange group dh-group1-sha1
    console timeout 0
    dhcpd auto_config outside
    threat-detection basic-threat
    threat-detection statistics host
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    enable inside
    enable outside
    anyconnect-essentials
    anyconnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 1
    anyconnect enable
    tunnel-group-list enable
    group-policy GroupPolicy_valami_VPN internal
    group-policy GroupPolicy_valami_VPN attributes
    wins-server value 192.168.2.2
    dns-server value 192.168.2.2
    vpn-tunnel-protocol ssl-client
    split-tunnel-policy tunnelall
    default-domain value valami.local
    webvpn
      anyconnect ssl rekey time 30
      anyconnect ssl rekey method ssl
      anyconnect ask enable default anyconnect timeout 30
      customization none
      deny-message value Login was successful, but because certain criteria have not been met or due to some specific group policy, you do not have permission to use any of the VPN features. Contact your IT administrator for more information.
    username test password P4ttSyrm33SV8TYp encrypted
    tunnel-group valami_VPN type remote-access
    tunnel-group valami_VPN general-attributes
    address-pool valami_vpn_pool
    default-group-policy GroupPolicy_valami_VPN
    tunnel-group valami_VPN webvpn-attributes
    group-alias valami_VPN enable
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:d54de340bb6794d90a9ee52c69044753
    : end

    First of all thanks your link.
    I know your notes, but i don't understand 1 thing:
    if i check nat exemption in the anyconnect wizad, why should i make nat exemption rule?
    A tried creating a roule, but it is wrong.
    My steps (on ASDM):
    1: create network object (10.10.10.0/24), named VPN
    2: create nat rule: source any, destination VPN, protocol any
    Here is my config:
    Result of the command: "show running-config"
    : Saved
    ASA Version 8.4(4)1
    hostname companyASA
    domain-name company.local
    enable password OeyyCrIqfUEmzen8 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    switchport access vlan 12
    interface Vlan1
    description LAN
    no forward interface Vlan12
    nameif inside
    security-level 100
    ip address 192.168.2.1 255.255.255.0
    interface Vlan2
    description WAN
    nameif outside
    security-level 0
    ip address 77.111.103.106 255.255.255.248
    interface Vlan12
    description Vendegeknek a companyHotSpot WiFi-hez
    nameif guest
    security-level 100
    ip address 192.168.4.1 255.255.255.0
    ftp mode passive
    clock timezone CEST 1
    clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
    dns domain-lookup inside
    dns domain-lookup outside
    dns domain-lookup guest
    dns server-group DefaultDNS
    name-server 62.112.192.4
    name-server 195.70.35.66
    domain-name company.local
    same-security-traffic permit intra-interface
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network inside-net
    subnet 192.168.2.0 255.255.255.0
    object network guest-net
    subnet 192.168.3.0 255.255.255.0
    object network NETWORK_OBJ_192.168.2.128_25
    subnet 192.168.2.128 255.255.255.128
    object network WEBSHOP
    host 192.168.2.2
    object network INSIDE_HOST
    host 10.100.130.5
    object network VOIP_management
    host 192.168.2.215
    object network Dev_1
    host 192.168.2.2
    object network Dev_2
    host 192.168.2.2
    object network RDP
    host 192.168.2.2
    object network Mediasa
    host 192.168.2.17
    object network VOIP_ePhone
    host 192.168.2.215
    object network NETWORK_OBJ_192.168.4.0_28
    subnet 192.168.4.0 255.255.255.240
    object network NETWORK_OBJ_10.10.10.8_29
    subnet 10.10.10.8 255.255.255.248
    object network VPN
    subnet 10.10.10.0 255.255.255.0
    object network VPN-internet
    subnet 10.10.10.0 255.255.255.0
    object-group protocol DM_INLINE_PROTOCOL_3
    protocol-object ip
    protocol-object icmp
    object-group protocol DM_INLINE_PROTOCOL_1
    protocol-object ip
    protocol-object icmp
    object-group protocol DM_INLINE_PROTOCOL_2
    protocol-object ip
    protocol-object icmp
    access-list global_access extended permit object-group DM_INLINE_PROTOCOL_3 any any
    access-list AnyConnect_Client_Local_Print extended deny ip any any
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq lpd
    access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 631
    access-list AnyConnect_Client_Local_Print remark Windows' printing port
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 9100
    access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.251 eq 5353
    access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Name Resolution protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.252 eq 5355
    access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 137
    access-list AnyConnect_Client_Local_Print extended permit udp any any eq netbios-ns
    access-list inside_access_in extended permit object-group DM_INLINE_PROTOCOL_2 any any
    access-list outside_access_in extended permit object-group DM_INLINE_PROTOCOL_1 any any
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    mtu guest 1500
    ip local pool company_vpn_pool 10.10.10.10-10.10.10.15 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any inside
    no asdm history enable
    arp timeout 14400
    nat (any,any) source static any any destination static VPN VPN
    nat (inside,outside) source static inside-net inside-net destination static VPN VPN
    object network inside-net
    nat (inside,outside) dynamic interface
    object network guest-net
    nat (guest,outside) dynamic interface
    access-group inside_access_in in interface inside
    access-group outside_access_in in interface outside
    access-group global_access global
    route outside 0.0.0.0 0.0.0.0 77.111.103.105 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa local authentication attempts max-fail 16
    http server enable
    http 192.168.2.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    telnet timeout 5
    ssh timeout 5
    ssh key-exchange group dh-group1-sha1
    console timeout 0
    dhcpd auto_config outside
    threat-detection basic-threat
    threat-detection statistics host
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    enable inside
    enable outside
    anyconnect-essentials
    anyconnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 1
    anyconnect enable
    tunnel-group-list enable
    group-policy GroupPolicy_company_VPN internal
    group-policy GroupPolicy_company_VPN attributes
    wins-server value 192.168.2.2
    dns-server value 192.168.2.2
    vpn-tunnel-protocol l2tp-ipsec
    split-tunnel-policy tunnelall
    default-domain value company.local
    webvpn
      anyconnect ssl rekey time 30
      anyconnect ssl rekey method ssl
      anyconnect ask enable default anyconnect timeout 30
      customization none
      deny-message value Login was successful, but because certain criteria have not been met or due to some specific group policy, you do not have permission to use any of the VPN features. Contact your IT administrator for more information.
    group-policy GroupPolicy_VPN internal
    group-policy GroupPolicy_VPN attributes
    wins-server none
    dns-server value 62.112.192.4 195.70.35.66
    vpn-tunnel-protocol ssl-client
    default-domain value company.local
    username test password P4ttSyrm33SV8TYp encrypted
    tunnel-group company_VPN type remote-access
    tunnel-group company_VPN general-attributes
    address-pool company_vpn_pool
    default-group-policy GroupPolicy_company_VPN
    tunnel-group company_VPN webvpn-attributes
    group-alias company_VPN enable
    tunnel-group VPN type remote-access
    tunnel-group VPN general-attributes
    address-pool company_vpn_pool
    default-group-policy GroupPolicy_VPN
    tunnel-group VPN webvpn-attributes
    group-alias VPN enable
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
      inspect icmp
      inspect icmp error
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:33ee37a3722f228f9be9b84ef43f731e
    : end
    Could you give me a CLI-code?
    (or ASDM steps).

  • ASA 5505 8.2 - SSL VPN - Cannot Ping inside host's

    Hello All,
    I'm an ASA Newb. 
    I feel like I have tried everything posted and still no success.
    PROBLEM:  When connected to the SSL VPN I cannot ping any internal host's.  I cannot ping anything on this inside?
    Result of the command: "show running-config"
    : Saved
    ASA Version 8.2(5)
    hostname MCASA01
    domain-name mydomain.org
    enable password xxbtzv6P4Hqevn4N encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    name 192.168.2.0 VLAN
    name 192.168.5.0 VPNPOOL
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    switchport access vlan 3
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 100
    ddns update hostname MC_DNS
    dhcp client update dns server both
    ip address 192.168.1.1 255.255.255.0
    interface Vlan2
    no forward interface Vlan1
    nameif outside
    security-level 0
    ip address 11.11.11.202 255.255.255.252
    interface Vlan3
    no nameif
    security-level 50
    ip address 192.168.2.1 255.255.255.0
    ftp mode passive
    clock timezone PST -8
    clock summer-time PDT recurring
    dns server-group DefaultDNS
    domain-name mydomain.org
    access-list SPLIT-TUNNEL standard permit 192.168.1.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    ip local pool VPNPOOL 192.168.5.1-192.168.5.10 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 1 0.0.0.0 0.0.0.0
    route outside 0.0.0.0 0.0.0.0 74.7.217.201 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa authentication ssh console LOCAL
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    http 0.0.0.0 0.0.0.0 outside
    http authentication-certificate inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto ca trustpoint ASDM_TrustPoint0
    enrollment terminal
    subject-name CN=vpn.mydomain.org,OU=IT,O="mydomain",C=US,St=CA,L=Chino
    keypair digicert.key
    crl configure
    crypto ca certificate chain ASDM_TrustPoint0
    certificate 00b63edadf5efa057ea49da56b179132e8
        3082051c 30820404 a0030201 02021100 b63edadf 5efa057e a49da56b 179132e8
        300d0609 2a864886 f70d0101 05050030 72310b30 09060355 04061302 4742311b
        30190603 55040813 12477265 61746572 204d616e 63686573 74657231 10300e06
        03550407 13075361 6c666f72 64311a30 18060355 040a1311 434f4d4f 444f2043
        41204c69 6d697465 64311830 16060355 0403130f 45737365 6e746961 6c53534c
        20434130 1e170d31 33313130 35303030 3030305a 170d3134 30323033 32333539
        35395a30 52312130 1f060355 040b1318 446f6d61 696e2043 6f6e7472 6f6c2056
        616c6964 61746564 3111300f 06035504 0b130846 72656520 53534c31 1a301806
        03550403 13117670 6e2e6d65 74726f63 656c6c2e 6f726730 82012230 0d06092a
        864886f7 0d010101 05000382 010f0030 82010a02 82010100 a0d97d51 fcd18293
        eaf8e9b2 d632b2e3 e4d92eb1 5b639766 52677a26 2aa7d09d 437be3b6 dfb8649c
        4d715278 e1745955 27e8aab2 9c9da997 694a73e8 c1c426f3 a519adba acc2ad94
        aa0e09af 6db7bfc6 bad90bf2 b057dc56 c69a4276 1b826c83 6cd7ae09 af39bd7d
        4abe60b4 9b04613a 287a1ae6 9d117d05 c7cdc15f 09d588b0 fcc05c47 c1cb6d67
        c3701389 d3b7691d b05ff82c b0be475d 746a4916 0bbf11a6 7ee1b7ec bd05e1d2
        dda305a6 918bfd35 17447b04 bca1e6d9 10955649 d8211878 168c4c21 279a6584
        4b560a9f 414aea15 91e21581 a71d6b98 86d9eac3 47ea3a1d a172c71a ecf77aaa
        536d73e4 bc53eb68 c7bfacdd fab87ea5 121baf55 067dbd19 02030100 01a38201
        cb308201 c7301f06 03551d23 04183016 8014dacb eaad5b08 5dccfffc 2654ce49
        e555c638 f4f8301d 0603551d 0e041604 14fabb1d f439c41f e59207c7 202c2fda
        b46bcacc ee300e06 03551d0f 0101ff04 04030205 a0300c06 03551d13 0101ff04
        02300030 34060355 1d25042d 302b0608 2b060105 05070301 06082b06 01050507
        0302060a 2b060104 0182370a 03030609 60864801 86f84204 01304f06 03551d20
        04483046 303a060b 2b060104 01b23101 02020730 2b302906 082b0601 05050702
        01161d68 74747073 3a2f2f73 65637572 652e636f 6d6f646f 2e636f6d 2f435053
        30080606 67810c01 0201303b 0603551d 1f043430 323030a0 2ea02c86 2a687474
        703a2f2f 63726c2e 636f6d6f 646f6361 2e636f6d 2f457373 656e7469 616c5353
        4c43412e 63726c30 6e06082b 06010505 07010104 62306030 3806082b 06010505
        07300286 2c687474 703a2f2f 6372742e 636f6d6f 646f6361 2e636f6d 2f457373
        656e7469 616c5353 4c43415f 322e6372 74302406 082b0601 05050730 01861868
        7474703a 2f2f6f63 73702e63 6f6d6f64 6f63612e 636f6d30 33060355 1d11042c
        302a8211 76706e2e 6d657472 6f63656c 6c2e6f72 67821577 77772e76 706e2e6d
        6574726f 63656c6c 2e6f7267 300d0609 2a864886 f70d0101 05050003 82010100
        2484b72c 56161585 c9caa1a3 43cbc754 d3b43cef 7902a775 d40d064f 6918d52f
        0aaaea0c ad873124 11b68847 406812da fd0c5d71 6e110898 1ebddcab ddf980e4
        b95be4e2 0633cc23 7a4cbc27 f1f5e4e8 1de3c127 2b28a364 f1f26764 98afe871
        45547855 c0ceaf39 256f46db 4ac412a7 2b594817 a967ba5a 24986b24 57002ce4
        f046c6b3 5f7c9cc2 e6cd8ede 8fbcac60 b87fd497 71328783 8b148f7f affec249
        191c460b 3d46d352 0651f35e 96a60fbe 7b22e057 06aa7722 da447cd3 0ea72e7f
        5ec8c13c b550f502 b020efdc 35f62b89 52d7e6e3 14ade632 802dee70 1cdbf7ad
        a39a173b 916406e4 887ba623 4813b925 8a63a300 fd016981 a8d70651 a736267a
      quit
    no crypto isakmp nat-traversal
    telnet timeout 5
    ssh 192.168.1.0 255.255.255.0 inside
    ssh 0.0.0.0 0.0.0.0 outside
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside vpnclient-wins-override
    dhcpd address 192.168.1.100-192.168.1.200 inside
    dhcpd dns 66.180.96.12 64.238.96.12 interface inside
    dhcpd lease 86400 interface inside
    dhcpd ping_timeout 4000 interface inside
    dhcpd domain mydomain.org interface inside
    threat-detection basic-threat
    threat-detection statistics access-list
    threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
    ntp server 64.147.116.229 source outside
    ssl trust-point ASDM_TrustPoint0 outside
    webvpn
    enable outside
    svc image disk0:/anyconnect-win-2.5.2014-k9.pkg 1
    svc enable
    tunnel-group-list enable
    group-policy DfltGrpPolicy attributes
    vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
    group-policy VPNGP internal
    group-policy VPNGP attributes
    vpn-tunnel-protocol svc
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value SPLIT-TUNNEL
    username GaryC password TGbvzEO3d6HlfU66 encrypted privilege 15
    username GaryC attributes
    vpn-group-policy VPNGP
    tunnel-group MCVPN type remote-access
    tunnel-group MCVPN general-attributes
    address-pool VPNPOOL
    default-group-policy VPNGP
    tunnel-group MCVPN webvpn-attributes
    group-alias MCVPN enable
    group-url https://11.11.11.202/MCVPN enable
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:1e950c041cc2c25116d30e5c884abbfc
    : end
    My goal is to allow Remote Users to RDP(3389) through VPN.
    Thank you,
    Gary
    Message was edited by: Gary Culwell

    Hello Jon,
      Thank you so much for your response. Clients will not be connect to a specific RDP server.  I was hoping if we were to establish a VPN Client tunnel I would like that tunnel to provide full local are access.  So the way the clients are used to is while in the field they use RDP to connect to their desktops on the internal LAN.
    Would you say this would work:
    route inside 192.168.1.0 255.255.255.0 192.168.1.1 1
    Do you have examples?
    Thank you,
    Gary

  • Enabling SSL through Net Manger is not working !!!!!!!

