09-11-2002 05:27 AM - edited 03-09-2019 12:15 AM
Dear Everybody,
I been setting up this VPN concentrator for remote access client, but i'm keep getting this kind of error message from the event log. I don't have any problem with the connection, but just want to know what does it mean by that, and are there anyway i can get rid of them?
Look forward for any suggestoin, thanks in advance.
Simon
Sep 10 10:41:21 209.227.86.29 6275 09/10/2002 10:41:43.260 SEV=4 HTTP/13
RPT=1133 209.227.180.199 HTTP 400 Bad Request: Form Error
Sep 10 10:41:22 209.227.86.29 6276 09/10/2002 10:41:43.430 SEV=4 HTTP/50
RPT=1138 209.227.180.199 HTTP 404 Not Found (/scripts/..`
\234../winnt/system32/cmd.exe)
Sep 10 10:41:22 209.227.86.29 6277 09/10/2002 10:41:43.430 SEV=3 HTTP/10
RPT=1151 209.227.180.199 HTTP 401 Unauthorized: Authorization Not Present
Sep 10 10:41:22 209.227.86.29 6278 09/10/2002 10:41:43.430 SEV=4 HTTP/13
RPT=1134 209.227.180.199 HTTP 400 Bad Request: Form Error
Sep 10 10:41:22 209.227.86.29 6279 09/10/2002 10:41:43.620 SEV=4 HTTP/50
RPT=1139 209.227.180.199 HTTP 404 Not Found (/scripts/..E
c../winnt/system32/cmd.exe)
Sep 10 10:41:22 209.227.86.29 6280 09/10/2002 10:41:43.620 SEV=3 HTTP/10
RPT=1152 209.227.180.199 HTTP 401 Unauthorized: Authorization Not Present
Sep 10 10:41:22 209.227.86.29 6281 09/10/2002 10:41:43.620 SEV=4 HTTP/13
RPT=1135 209.227.180.199 HTTP 400 Bad Request: Form Error
Sep 10 10:41:22 209.227.86.29 6282 09/10/2002 10:41:43.800 SEV=4 HTTP/50
RPT=1140 209.227.180.199 HTTP 404 Not Found (/scripts/..E
c../winnt/system32/cmd.exe)
Sep 10 10:41:22 209.227.86.29 6283 09/10/2002 10:41:43.800 SEV=3 HTTP/10
RPT=1153 209.227.180.199 HTTP 401 Unauthorized: Authorization Not Present
Sep 10 10:41:22 209.227.86.29 6284 09/10/2002 10:41:43.800 SEV=4 HTTP/13
RPT=1136 209.227.180.199 HTTP 400 Bad Request: Form Error
Sep 10 10:41:22 209.227.86.29 6285 09/10/2002 10:41:43.980 SEV=4 HTTP/50
RPT=1141 209.227.180.199 HTTP 404 Not Found
(/scripts/..%5c../winnt/system32/cmd.exe)
Sep 10 10:41:22 209.227.86.29 6286 09/10/2002 10:41:43.980 SEV=3 HTTP/10
RPT=1154 209.227.180.199 HTTP 401 Unauthorized: Authorization Not Present
Sep 10 10:41:22 209.227.86.29 6287 09/10/2002 10:41:43.980 SEV=4 HTTP/13
RPT=1137 209.227.180.199 HTTP 400 Bad Request: Form Error
Sep 10 10:41:22 209.227.86.29 6288 09/10/2002 10:41:44.150 SEV=4 HTTP/50
RPT=1142 209.227.180.199 HTTP 404 Not Found
(/scripts/..%2f../winnt/system32/cmd.exe)
Sep 10 10:41:22 209.227.86.29 6289 09/10/2002 10:41:44.150 SEV=3 HTTP/10
RPT=1155 209.227.180.199 HTTP 401 Unauthorized: Authorization Not Present
Sep 10 10:41:22 209.227.86.29 6290 09/10/2002 10:41:44.150 SEV=4 HTTP/13
RPT=1138 209.227.180.199 HTTP 400 Bad Request: Form Error
Sep 10 10:44:23 172.16.4.9 21246: Sep 10 10:44:40: %SEC-6-IPACCESSLOGP: list
120 permitted udp 209.227.86.29(514) -> 64.32.177.23(514), 96 packets
09-18-2002 12:38 PM
I only doubt your AAA configs. Check them out as it seems to be complaining about an Authorization problem.
09-24-2002 08:27 AM
Looks like NIMDA virus from around is scanning and hitting your public
interface. I would lock your public interface down from HTTP/https and
of course, everything.
Nimda is treating the vpn's webserver like IIS on a microsoft box, and trying
to crack its way into directories and get rights to do damage.
I doubt it can hurt the vpn, by why risk problems, crashes and the cpu overhead
09-24-2002 08:30 AM
Another good reason why you should put your 3000 behind a firewall :-)
Barry
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide