Windows 7 Using F5 Firepass(vpn) to access network share, win 7 64bit sp1

[happykid]

Hi,

I am currently having some problems with BSoD appearing while I'm browsing local network shares on our company servers through F5 Firepass vpn. It seems to come at random when you are viewing/editing office documents, but you can force the same bsod by searching for ppt etc on a network disk and just scroll down the page.

It seems for now that it is only affecting our Dell laptops, especially the Latitude E6410 but other models are affected too. Ive tried a few different Win 7 pro x64 images, the latest being with sp1 included. I did some tests with a Lenovo Thinkpad T60 and it stopped getting bsod after I installed Win 7 with sp1 included.

Give me a shout if you need any more information.

Thanks for all your help in advance.

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault).  The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
        use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
        use .trap on that value
Else
        .trap on the appropriate frame will show where the trap was taken
        (on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: 0000000080050031
Arg3: 00000000000006f8
Arg4: fffff88001892c24

Debugging Details:
------------------


BUGCHECK_STR:  0x7f_8

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  TunnelServer.e

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002cc82a9 to fffff80002cc8d00

STACK_TEXT:  
fffff800`00ba4d28 fffff800`02cc82a9 : 00000000`0000007f 00000000`00000008 00000000`80050031 00000000`000006f8 : nt!KeBugCheckEx
fffff800`00ba4d30 fffff800`02cc6772 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff800`00ba4e70 fffff880`01892c24 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0xb2
fffff880`064db000 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tdx!TdxSendConnection+0x4


STACK_COMMAND:  kb

FOLLOWUP_IP: 
tdx!TdxSendConnection+4
fffff880`01892c24 4154            push    r12

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  tdx!TdxSendConnection+4

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: tdx

IMAGE_NAME:  tdx.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce79332

FAILURE_BUCKET_ID:  X64_0x7f_8_tdx!TdxSendConnection+4

BUCKET_ID:  X64_0x7f_8_tdx!TdxSendConnection+4

Followup: MachineOwner

 

[Captain Jack]

Hello there!

The dump is pointing to Microsoft TDI Translation driver. which may not be the problem. I believe it could be F5 Firepass VPN because the driver it uses is pretty old i.e. F5FltDrv.sys Fri Sep 05 01:26:31 2008 so we have to update those drivers and Uninstall any third party Firewall / Internet Security as if now. You could replace it with Microsoft Security Essentials.

I would appreciate if you get me the MSINFO32 file.

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault).  The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
        use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
        use .trap on that value
Else
        .trap on the appropriate frame will show where the trap was taken
        (on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: 0000000080050031
Arg3: 00000000000006f8
Arg4: fffff88001858c24

Debugging Details:
------------------


BUGCHECK_STR:  0x7f_8

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  TunnelServer.e

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002ce52a9 to fffff80002ce5d00

STACK_TEXT:  
fffff880`0330dce8 fffff800`02ce52a9 : 00000000`0000007f 00000000`00000008 00000000`80050031 00000000`000006f8 : nt!KeBugCheckEx
fffff880`0330dcf0 fffff800`02ce3772 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`0330de30 fffff880`01858c24 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0xb2
fffff880`08758000 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tdx!TdxSendConnection+0x4


STACK_COMMAND:  kb

FOLLOWUP_IP: 
tdx!TdxSendConnection+4
fffff880`01858c24 4154            push    r12

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  tdx!TdxSendConnection+4

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: tdx

IMAGE_NAME:  tdx.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce79332

FAILURE_BUCKET_ID:  X64_0x7f_8_tdx!TdxSendConnection+4

BUCKET_ID:  X64_0x7f_8_tdx!TdxSendConnection+4

Followup: MachineOwner

 

[happykid]

Ok, thanks for taking a look.

I've currently got the latest software, and if I use the web interface to open a vpn tunnel then it should check if the driver is older than the one on the vpn box. And that one was updated not that long ago. There is also "urvpndrv F5 Networks VPN Adapter 05.01.2011 00:22:20" which is fairly new.

There are no third party Firewall / Internet Security installed on the laptop at the moment since its just a clean install to find out what could be the problem. Less clutter is always better

Ive attached the Msinfo file.

 

[Captain Jack]

Did you check with the VPN vendor about this issue. because when it comes to specific software vendor i'm not sure how it fix it. You might wanna contact their support.

 

[gfuchs]

Having the same problem. Seems to be .ppt files.
Both Thinkpads and Dell systems.
Have you opened a case with F5?

I'm going to tomorrow.

Greg

 

[Pssinatl]

Same issue on an HP desktop. I find that it is big files, which is often (but not always) ppt files. my issue started the day my employer changed VPN toF5. If you her anything from f5 ticket please post, thanks.

 

[gfuchs]

This is a Microsoft issue that was introduced in SP1 according to F5 support.
KB 2519736

F5 does have a hotfix that fixed the problem for us for 7.0
HF-361049

Greg

 

[Pssinatl]

Many thanks.