    When configuring SSL in the "Oracle net manager"
    1) Should the Service Name also be TCP/IP with SSL or just the Listener
    Steps I followed:
    1) Created a wallet in [READY] mode
    2) configured *ora files through net manager
    3) Restarted the listner
    listener.ora:
    ===========
    SSL_CLIENT_AUTHENTICATION = FALSE
    WALLET_LOCATION =
    (SOURCE =
    (METHOD = FILE)
    (METHOD_DATA =
    (DIRECTORY = C:\oracle\db\11g\11.1.0\db_2\admin\orcl\wallet)
    LISTENER =
    (DESCRIPTION_LIST =
    (DESCRIPTION =
    (ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC1521))
    (DESCRIPTION =
    (ADDRESS = (PROTOCOL = TCPS)(HOST = kcr-PC)(PORT = 2484))
    TRACE_LEVEL_LISTENER = ADMIN
    tnsname.ora:
    ===========
    ORCL =
    (DESCRIPTION =
    (ADDRESS_LIST =
    (ADDRESS = (PROTOCOL = TCP)(HOST = kcr-PC)(PORT = 1521)) // I have trried (PROTOCOL = TCPS) doesn't work
    (CONNECT_DATA =
    (SERVER = DEDICATED)
    (SERVICE_NAME = orcl)
    sqlnet.ora:
    ===========
    SQLNET.AUTHENTICATION_SERVICES= (BEQ, TCPS, NTS)
    SSL_VERSION = 0
    NAMES.DIRECTORY_PATH= (TNSNAMES, EZCONNECT)
    SSL_CLIENT_AUTHENTICATION = FALSE
    WALLET_LOCATION =
    (SOURCE =
    (METHOD = FILE)
    (METHOD_DATA =
    (DIRECTORY = C:\oracle\db\11g\11.1.0\db_2\admin\orcl\wallet)
    SSL_CIPHER_SUITES= (SSL_RSA_EXPORT_WITH_RC4_40_MD5, SSL_RSA_EXPORT_WITH_DES40_CBC_SHA)
    Log file output
    listener.log
    ==========
    Wed Sep 15 14:08:30 2010
    15-SEP-2010 14:08:30 * (CONNECT_DATA=(CID=(PROGRAM=)(HOST=)(USER=kcr))(COMMAND=status)(ARGUMENTS=64)(SERVICE=LISTENER)(VERSION=185599744)) * status * 0
    No longer listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(PIPENAME=\\.\pipe\EXTPROC1521ipc)))
    No longer listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=tcps)(HOST=kcr-PC)(PORT=2484)))
    Listener completed notification to CRS on stop
    15-SEP-2010 14:08:32 * (CONNECT_DATA=(CID=(PROGRAM=)(HOST=)(USER=kcr))(COMMAND=stop)(ARGUMENTS=64)(SERVICE=LISTENER)(VERSION=185599744)) * stop * 0
    Wed Sep 15 14:13:13 2010
    System parameter file is C:\oracle\db\11g\11.1.0\db_2\network\admin\listener.ora
    Log messages written to c:\oracle\db\11g\diag\tnslsnr\kcr-PC\listener\alert\log.xml
    Trace information written to c:\oracle\db\11g\diag\tnslsnr\kcr-PC\listener\trace\ora_2192_3556.trc
    Trace level is currently 6
    Started with pid=2192
    Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(PIPENAME=\\.\pipe\EXTPROC1521ipc)))
    Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=tcps)(HOST=kcr-PC)(PORT=2484)))
    Listener completed notification to CRS on start
    TIMESTAMP * CONNECT DATA [* PROTOCOL INFO] * EVENT [* SID] * RETURN CODE
    15-SEP-2010 14:13:18 * (CONNECT_DATA=(CID=(PROGRAM=)(HOST=)(USER=kcr))(COMMAND=status)(ARGUMENTS=64)(SERVICE=LISTENER)(VERSION=185599744)) * status * 0
    Wed Sep 15 14:13:30 2010
    15-SEP-2010 14:13:30 * (CONNECT_DATA=(CID=(PROGRAM=)(HOST=)(USER=kcr))(COMMAND=status)(ARGUMENTS=64)(SERVICE=LISTENER)(VERSION=185599744)) * status * 0
    Wed Sep 15 14:16:18 2010
    15-SEP-2010 14:16:18 * (CONNECT_DATA=(CID=(PROGRAM=)(HOST=)(USER=kcr))(COMMAND=status)(ARGUMENTS=64)(SERVICE=LISTENER)(VERSION=185599744)) * status * 0
    listener.log
    ==========
    Wed Sep 15 14:08:30 2010
    15-SEP-2010 14:08:30 * (CONNECT_DATA=(CID=(PROGRAM=)(HOST=)(USER=kcr))(COMMAND=status)(ARGUMENTS=64)(SERVICE=LISTENER)(VERSION=185599744)) * status * 0
    No longer listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(PIPENAME=\\.\pipe\EXTPROC1521ipc)))
    No longer listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=tcps)(HOST=kcr-PC)(PORT=2484)))
    Listener completed notification to CRS on stop
    15-SEP-2010 14:08:32 * (CONNECT_DATA=(CID=(PROGRAM=)(HOST=)(USER=kcr))(COMMAND=stop)(ARGUMENTS=64)(SERVICE=LISTENER)(VERSION=185599744)) * stop * 0
    Wed Sep 15 14:13:13 2010
    System parameter file is C:\oracle\db\11g\11.1.0\db_2\network\admin\listener.ora
    Log messages written to c:\oracle\db\11g\diag\tnslsnr\kcr-PC\listener\alert\log.xml
    Trace information written to c:\oracle\db\11g\diag\tnslsnr\kcr-PC\listener\trace\ora_2192_3556.trc
    Trace level is currently 6
    Started with pid=2192
    Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(PIPENAME=\\.\pipe\EXTPROC1521ipc)))
    Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=tcps)(HOST=kcr-PC)(PORT=2484)))
    Listener completed notification to CRS on start
    TIMESTAMP * CONNECT DATA [* PROTOCOL INFO] * EVENT [* SID] * RETURN CODE
    15-SEP-2010 14:13:18 * (CONNECT_DATA=(CID=(PROGRAM=)(HOST=)(USER=kcr))(COMMAND=status)(ARGUMENTS=64)(SERVICE=LISTENER)(VERSION=185599744)) * status * 0
    Wed Sep 15 14:13:30 2010
    15-SEP-2010 14:13:30 * (CONNECT_DATA=(CID=(PROGRAM=)(HOST=)(USER=kcr))(COMMAND=status)(ARGUMENTS=64)(SERVICE=LISTENER)(VERSION=185599744)) * status * 0
    Wed Sep 15 14:16:18 2010
    15-SEP-2010 14:16:18 * (CONNECT_DATA=(CID=(PROGRAM=)(HOST=)(USER=kcr))(COMMAND=status)(ARGUMENTS=64)(SERVICE=LISTENER)(VERSION=185599744)) * status * 0
    Trace log:
    =========
    Trace file c:\oracle\db\11g\diag\tnslsnr\kcr-PC\listener\trace\ora_2192_3556.trc
    TNSLSNR for 32-bit Windows: Version 11.1.0.7.0 - Production on 15-SEP-2010 14:13:13
    Copyright (c) 1991, 2008, Oracle. All rights reserved.
    2010-09-15 14:13:13.706315 : --- TRACE CONFIGURATION INFORMATION FOLLOWS ---
    2010-09-15 14:13:13.706426 : New trace stream is c:\oracle\db\11g\diag\tnslsnr\kcr-PC\listener\trace\ora_2192_3556.trc
    2010-09-15 14:13:13.706493 : New trace level is 6
    2010-09-15 14:13:13.706556 : --- TRACE CONFIGURATION INFORMATION ENDS ---
    2010-09-15 14:13:13.706621 : --- PARAMETER SOURCE INFORMATION FOLLOWS ---
    2010-09-15 14:13:13.706767 : Attempted load of system pfile source C:\oracle\db\11g\11.1.0\db_2\network\admin\listener.ora
    2010-09-15 14:13:13.706822 : Parameter source loaded successfully
    2010-09-15 14:13:13.706869 :
    2010-09-15 14:13:13.706914 : Attempted load of command line source
    2010-09-15 14:13:13.706961 : Parameter source was not loaded
    2010-09-15 14:13:13.707006 :
    2010-09-15 14:13:13.707051 : -> PARAMETER TABLE LOAD RESULTS FOLLOW <-
    2010-09-15 14:13:13.707098 : Successful parameter table load
    2010-09-15 14:13:13.707148 : -> PARAMETER TABLE HAS THE FOLLOWING CONTENTS <-
    2010-09-15 14:13:13.707198 : LISTENER = (DESCRIPTION_LIST = (DESCRIPTION = (ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC1521))) (DESCRIPTION = (ADDRESS = (PROTOCOL = TCPS)(HOST = kcr-PC)(PORT = 2484))))
    2010-09-15 14:13:13.707250 : SSL_CLIENT_AUTHENTICATION = FALSE
    2010-09-15 14:13:13.707297 : TRACE_LEVEL_LISTENER = ADMIN
    2010-09-15 14:13:13.707344 : WALLET_LOCATION = (SOURCE = (METHOD = FILE) (METHOD_DATA = (DIRECTORY = C:\oracle\db\11g\11.1.0\db_2\admin\orcl\wallet)))
    2010-09-15 14:13:13.707394 : --- PARAMETER SOURCE INFORMATION ENDS ---
    2010-09-15 14:13:13.707447 : --- LOG CONFIGURATION INFORMATION FOLLOWS ---
    2010-09-15 14:13:13.707520 : Log stream will be "c:\oracle\db\11g\diag\tnslsnr\kcr-PC\listener\alert\log.xml"
    2010-09-15 14:13:13.707570 : Log stream validation not requested
    2010-09-15 14:13:13.707617 : --- LOG CONFIGURATION INFORMATION ENDS ---
    2010-09-15 14:13:13.707672 : nlstdipi:entry
    2010-09-15 14:13:13.708416 : nlstdipi:exit
    2010-09-15 14:13:13.713189 : nsglldprm:Resolved "INBOUND_CONNECT_TIMEOUT_LISTENER" to: 60
    2010-09-15 14:13:13.713270 : nsglldprm:Resolved "STARTUP_WAIT_TIME_LISTENER" to: 0
    2010-09-15 14:13:13.713356 : nsglldprm:LocalOSauth enabled
