Failed Main Mode negotiations at warning level

DirectAccess_Server_Security_AuthFailuresIPv6_Warning (UnitMonitor)

This is a warning alarm generated because "Failed Main Mode Negotiations" counter (under the object "IPsec AuthIP IPv6" in the performance monitor tool) exceeded warning levels. This alarm is cleared when the counter returns to healthy levels.

Knowledge Base article:

Summary

This is a warning alarm generated because the "Failed Main Mode Negotiations" counter (under the object "IPsec AuthIP IPv6" in the performance monitor tool) exceeded warning levels. This alarm is cleared when the counter returns to healthy levels.

Causes

This alarm indicates authentication failures reaching warning levels (as defined through the thresholds).

Resolutions

Increase the threshold setting for this counter to prevent false alarms.

Element properties:

Target	Microsoft.Forefront.UAG.DirectAccess
Parent Monitor	System.Health.SecurityState
Category	SecurityHealth
Enabled	True
Instance Name	IPsec AuthIP IPv6
Counter Name	Failed Main Mode Negotiations
Frequency	300
Alert Generate	False
Alert Auto Resolve	True
Monitor Type	System.Performance.DeltaThreshold
Remotable	True
Accessibility	Public
RunAs	Default

Source Code:

<UnitMonitor ID="DirectAccess_Server_Security_AuthFailuresIPv6_Warning" Accessibility="Public" Enabled="true" Target="Microsoft.Forefront.UAG.DirectAccess" ParentMonitorID="Health!System.Health.SecurityState" Remotable="true" Priority="Normal" TypeID="Performance!System.Performance.DeltaThreshold" ConfirmDelivery="false">

  <Category>SecurityHealth</Category>

  <OperationalStates>

    <OperationalState ID="UnderThreshold" MonitorTypeStateID="UnderThreshold" HealthState="Success"/>

    <OperationalState ID="OverThreshold" MonitorTypeStateID="OverThreshold" HealthState="Warning"/>

  </OperationalStates>

  <Configuration>

    <ComputerName>$Target/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

    <CounterName>Failed Main Mode Negotiations</CounterName>

    <ObjectName>IPsec AuthIP IPv6</ObjectName>

    <InstanceName/>

    <AllInstances>false</AllInstances>

    <Frequency>300</Frequency>

    <Threshold>5</Threshold>

    <NumSamples>5</NumSamples>

    <Absolute>true</Absolute>

  </Configuration>

</UnitMonitor>