    2010-09-15 14:13:13.713407 : nsglldprm:No Default Service Configured for LISTENER
    2010-09-15 14:13:13.714149 : nsinherit:doing connect handshake...
    2010-09-15 14:13:13.714227 : nsinh_hoff:ADR="(ADDRESS=(PROTOCOL=beq))"
    2010-09-15 14:13:13.714282 : nsc2addr:(ADDRESS=(PROTOCOL=beq))
    2010-09-15 14:13:13.715334 : nlpcaini:entry
    2010-09-15 14:13:13.715415 : nlpcaini:No process parameters set
    2010-09-15 14:13:13.715468 : nlpcaini:exit
    2010-09-15 14:13:13.715522 : nsinh_hoff:inheriting the connection...
    2010-09-15 14:13:13.715601 : nsmal:996 bytes at 0x1e048e0
    2010-09-15 14:13:13.715667 : nsmal:2096 bytes at 0x1e04cd0
    2010-09-15 14:13:13.715737 : nsmal:84 bytes at 0x1e05640
    2010-09-15 14:13:13.715902 : nsopen:opening transport...
    2010-09-15 14:13:13.715938 : ntpcon:entry
    2010-09-15 14:13:13.715966 : ntpcon:toc = 6
    2010-09-15 14:13:13.715992 : ntpcon:exit
    2010-09-15 14:13:13.716018 : ntpcon:entry
    2010-09-15 14:13:13.716044 : ntpcon:toc = 4
    2010-09-15 14:13:13.716075 : sntpinherit:entry
    2010-09-15 14:13:13.716176 : sntpinherit:Attempting to make pipe \\.\PIPE\ORANTP890.DE4.w
    2010-09-15 14:13:13.716245 : sntpinherit:Listening on pipe \\.\PIPE\ORANTP890.DE4.w
    2010-09-15 14:13:13.716277 : sntpinherit:Attempting to make pipe \\.\PIPE\ORANTP890.DE4
    2010-09-15 14:13:13.716328 : sntpinherit:Listening on pipe \\.\PIPE\ORANTP890.DE4
    2010-09-15 14:13:15.633322 : sntpinherit:Successfully established pipe 508 to parent.
    2010-09-15 14:13:15.633435 : sntpinherit:Successfully established pipe 504 to parent.
    2010-09-15 14:13:15.633476 : sntpinherit:exit
    2010-09-15 14:13:15.633508 : ntpcon:NT layer IPC connection has been established.
    2010-09-15 14:13:15.633645 : ntpcon:exit
    2010-09-15 14:13:15.633683 : nsopen:transport is open
    2010-09-15 14:13:15.633719 : nsoptions:lcl[0]=0x0, lcl[1]=0x0, gbl[0]=0x0, gbl[1]=0x0, cha=0x0
    2010-09-15 14:13:15.633752 : nsoptions:lcl[0]=0xf4ffefff, lcl[1]=0x0, gbl[0]=0x78bf, gbl[1]=0x0
    2010-09-15 14:13:15.633799 : nsnainit:inherit
    2010-09-15 14:13:15.633834 : nsnasvnainfo:NA disabled for this connection
    2010-09-15 14:13:15.633872 : nainit:entry
    2010-09-15 14:13:15.633910 : nagblini:entry
    2010-09-15 14:13:15.633953 : nau_gin:entry
    2010-09-15 14:13:15.633987 : nau_gparams:entry
    2010-09-15 14:13:15.634020 : nam_gbp:Reading parameter "sqlnet.authentication_required" from parameter file
    2010-09-15 14:13:15.634053 : nam_gbp:Parameter not found
    2010-09-15 14:13:15.634084 : nau_gparams:Using default value "FALSE"
    2010-09-15 14:13:15.634115 : nau_gslf:entry
    2010-09-15 14:13:15.634145 : nam_gic:entry
    2010-09-15 14:13:15.634174 : nam_gic:Counting # of items in "sqlnet.authentication_services" parameter
    2010-09-15 14:13:15.634208 : nam_gic:Parameter not found
    2010-09-15 14:13:15.634236 : nam_gic:Found 0 items
    2010-09-15 14:13:15.634263 : nam_gic:exit
    2010-09-15 14:13:15.634290 : nau_gslf:Using default value "all available adapters"
    2010-09-15 14:13:15.634321 : nauss_set_state:entry
    2010-09-15 14:13:15.634348 : nauss_set_state:exit
    2010-09-15 14:13:15.634377 : nau_gslf:exit
    2010-09-15 14:13:15.634404 : nau_gparams:exit
    2010-09-15 14:13:15.634430 : nau_gin:exit
    2010-09-15 14:13:15.634457 : nagblini:exit
    2010-09-15 14:13:15.634489 : na_saveprot:entry
    2010-09-15 14:13:15.634518 : na_saveprot:exit
    2010-09-15 14:13:15.634549 : nacomin:entry
    2010-09-15 14:13:15.634582 : nas_init:entry
    2010-09-15 14:13:15.634611 : nas_init:exit
    2010-09-15 14:13:15.634645 : nau_ini:entry
    2010-09-15 14:13:15.634674 : naugcp_get_connect_parameters:entry
    2010-09-15 14:13:15.634702 : nauss_set_state:entry
    2010-09-15 14:13:15.634728 : nauss_set_state:exit
    2010-09-15 14:13:15.634755 : naugcp_get_connect_parameters:exit
    2010-09-15 14:13:15.634785 : nau_gettab:entry
    2010-09-15 14:13:15.634840 : nau_gettab:exit
    2010-09-15 14:13:15.634868 : nau_sini:entry
    2010-09-15 14:13:15.634895 : nau_sini:exit
    2010-09-15 14:13:15.634927 : nau_ini:exit
    2010-09-15 14:13:15.634959 : naeeinit:entry
    2010-09-15 14:13:15.634992 : nam_gbp:Reading parameter "SQLNET.FIPS_140" from parameter file
    2010-09-15 14:13:15.635022 : nam_gbp:Parameter not found
    2010-09-15 14:13:15.635055 : nam_gnsp:Reading parameter "SQLNET.ENCRYPTION_SERVER" from parameter file
    2010-09-15 14:13:15.635088 : nam_gnsp:Parameter not found
    2010-09-15 14:13:15.635119 : naequad:Using default value "ACCEPTED"
    2010-09-15 14:13:15.635147 : nam_gic:entry
    2010-09-15 14:13:15.635174 : nam_gic:Counting # of items in "SQLNET.ENCRYPTION_TYPES_SERVER" parameter
    2010-09-15 14:13:15.635205 : nam_gic:Parameter not found
    2010-09-15 14:13:15.635232 : nam_gic:exit
    2010-09-15 14:13:15.635259 : naesno:Using default value "all available algorithms"
    2010-09-15 14:13:15.635290 : naeshow:entry
    2010-09-15 14:13:15.635409 : naeshow:exit
    2010-09-15 14:13:15.635439 : naeeinit:exit
    2010-09-15 14:13:15.635469 : naecinit:entry
    2010-09-15 14:13:15.635498 : nam_gnsp:Reading parameter "SQLNET.CRYPTO_CHECKSUM_SERVER" from parameter file
    2010-09-15 14:13:15.635530 : nam_gnsp:Parameter not found
    2010-09-15 14:13:15.635557 : naequad:Using default value "ACCEPTED"
    2010-09-15 14:13:15.635584 : nam_gic:entry
    2010-09-15 14:13:15.635611 : nam_gic:Counting # of items in "SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER" parameter
    2010-09-15 14:13:15.635643 : nam_gic:Parameter not found
    2010-09-15 14:13:15.635669 : nam_gic:exit
    2010-09-15 14:13:15.635696 : naesno:Using default value "all available algorithms"
    2010-09-15 14:13:15.635724 : naeshow:entry
    2010-09-15 14:13:15.635750 : naeshow:exit
    2010-09-15 14:13:15.635776 : naecinit:exit
    2010-09-15 14:13:15.635868 : nadisc:entry
    2010-09-15 14:13:15.635903 : nacomtm:entry
    2010-09-15 14:13:15.635932 : nacompd:entry
    2010-09-15 14:13:15.635959 : nacompd:exit
    2010-09-15 14:13:15.635985 : nacompd:entry
    2010-09-15 14:13:15.636074 : nacompd:exit
    2010-09-15 14:13:15.636103 : nacomtm:exit
    2010-09-15 14:13:15.636134 : nas_dis:entry
    2010-09-15 14:13:15.636161 : nas_dis:exit
    2010-09-15 14:13:15.636193 : nau_dis:entry
    2010-09-15 14:13:15.636222 : nau_dis:exit
    2010-09-15 14:13:15.636251 : naeetrm:entry
    2010-09-15 14:13:15.636278 : naeetrm:exit
    2010-09-15 14:13:15.636307 : naectrm:entry
    2010-09-15 14:13:15.636336 : naectrm:exit
    2010-09-15 14:13:15.636365 : nagbltrm:entry
    2010-09-15 14:13:15.636397 : nau_gtm:entry
    2010-09-15 14:13:15.636423 : nau_gtm:exit
    2010-09-15 14:13:15.636450 : nagbltrm:exit
    2010-09-15 14:13:15.636477 : nadisc:exit
    2010-09-15 14:13:15.636503 : nainit:exit
    2010-09-15 14:13:15.636531 : nsnainit:NS Connection version: 314
    2010-09-15 14:13:15.636565 : nsnainit:inf->nsinfflg[0]: 0xd inf->nsinfflg[1]: 0xd
    2010-09-15 14:13:15.636601 : nsnainit:"or" info flags: 0xd     Translations follow:
         native service(s) is (are) wanted
         NA disabled remotely for this connection
         NA services unavailable on both processes - negotiation not needed
    2010-09-15 14:13:15.636643 : nsnainit:"or" info flags: 0xd     Translations follow:
         native service(s) is (are) wanted
         NA disabled remotely for this connection
         NA services unavailable on both processes - negotiation not needed
    "and" info flags: 0xd     Translations follow:
         native service(s) is (are) wanted
         NA disabled remotely for this connection
         NA services unavailable on both processes - negotiation not needed
    2010-09-15 14:13:15.636697 : nsopen:global context check-in (to slot 0) complete
    2010-09-15 14:13:15.636732 : nsopen:lcl[0]=0xf4ffefff, lcl[1]=0x0, gbl[0]=0x78bf, gbl[1]=0x0, tdu=4096, sdu=8192
    2010-09-15 14:13:15.636773 : nsfull_opn:cid=0, opcode=65, bl=0, what=0, uflgs=0x0, cflgs=0x0
    2010-09-15 14:13:15.636805 : nsfull_opn:nsctx: state=7, flg=0x4000, mvd=0
    2010-09-15 14:13:15.636841 : nsmal:84 bytes at 0x1e07da8
    2010-09-15 14:13:15.636892 : nsmal:84 bytes at 0x1e09e28
    2010-09-15 14:13:15.636948 : nsdo:cid=0, opcode=68, bl=0, what=8, uflgs=0x0, cflgs=0x3
    2010-09-15 14:13:15.636983 : nsdo:rank=64, nsctxrnk=0
    2010-09-15 14:13:15.637012 : nsdo:nsctx: state=14, flg=0x4004, mvd=0
    2010-09-15 14:13:15.637044 : nsdo:gtn=10, gtc=10, ptn=10, ptc=8155
    2010-09-15 14:13:15.637078 : nscon:doing connect handshake...
    2010-09-15 14:13:15.637110 : nscon:recving a packet
    2010-09-15 14:13:15.637144 : nsprecv:reading from transport...
    2010-09-15 14:13:15.637174 : ntprd:entry
    2010-09-15 14:13:15.637201 : sntpread:entry
    2010-09-15 14:13:15.637229 : sntpread:Attempting to read 8208 bytes from handle 508
    2010-09-15 14:13:15.637266 : sntpread:ReadFile returned 152 bytes
    2010-09-15 14:13:15.637295 : sntpread:rc = 0, ntresnt[0] = 0
    2010-09-15 14:13:15.637322 : sntpread:exit
    2010-09-15 14:13:15.637349 : ntprd:exit
    2010-09-15 14:13:15.637380 : nsprecv:152 bytes from transport
    2010-09-15 14:13:15.637411 : nsprecv:tlen=152, plen=152, type=1
    2010-09-15 14:13:15.637443 : nscon:got NSPTCN packet
    2010-09-15 14:13:15.637481 : nsconneg:vsn=314, lov=300, opt=0x0, sdu=8192, tdu=4096, ntc=0x20e
    2010-09-15 14:13:15.637513 : nsconneg:vsn=314, gbl=0x0, sdu=8192, tdu=4096
    2010-09-15 14:13:15.637547 : nsmal:94 bytes at 0x1e0bea8
    2010-09-15 14:13:15.637580 : nscon:got 94 bytes connect data
    2010-09-15 14:13:15.637612 : nsmfr:94 bytes at 0x1e0bea8
    2010-09-15 14:13:15.637644 : nscon:discarding connect data (94 bytes)
    2010-09-15 14:13:15.637676 : nsdo:nsctxrnk=0
    2010-09-15 14:13:15.637708 : nsinh_hoff:connection inherited
    2010-09-15 14:13:15.637739 : nsinherit:connected
    2010-09-15 14:13:15.637782 : nsglma:entry
    2010-09-15 14:13:15.638886 : nsglma:Listener's pid=2192
    2010-09-15 14:13:15.639072 : nladini:entry
    2010-09-15 14:13:15.639125 : nladini:exit
    2010-09-15 14:13:15.639152 : nladget:entry
    2010-09-15 14:13:15.639197 : nladget:exit
    2010-09-15 14:13:15.639234 : nsgllsn:LSNDSC==>(DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC1521)))
    2010-09-15 14:13:15.639270 : nsglhcrt:entry
    2010-09-15 14:13:15.642067 : nsglhcrt:exit
    2010-09-15 14:13:15.642174 : nsglbgetRSPidx:entry
    2010-09-15 14:13:15.642222 : nladini:entry
    2010-09-15 14:13:15.642259 : nladini:exit
    2010-09-15 14:13:15.642286 : nladget:entry
    2010-09-15 14:13:15.642332 : nladget:exit
    2010-09-15 14:13:15.642363 : nsglbn2i:entry
    2010-09-15 14:13:15.642392 : nsglbn2i:exit
    2010-09-15 14:13:15.642435 : nladtrm:entry
    2010-09-15 14:13:15.642465 : nladtrm:exit
    2010-09-15 14:13:15.642493 : nsglbgetRSPidx:returning ecode=0
    2010-09-15 14:13:15.642520 : nsglbgetRSPidx:exit
    2010-09-15 14:13:15.642593 : nsc2addr:(DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC1521)))
    2010-09-15 14:13:15.643490 : ntnbnd2ddr:entry
    2010-09-15 14:13:15.643547 : ntnbnd2ddr:exit
    2010-09-15 14:13:15.643584 : nsmal:996 bytes at 0x1e0d428
    2010-09-15 14:13:15.643622 : nsmal:2096 bytes at 0x1e0d818
    2010-09-15 14:13:15.643660 : nsmal:84 bytes at 0x1e0e188
    2010-09-15 14:13:15.643728 : nsopen:opening transport...
    2010-09-15 14:13:15.643762 : ntnlsn:entry
    2010-09-15 14:13:15.643810 : ntnlsn:creating pipe \\.\pipe\EXTPROC1521ipc
    2010-09-15 14:13:15.643899 : ntnlsn:listening on pipe 532
    2010-09-15 14:13:15.643930 : nsopen:transport is open
    2010-09-15 14:13:15.643961 : nsoptions:lcl[0]=0x0, lcl[1]=0x12003, gbl[0]=0x0, gbl[1]=0x2001, cha=0x0
    2010-09-15 14:13:15.643994 : nsoptions:lcl[0]=0xf4ffefff, lcl[1]=0x12003, gbl[0]=0x78bf, gbl[1]=0x2001
    2010-09-15 14:13:15.644034 : nsopen:global context check-in (to slot 1) complete
    2010-09-15 14:13:15.644067 : nsopen:lcl[0]=0xf4ffefff, lcl[1]=0x12003, gbl[0]=0x78bf, gbl[1]=0x2001, tdu=32767, sdu=8192
    2010-09-15 14:13:15.644101 : nsfull_opn:cid=1, opcode=65, bl=0, what=0, uflgs=0x0, cflgs=0x0
    2010-09-15 14:13:15.644132 : nsfull_opn:nsctx: state=7, flg=0x4002, mvd=0
    2010-09-15 14:13:15.644162 : nsmal:84 bytes at 0x1e108e8
    2010-09-15 14:13:15.644215 : nsgllsn:completing partial addr: (DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC1521)))
    2010-09-15 14:13:15.645109 : nsgllsn:Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(PIPENAME=\\.\pipe\EXTPROC1521ipc)))
    2010-09-15 14:13:15.645216 : nsevreg:begin registration process for 1
    2010-09-15 14:13:15.645259 : nsevreg:sgt=0, evn=4, evt[2]=0x0
    2010-09-15 14:13:15.645290 : nsevreg:begin notification process for 1
    2010-09-15 14:13:15.645331 : nsrah:setting transport read mode (2)
    2010-09-15 14:13:15.645375 : ntnrd:failed to read 8155 bytes
    2010-09-15 14:13:15.645407 : sntn2err:entry
    2010-09-15 14:13:15.645438 : sntn2err:error: handle=532, op=5, nt[0]=524, nt[1]=997
    2010-09-15 14:13:15.645467 : sntn2err:exit
    2010-09-15 14:13:15.645502 : nsmal:84 bytes at 0x1e12af8
    2010-09-15 14:13:15.645556 : ntnrd:failed to read 8155 bytes
    2010-09-15 14:13:15.645585 : sntn2err:entry
    2010-09-15 14:13:15.645612 : sntn2err:error: handle=532, op=5, nt[0]=524, nt[1]=997
    2010-09-15 14:13:15.645640 : sntn2err:exit
    2010-09-15 14:13:15.645670 : nsmal:84 bytes at 0x1e14cb0
    2010-09-15 14:13:15.645712 : ntnrd:failed to read 8155 bytes
    2010-09-15 14:13:15.645740 : sntn2err:entry
    2010-09-15 14:13:15.645767 : sntn2err:error: handle=532, op=5, nt[0]=524, nt[1]=997
    2010-09-15 14:13:15.645795 : sntn2err:exit
    2010-09-15 14:13:15.645830 : nsmal:84 bytes at 0x1e16e68
    2010-09-15 14:13:15.645874 : ntnrd:failed to read 8155 bytes
    2010-09-15 14:13:15.645903 : sntn2err:entry
    2010-09-15 14:13:15.645931 : sntn2err:error: handle=532, op=5, nt[0]=524, nt[1]=997
    2010-09-15 14:13:15.645958 : sntn2err:exit
    2010-09-15 14:13:15.645989 : nsevreg:rdm=2, sgt=0, evt[0]=0x1, [1]=0x1, [2]=0x0, nrg=0
    2010-09-15 14:13:15.646018 : nsevreg:registering for 0x1
    2010-09-15 14:13:15.646068 : nsglhins:entry
    2010-09-15 14:13:15.646099 : nsglhins:exit
    2010-09-15 14:13:15.646180 : nsc2addr:(ADDRESS=(PROTOCOL=tcp)(HOST=127.0.0.1)(PARTIAL=yes)(QUEUESIZE=1))
    2010-09-15 14:13:15.646440 : nttbnd2addr:entry
    2010-09-15 14:13:15.646487 : snlinGetAddrInfo:entry
    2010-09-15 14:13:15.646621 : snlinGetAddrInfo:exit
    2010-09-15 14:13:15.646653 : nttbnd2addr:using host IP address: 127.0.0.1
    2010-09-15 14:13:15.646686 : snlinFreeAddrInfo:entry
    2010-09-15 14:13:15.646714 : snlinFreeAddrInfo:exit
    2010-09-15 14:13:15.646832 : nttbnd2addr:exit
    2010-09-15 14:13:15.646868 : nsmal:996 bytes at 0x1e19010
    2010-09-15 14:13:15.646900 : nsmal:2096 bytes at 0x1e19400
    2010-09-15 14:13:15.646932 : nsmal:84 bytes at 0x1e19d70
    2010-09-15 14:13:15.646984 : nttcon:entry
    2010-09-15 14:13:15.647013 : nttcon:toc = 6
    2010-09-15 14:13:15.647052 : nttcnp:entry
    2010-09-15 14:13:15.647080 : nttcnp:exit
    2010-09-15 14:13:15.647117 : nttcon:exit
    2010-09-15 14:13:15.647147 : nsopen:opening transport...
    2010-09-15 14:13:15.647175 : nttcon:entry
    2010-09-15 14:13:15.647201 : nttcon:toc = 2
    2010-09-15 14:13:15.647229 : nttcnp:entry
    2010-09-15 14:13:15.647259 : ntvlin:entry
    2010-09-15 14:13:15.647291 : ntvllt:entry
    2010-09-15 14:13:15.647323 : ntvllt:tcp.validnode_checking not turned on
    2010-09-15 14:13:15.647351 : ntvllt:exit
    2010-09-15 14:13:15.647377 : ntvlin:exit
    2010-09-15 14:13:15.647404 : nttcnp:Validnode Table IN use; err 0x0
    2010-09-15 14:13:15.648365 : nttcnp:getting sockname
    2010-09-15 14:13:15.648422 : nttcnp:getting peername
    2010-09-15 14:13:15.648452 : nttcnp:exit
    2010-09-15 14:13:15.648488 : nttcon:exit
    2010-09-15 14:13:15.648517 : nsopen:transport is open
    2010-09-15 14:13:15.648548 : nsoptions:lcl[0]=0x0, lcl[1]=0x10003, gbl[0]=0x0, gbl[1]=0x2001, cha=0x0
    2010-09-15 14:13:15.648581 : nsoptions:lcl[0]=0xf4ffefff, lcl[1]=0x10003, gbl[0]=0x7abf, gbl[1]=0x2001
    2010-09-15 14:13:15.648616 : nsopen:global context check-in (to slot 2) complete
    2010-09-15 14:13:15.648648 : nsopen:lcl[0]=0xf4ffefff, lcl[1]=0x10003, gbl[0]=0x7abf, gbl[1]=0x2001, tdu=32767, sdu=8192
    2010-09-15 14:13:15.648682 : nsfull_opn:cid=2, opcode=65, bl=0, what=0, uflgs=0x0, cflgs=0x0
    2010-09-15 14:13:15.648713 : nsfull_opn:nsctx: state=7, flg=0x4002, mvd=0
    2010-09-15 14:13:15.648746 : nsmal:84 bytes at 0x1e1c688
    2010-09-15 14:13:15.648815 : nladget:entry
    2010-09-15 14:13:15.648868 : nladget:exit
    2010-09-15 14:13:15.648903 : nsgllsn:LSNDSC==>(DESCRIPTION=(ADDRESS=(PROTOCOL=TCPS)(HOST=kcr-PC)(PORT=2484)))
    2010-09-15 14:13:15.649018 : nsglhcrt:entry
    2010-09-15 14:13:15.649230 : nsglhcrt:exit
    2010-09-15 14:13:15.649265 : nsglbgetRSPidx:entry
    2010-09-15 14:13:15.649293 : nladini:entry
    2010-09-15 14:13:15.649328 : nladini:exit
    2010-09-15 14:13:15.649354 : nladget:entry
    2010-09-15 14:13:15.649401 : nladget:exit
    2010-09-15 14:13:15.649428 : nsglbn2i:entry
    2010-09-15 14:13:15.649456 : nsglbn2i:exit
    2010-09-15 14:13:15.649500 : nladtrm:entry
    2010-09-15 14:13:15.649531 : nladtrm:exit
    2010-09-15 14:13:15.649559 : nsglbgetRSPidx:returning ecode=0
    2010-09-15 14:13:15.649586 : nsglbgetRSPidx:exit
    2010-09-15 14:13:15.649654 : nsc2addr:(DESCRIPTION=(ADDRESS=(PROTOCOL=TCPS)(HOST=kcr-PC)(PORT=2484)))
    2010-09-15 14:13:15.650926 : ntzini:entry
    2010-09-15 14:13:15.650997 : ntzSetupConnection:entry
    2010-09-15 14:13:15.651039 : ntzgbhapip:entry
    2010-09-15 14:13:15.651072 : ntzgbhapip:no value for bhapi parameter specified - using default value: "TRUE"
    2010-09-15 14:13:15.651101 : ntzgbhapip:exit
    2010-09-15 14:13:15.657818 : ntzSetupConnection:exit
    2010-09-15 14:13:15.657905 : ntzSetupConnection:entry
    2010-09-15 14:13:15.657936 : ntzgbhapip:entry
    2010-09-15 14:13:15.657968 : ntzgbhapip:no value for bhapi parameter specified - using default value: "TRUE"
    2010-09-15 14:13:15.657998 : ntzgbhapip:exit
    2010-09-15 14:13:15.663017 : ntzSetupConnection:exit
    2010-09-15 14:13:15.663075 : ntzcsgtab:entry
    2010-09-15 14:13:15.663110 : ntzcsgtab:exit
    2010-09-15 14:13:15.663137 : ntzini:exit
    2010-09-15 14:13:15.663166 : nttbnd2addr:entry
    2010-09-15 14:13:15.663197 : snlinGetAddrInfo:entry
    2010-09-15 14:13:15.663240 : snlinGetAddrInfo:getaddrinfo() failed with error 11001
    2010-09-15 14:13:15.663269 : snlinGetAddrInfo:exit
    2010-09-15 14:13:15.663297 : nttbnd2addr:looking up IP addr for host: kcr-PC
    2010-09-15 14:13:15.663324 : snlinGetAddrInfo:entry
    2010-09-15 14:13:15.664291 : snlinGetAddrInfo:exit
    2010-09-15 14:13:15.664336 : snlinFreeAddrInfo:entry
    2010-09-15 14:13:15.664365 : snlinFreeAddrInfo:exit
    2010-09-15 14:13:15.664392 : nttbnd2addr:exit
    2010-09-15 14:13:15.664445 : nsmal:996 bytes at 0x1e48d18
    2010-09-15 14:13:15.664479 : nsmal:2096 bytes at 0x1e49108
    2010-09-15 14:13:15.664533 : nsmal:84 bytes at 0x1e49a90
    2010-09-15 14:13:15.664583 : ntzconnect:entry
    2010-09-15 14:13:15.664612 : nttcon:entry
    2010-09-15 14:13:15.664640 : nttcon:toc = 6
    2010-09-15 14:13:15.664676 : nttcnp:entry
    2010-09-15 14:13:15.664703 : nttcnp:exit
    2010-09-15 14:13:15.664734 : nttcon:exit
    2010-09-15 14:13:15.664761 : ntzconnect:underlying transport adapter failed.
    2010-09-15 14:13:15.664794 : ntzconnect:failed with error 551
    2010-09-15 14:13:15.664849 : ntzconnect:exit
    2010-09-15 14:13:15.664879 : nsopen:opening transport...
    2010-09-15 14:13:15.664908 : ntzconnect:entry
    2010-09-15 14:13:15.664934 : nttcon:entry
    2010-09-15 14:13:15.664960 : nttcon:toc = 2
    2010-09-15 14:13:15.664988 : nttcnp:entry
    2010-09-15 14:13:15.665015 : ntvlin:entry
    2010-09-15 14:13:15.665042 : ntvllt:entry
    2010-09-15 14:13:15.665074 : ntvllt:tcp.validnode_checking not turned on
    2010-09-15 14:13:15.665102 : ntvllt:exit
    2010-09-15 14:13:15.665128 : ntvlin:exit
    2010-09-15 14:13:15.665155 : nttcnp:Validnode Table IN use; err 0x0
    2010-09-15 14:13:15.665380 : snlinGetAddrInfo:entry
    2010-09-15 14:13:15.666066 : snlinGetAddrInfo:exit
    2010-09-15 14:13:15.666106 : snlinFreeAddrInfo:entry
    2010-09-15 14:13:15.666134 : snlinFreeAddrInfo:exit
    2010-09-15 14:13:15.666213 : nttcnp:getting sockname
    2010-09-15 14:13:15.666245 : nttcnp:getting peername
    2010-09-15 14:13:15.666273 : nttcnp:exit
    2010-09-15 14:13:15.666417 : snlinGetAddrInfo:entry
    2010-09-15 14:13:15.666901 : snlinGetAddrInfo:exit
    2010-09-15 14:13:15.666939 : snlinFreeAddrInfo:entry
    2010-09-15 14:13:15.666966 : snlinFreeAddrInfo:exit
    2010-09-15 14:13:15.666994 : nttcon:exit
    2010-09-15 14:13:15.667022 : ntzAllocate:entry
    2010-09-15 14:13:15.667050 : ntzAllocate:allocating 168 bytes of memory.
    2010-09-15 14:13:15.667079 : ntzAllocate:exit
    2010-09-15 14:13:15.667105 : ntzconnect:exit
    2010-09-15 14:13:15.667134 : nsopen:transport is open
    2010-09-15 14:13:15.667164 : nsoptions:lcl[0]=0x0, lcl[1]=0x12003, gbl[0]=0x0, gbl[1]=0x2001, cha=0x0
    2010-09-15 14:13:15.667198 : nsoptions:lcl[0]=0xf4ffefff, lcl[1]=0x12003, gbl[0]=0x7abf, gbl[1]=0x2001
    2010-09-15 14:13:15.667233 : nsopen:global context check-in (to slot 3) complete
    2010-09-15 14:13:15.667265 : nsopen:lcl[0]=0xf4ffefff, lcl[1]=0x12003, gbl[0]=0x7abf, gbl[1]=0x2001, tdu=32767, sdu=8192
    2010-09-15 14:13:15.667300 : nsfull_opn:cid=3, opcode=65, bl=0, what=0, uflgs=0x0, cflgs=0x0
    2010-09-15 14:13:15.667330 : nsfull_opn:nsctx: state=7, flg=0x4002, mvd=0
    2010-09-15 14:13:15.667361 : nsmal:84 bytes at 0x1e49af0
    2010-09-15 14:13:15.667419 : nsgllsn:completing partial addr: (DESCRIPTION=(ADDRESS=(PROTOCOL=TCPS)(HOST=kcr-PC)(PORT=2484)))
    2010-09-15 14:13:15.667462 : nttaddr2bnd:entry
    2010-09-15 14:13:15.667604 : snlinGetAddrInfo:entry
    2010-09-15 14:13:15.668269 : snlinGetAddrInfo:exit
    2010-09-15 14:13:15.668305 : snlinFreeAddrInfo:entry
    2010-09-15 14:13:15.668333 : snlinFreeAddrInfo:exit
    2010-09-15 14:13:15.668367 : nttaddr2bnd:exit
    2010-09-15 14:13:15.669099 : nsgllsn:Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=tcps)(HOST=kcr-PC)(PORT=2484)))
    2010-09-15 14:13:15.669141 : nsevreg:begin registration process for 3
    2010-09-15 14:13:15.669174 : nsevreg:sgt=0, evn=1, evt[2]=0x0
    2010-09-15 14:13:15.669203 : nsevreg:begin notification process for 3
    2010-09-15 14:13:15.669234 : nsevreg:rdm=0, sgt=0, evt[0]=0x1, [1]=0x1, [2]=0x0, nrg=0
    2010-09-15 14:13:15.669263 : nsevre

    Thanks for your reply.
    Little more research I found that auto login needs to be enabled. I am still working on resolving this issue, I have spent over 12 hrs to resolve this issue. I will post with my troubleshooting results. Please advise.
    Thanks,
    /SR

  • SSL CertGen & Private key import errors - 7.0

    I am trying to install weblogic generated ssl certificate and because the private
    key needs to be encrypted with a password, i am loading this in a new JDK keystore
    and trying to configure WL.
    I am running utils.CertGen from weblogic 7.0 sp3 on XP.
    X:\SSLTest>java utils.CertGen testpassword testcert testkey
    Creating Domestic Key Strength - 1024
    ..... Certificate CommonName will contain Hostname KUNDULA_M-DGS
    Encoding
    Created Private Key files - testkey.der and testkey.pem
    com.rsa.certj.cert.CertificateException: Cannot build Cert Request Info: Unable
    to encode X500Name.
    at com.rsa.certj.cert.PKCS10CertRequest.getCertRequestInfoDEREncoding(PKCS10CertRequest.java:824)
    at com.rsa.certj.cert.PKCS10CertRequest.signCertRequest(PKCS10CertRequest.java:1082)
    at utils.CertGen.createCertificateRequest(CertGen.java:312)
    at utils.CertGen.processCommand(CertGen.java:185)
    at utils.CertGen.main(CertGen.java:170)
    com.rsa.certj.cert.CertificateException: Cannot build Cert Request Info: Unable
    to encode X500Name.
    at com.rsa.certj.cert.PKCS10CertRequest.getCertRequestInfoDEREncoding(PKCS10CertRequest.java:824)
    at com.rsa.certj.cert.PKCS10CertRequest.signCertRequest(PKCS10CertRequest.java:1082)
    at utils.CertGen.createCertificateRequest(CertGen.java:312)
    at utils.CertGen.processCommand(CertGen.java:185)
    at utils.CertGen.main(CertGen.java:170)
    I went ahead and ran the same CertGen on unix and got the certificate file and
    the key file
    to my box to check to see if i can install it. I created a new keystore with keytool,
    loaded the private key with the alias and the password phrase, made this key store
    the default keystore, supplied the management password, changed the files to read
    the new cert file and key file.
    Attached is the log for the SSL debug.
    Do i need to import the private key stored in the JDK for weblogic ? I tried doing
    that by running.
    X:\>java utils.ImportPrivateKey X:\bea\user_projects\mydomain\mystore.jks mypass
    myalias pvtPasswd X:\bea\user_projects\mydomain\localcert.pem X:\bea\user_projects\mydomain\localkey.pem
    ImportPrivateKey will use existing X:\bea\user_projects\mydomain\mystore.jks
    ImportPrivateKey failed, java.security.KeyManagementException: ASN.1: Unxpected
    ASN.1 tag
    java.security.KeyManagementException: ASN.1: Unxpected ASN.1 tag
    at com.certicom.security.cert.internal.x509.SSLPlusSupport.getLocalIdentityPartial(Unknown
    Source)
    at com.certicom.net.ssl.CerticomContextWrapper.inputPrivateKey(Unknown
    Source)
    at utils.ImportPrivateKey.importKey(ImportPrivateKey.java:76)
    at utils.ImportPrivateKey.importKey(ImportPrivateKey.java:44)
    at utils.ImportPrivateKey.main(ImportPrivateKey.java:32)
    X:\>
    Attached log is SSL debug enabled and it cant see the private key.
    Any help is appreciated.
    thanks,
    mallik
    [ssldebuglog.txt]

    "Mallik" <[email protected]> wrote in message
    news:3f3274e9$[email protected]..
    >
    I am trying to install weblogic generated ssl certificate and because theprivate
    key needs to be encrypted with a password, i am loading this in a new JDKkeystore
    and trying to configure WL.
    I am running utils.CertGen from weblogic 7.0 sp3 on XP.
    X:\SSLTest>java utils.CertGen testpassword testcert testkey
    Creating Domestic Key Strength - 1024
    ..... Certificate CommonName will contain Hostname KUNDULA_M-DGS
    Encoding
    Try this on 8.1 and see if it works. There was a bug fix with respect to "_"
    in hostnames.

  • Problem establishing SSL VPN from only 1 IP address

    Hi,
    I'm experiencing strange problem.
    I can't establish SSL VPN connection from 1 IP address, but I don't have problem establishing SSL VPN from any other IP address.
    Remote IP address: 10.0.0.1
    ASA's public IP address: 192.168.1.1
    Output of packet-tracer:
    1. with problematic source IP address:
    packet-tracer input wan tcp 10.0.0.1 50601 192.168.1.1 443 detailed
    Phase: 1
    Type: ROUTE-LOOKUP
    Subtype: input
    Result: ALLOW
    Config:
    Additional Information:
    in   192.168.1.1   255.255.255.255 identity
    Phase: 2
    Type: ACCESS-LIST
    Subtype:
    Result: ALLOW
    Config:
    Implicit Rule
    Additional Information:
    Forward Flow based lookup yields rule:
    in  id=0x7fff37573f00, priority=119, domain=permit, deny=false
            hits=861, user_data=0x0, cs_id=0x0, flags=0x0, protocol=6
            src ip/id=0.0.0.0, mask=0.0.0.0, port=0
            dst ip/id=0.0.0.0, mask=0.0.0.0, port=443, dscp=0x0
            input_ifc=wan, output_ifc=identity
    Phase: 3
    Type: CONN-SETTINGS
    Subtype:
    Result: ALLOW
    Config:
    Additional Information:
    Forward Flow based lookup yields rule:
    in  id=0x7fff38a10a50, priority=8, domain=conn-set, deny=false
            hits=4069, user_data=0x7fff38770910, cs_id=0x0, reverse, flags=0x0, protocol=6
            src ip/id=0.0.0.0, mask=0.0.0.0, port=0
            dst ip/id=192.168.1.1, mask=255.255.255.255, port=443, dscp=0x0
            input_ifc=wan, output_ifc=identity
    Phase: 4
    Type: IP-OPTIONS
    Subtype:
    Result: ALLOW
    Config:
    Additional Information:
    Forward Flow based lookup yields rule:
    in  id=0x7fff395c7d70, priority=0, domain=inspect-ip-options, deny=true
            hits=4044934, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
            src ip/id=0.0.0.0, mask=0.0.0.0, port=0
            dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
            input_ifc=wan, output_ifc=any
    Phase: 5
    Type: VPN
    Subtype: ipsec-tunnel-flow
    Result: ALLOW
    Config:
    Additional Information:
    Forward Flow based lookup yields rule:
    in  id=0x7fff37560700, priority=13, domain=ipsec-tunnel-flow, deny=true
            hits=2268518, user_data=0x0, cs_id=0x0, flags=0x0, protocol=0
            src ip/id=0.0.0.0, mask=0.0.0.0, port=0
            dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
            input_ifc=wan, output_ifc=any
    Phase: 6
    Type: TCP-MODULE
    Subtype: webvpn
    Result: ALLOW
    Config:
    Additional Information:
    Forward Flow based lookup yields rule:
    in  id=0x7fff38a10cc0, priority=13, domain=soft-np-tcp-module, deny=false
            hits=4627, user_data=0x7fff38c14300, cs_id=0x0, reverse, flags=0x0, protocol=6
            src ip/id=0.0.0.0, mask=0.0.0.0, port=0
            dst ip/id=192.168.1.1, mask=255.255.255.255, port=443, dscp=0x0
            input_ifc=wan, output_ifc=identity
    Phase: 7
    Type: VPN
    Subtype: encrypt
    Result: DROP
    Config:
    Additional Information:
    Reverse Flow based lookup yields rule:
    out id=0x7fff375504a0, priority=69, domain=encrypt, deny=false
            hits=40747, user_data=0x0, cs_id=0x7fff3754fa40, reverse, flags=0x0, protocol=0
            src ip/id=192.168.1.1, mask=255.255.255.255, port=0
            dst ip/id=10.0.0.1, mask=255.255.255.255, port=0, dscp=0x0
            input_ifc=any, output_ifc=wan
    Result:
    input-interface: wan
    input-status: up
    input-line-status: up
    output-interface: NP Identity Ifc
    output-status: up
    output-line-status: up
    Action: drop
    Drop-reason: (acl-drop) Flow is denied by configured rule
    If I run packet-tracer with any other source IP address, let's say 10.0.0.2, everything is OK:
    packet-tracer input wan tcp 10.0.0.2 50601 192.168.1.1 443 de
    Phase: 1
    Type: ROUTE-LOOKUP
    Subtype: input
    Result: ALLOW
    Config:
    Additional Information:
    in   192.168.1.1   255.255.255.255 identity
    Phase: 2
    Type: ACCESS-LIST
    Subtype:
    Result: ALLOW
    Config:
    Implicit Rule
    Additional Information:
    Forward Flow based lookup yields rule:
    in  id=0x7fff37573f00, priority=119, domain=permit, deny=false
            hits=862, user_data=0x0, cs_id=0x0, flags=0x0, protocol=6
            src ip/id=0.0.0.0, mask=0.0.0.0, port=0
            dst ip/id=0.0.0.0, mask=0.0.0.0, port=443, dscp=0x0
            input_ifc=wan, output_ifc=identity
    Phase: 3
    Type: CONN-SETTINGS
    Subtype:
    Result: ALLOW
    Config:
    Additional Information:
    Forward Flow based lookup yields rule:
    in  id=0x7fff38a10a50, priority=8, domain=conn-set, deny=false
            hits=4090, user_data=0x7fff38770910, cs_id=0x0, reverse, flags=0x0, protocol=6
            src ip/id=0.0.0.0, mask=0.0.0.0, port=0
            dst ip/id=192.168.1.1, mask=255.255.255.255, port=443, dscp=0x0
            input_ifc=wan, output_ifc=identity
    Phase: 4
    Type: IP-OPTIONS
    Subtype:
    Result: ALLOW
    Config:
    Additional Information:
    Forward Flow based lookup yields rule:
    in  id=0x7fff395c7d70, priority=0, domain=inspect-ip-options, deny=true
            hits=4047886, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
            src ip/id=0.0.0.0, mask=0.0.0.0, port=0
            dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
            input_ifc=wan, output_ifc=any
    Phase: 5
    Type: VPN
    Subtype: ipsec-tunnel-flow
    Result: ALLOW
    Config:
    Additional Information:
    Forward Flow based lookup yields rule:
    in  id=0x7fff37560700, priority=13, domain=ipsec-tunnel-flow, deny=true
            hits=2270040, user_data=0x0, cs_id=0x0, flags=0x0, protocol=0
            src ip/id=0.0.0.0, mask=0.0.0.0, port=0
            dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
            input_ifc=wan, output_ifc=any
    Phase: 6
    Type: TCP-MODULE
    Subtype: webvpn
    Result: ALLOW
    Config:
    Additional Information:
    Forward Flow based lookup yields rule:
    in  id=0x7fff38a10cc0, priority=13, domain=soft-np-tcp-module, deny=false
            hits=4648, user_data=0x7fff38c14300, cs_id=0x0, reverse, flags=0x0, protocol=6
            src ip/id=0.0.0.0, mask=0.0.0.0, port=0
            dst ip/id=192.168.1.1, mask=255.255.255.255, port=443, dscp=0x0
            input_ifc=wan, output_ifc=identity
    Phase: 7
    Type: USER-STATISTICS
    Subtype: user-statistics
    Result: ALLOW
    Config:
    Additional Information:
    Reverse Flow based lookup yields rule:
    out id=0x7fff3a1cc320, priority=0, domain=user-statistics, deny=false
            hits=4902651, user_data=0x7fff3a0043c0, cs_id=0x0, reverse, flags=0x0, protocol=0
            src ip/id=0.0.0.0, mask=0.0.0.0, port=0
            dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
            input_ifc=any, output_ifc=wan
    Phase: 8
    Type: FLOW-CREATION
    Subtype:
    Result: ALLOW
    Config:
    Additional Information:
    New flow created with id 4384689, packet dispatched to next module
    Module information for forward flow ...
    snp_fp_tracer_drop
    snp_fp_inspect_ip_options
    snp_fp_tcp_normalizer
    snp_fp_tcp_mod
    snp_fp_adjacency
    snp_fp_fragment
    snp_fp_drop
    Module information for reverse flow ...
    snp_fp_tracer_drop
    snp_fp_inspect_ip_options
    snp_fp_tcp_normalizer
    snp_fp_adjacency
    snp_fp_fragment
    snp_ifc_stat
    Result:
    input-interface: wan
    input-status: up
    input-line-status: up
    output-interface: NP Identity Ifc
    output-status: up
    output-line-status: up
    Action: allow
    I run packet capture on WAN interface - and I can only see incoming packets (SYN) with destination to tcp/443 but there isn't any outgoing packet (SYN/ACK).
    I even can't open web page from internet browser (url https://192.168.1.1) when source IP is 10.0.0.1, but I can open "SSL VPN Service" web page from any other source IP address.
    The only thing different with this IP address is that there's configured site-to-site (IPsec) vpn tunnel from same source to same destination IP address.
    Here is the configuration of the tunnel:
    group-policy GroupPolicy_10.0.0.1 internal
    group-policy GroupPolicy_10.0.0.1 attributes
    vpn-filter value VPN-ACL
    vpn-tunnel-protocol ikev1 ssl-client
    access-list VPN-ACL:
    access-list VPN-ACL extended permit ip object-group DM_INLINE_NETWORK_83 object-group DM_INLINE_NETWORK_84
    object-group network DM_INLINE_NETWORK_83
    network-object 10.11.217.0 255.255.255.0
    network-object 192.168.201.0 255.255.255.0
    object-group network DM_INLINE_NETWORK_84
    network-object 10.11.217.0 255.255.255.0
    network-object 192.168.201.0 255.255.255.0
    tunnel local & remote networks:
    access-list wan_cryptomap_5 extended permit ip 10.11.217.0 255.255.255.0 192.168.201.0 255.255.255.0
    crypto map wan_map 5 match address wan_cryptomap_5
    crypto map wan_map 5 set connection-type answer-only
    crypto map wan_map 5 set peer 10.0.0.1
    crypto map wan_map 5 set ikev1 transform-set ESP-3DES-SHA
    I've configured the same setup in my lab and I can't reproduce the error.
    The SW version running on ASA is asa861-12.
    I'm out of ideas.

    Just collected some other information:
    1. traceroute shows that traffic is not leaving ASA at all
    1   *  *  *
    2   *  *  *
    3   *  *  *
    I double checked that there is no "strange" entry for remote public IP in routing. Traffic with destination to remote IP should be sent via default gateway like all other traffic.
    2. debug crypto ipsec shows this information when I ping public IP address of the remote host (with VPN
    IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=1, saddr=192.168.1.1, sport=30647, daddr=10.0.0.1, dport=30647
    IPSEC(crypto_map_check)-5: Checking crypto map wan_map 1: skipping because 5-tuple does not match ACL wan_cryptomap_1.
    IPSEC(crypto_map_check)-5: Checking crypto map wan_map 2: skipping because 5-tuple does not match ACL wan_cryptomap_2.
    IPSEC(crypto_map_check)-5: Checking crypto map wan_map 3: skipping because 5-tuple does not match ACL wan_cryptomap_3.
    IPSEC(crypto_map_check)-5: Checking crypto map wan_map 4: skipping because 5-tuple does not match ACL wan_cryptomap_4.
    IPSEC(crypto_map_check)-5: Checking crypto map wan_map 5: skipping dormant map.
    IPSEC(crypto_map_check)-5: Checking crypto map wan_map 5: skipping dormant map.
    IPSEC(crypto_map_check)-5: Checking crypto map wan_map 6: skipping because 5-tuple does not match ACL wan_cryptomap_6.
    IPSEC(crypto_map_check)-5: Checking crypto map wan_map 7: skipping because 5-tuple does not match ACL wan_cryptomap_7.
    IPSEC(crypto_map_check)-5: Checking crypto map wan_map 8: skipping because 5-tuple does not match ACL wan_cryptomap_8.
    IPSEC(crypto_map_check)-5: Checking crypto map wan_map 9: skipping because 5-tuple does not match ACL wan_cryptomap_9.
    IPSEC(crypto_map_check)-5: Checking crypto map wan_map 10: skipping because 5-tuple does not match ACL wan_cryptomap_10.
    IPSEC(crypto_map_check)-5: Checking crypto map wan_map 11: skipping because 5-tuple does not match ACL wan_cryptomap_11.
    IPSEC(crypto_map_check)-5: Checking crypto map wan_map 13: skipping because 5-tuple does not match ACL wan_cryptomap_13.
    IPSEC(crypto_map_check)-5: Checking crypto map wan_map 65535: skipping dynamic_link.
    IPSEC(crypto_map_check)-1: Error: No crypto map matched.
    It really seems that the whole problem is that ASA is trying to encrypt traffic sent from public IP address of one VPN endpoint and targeted to public IP address of another VPN endpoint and send it to remote VPN endpoint via IPcec tunel.
    There is indeed VPN tunnel established between both VPN endpoints, but there are just local and remote networks defined with private IP address space for this tunnel, VPN endpoint's public IP addresses are not included in the definition of this IPsec VPN tunnel.
    And there are at least two more IPsec VPN tunnels configured the same way and I can't reprodure this error on there two VPN tunnels.
    Any idea?

Maybe you are looking for

  • How do i turn ON digital out port on appleTV

    Just got my new apple tv ( latest version). I have connected hdmi out to the tv and optical out to my old A/V receiver. I have also appropriately made all the assignments on my receiver for optical in. Not getting any sound from digital out of apple

  • Print formats available in BW

    Hi, I have a customer that wants to use our product to improve the quality of the outputs from BW. To tell if we can support the customer, I need to know what print formats BW can produce (e.g. RDI, XSF, OTF, PDF, ASCII). To give you a bit more detai

  • Viewing Microsoft Word Documents on iPod

    I tried to put some Microsoft word documents on my iPod but when I selected them from my iPod only a jumbled word would show up. Does anyone know how I can succesfully put Microsoft Word Documents on my iPod?

  • HP 750 all in one

    I have been given a HP 750 all in one printer which has not been used for some time.  I have fitted two new HP cartridges and whilst the black is fine I am only getting the cyan from the colour.  I have tried the cleaning process several times to no

  • Accessors/Mutators needed ???

    I wrote a student grade calculation program. Now, our prof. gave us a sample program that tracks an employee and their salary and information. When I'm comparing mine to his, I notice I have no accessor/mutator (get/set) statements like he does. Am I