Using F5 Firepass(vpn) to access network share, win 7 64bit sp1

Discussion in 'Windows 7 Blue Screen of Death (BSOD)' started by happykid, Jun 10, 2011.

  1. happykid

    happykid New Member

    Joined:
    Jun 10, 2011
    Messages:
    4
    Likes Received:
    0
    Hi,

    I am currently having some problems with BSoD appearing while I'm browsing local network shares on our company servers through F5 Firepass vpn. It seems to come at random when you are viewing/editing office documents, but you can force the same bsod by searching for ppt etc on a network disk and just scroll down the page.

    It seems for now that it is only affecting our Dell laptops, especially the Latitude E6410 but other models are affected too. Ive tried a few different Win 7 pro x64 images, the latest being with sp1 included. I did some tests with a Lenovo Thinkpad T60 and it stopped getting bsod after I installed Win 7 with sp1 included.

    Give me a shout if you need any more information.

    Thanks for all your help in advance.

    Code:
    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    UNEXPECTED_KERNEL_MODE_TRAP (7f)
    This means a trap occurred in kernel mode, and it's a trap of a kind
    that the kernel isn't allowed to have/catch (bound trap) or that
    is always instant death (double fault).  The first number in the
    bugcheck params is the number of the trap (8 = double fault, etc)
    Consult an Intel x86 family manual to learn more about what these
    traps are. Here is a *portion* of those codes:
    If kv shows a taskGate
            use .tss on the part before the colon, then kv.
    Else if kv shows a trapframe
            use .trap on that value
    Else
            .trap on the appropriate frame will show where the trap was taken
            (on x86, this will be the ebp that goes with the procedure KiTrap)
    Endif
    kb will then show the corrected stack.
    Arguments:
    Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
    Arg2: 0000000080050031
    Arg3: 00000000000006f8
    Arg4: fffff88001892c24
    
    Debugging Details:
    ------------------
    
    
    BUGCHECK_STR:  0x7f_8
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
    
    PROCESS_NAME:  TunnelServer.e
    
    CURRENT_IRQL:  2
    
    LAST_CONTROL_TRANSFER:  from fffff80002cc82a9 to fffff80002cc8d00
    
    STACK_TEXT:  
    fffff800`00ba4d28 fffff800`02cc82a9 : 00000000`0000007f 00000000`00000008 00000000`80050031 00000000`000006f8 : nt!KeBugCheckEx
    fffff800`00ba4d30 fffff800`02cc6772 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
    fffff800`00ba4e70 fffff880`01892c24 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0xb2
    fffff880`064db000 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tdx!TdxSendConnection+0x4
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    tdx!TdxSendConnection+4
    fffff880`01892c24 4154            push    r12
    
    SYMBOL_STACK_INDEX:  3
    
    SYMBOL_NAME:  tdx!TdxSendConnection+4
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: tdx
    
    IMAGE_NAME:  tdx.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  4ce79332
    
    FAILURE_BUCKET_ID:  X64_0x7f_8_tdx!TdxSendConnection+4
    
    BUCKET_ID:  X64_0x7f_8_tdx!TdxSendConnection+4
    
    Followup: MachineOwner
    
    
     

    Attached Files:

    #1 happykid, Jun 10, 2011
    Last edited: Jun 10, 2011
  2. Captain Jack

    Captain Jack Extraordinary Member

    Joined:
    Mar 6, 2010
    Messages:
    1,952
    Likes Received:
    139
    Hello there!

    The dump is pointing to Microsoft TDI Translation driver. which may not be the problem. I believe it could be F5 Firepass VPN because the driver it uses is pretty old i.e. F5FltDrv.sys Fri Sep 05 01:26:31 2008 so we have to update those drivers and Uninstall any third party Firewall / Internet Security as if now. You could replace it with Microsoft Security Essentials.

    I would appreciate if you get me the MSINFO32 file.

    Code:
    UNEXPECTED_KERNEL_MODE_TRAP (7f)
    This means a trap occurred in kernel mode, and it's a trap of a kind
    that the kernel isn't allowed to have/catch (bound trap) or that
    is always instant death (double fault).  The first number in the
    bugcheck params is the number of the trap (8 = double fault, etc)
    Consult an Intel x86 family manual to learn more about what these
    traps are. Here is a *portion* of those codes:
    If kv shows a taskGate
            use .tss on the part before the colon, then kv.
    Else if kv shows a trapframe
            use .trap on that value
    Else
            .trap on the appropriate frame will show where the trap was taken
            (on x86, this will be the ebp that goes with the procedure KiTrap)
    Endif
    kb will then show the corrected stack.
    Arguments:
    Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
    Arg2: 0000000080050031
    Arg3: 00000000000006f8
    Arg4: fffff88001858c24
    
    Debugging Details:
    ------------------
    
    
    BUGCHECK_STR:  0x7f_8
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
    
    PROCESS_NAME:  TunnelServer.e
    
    CURRENT_IRQL:  2
    
    LAST_CONTROL_TRANSFER:  from fffff80002ce52a9 to fffff80002ce5d00
    
    STACK_TEXT:  
    fffff880`0330dce8 fffff800`02ce52a9 : 00000000`0000007f 00000000`00000008 00000000`80050031 00000000`000006f8 : nt!KeBugCheckEx
    fffff880`0330dcf0 fffff800`02ce3772 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
    fffff880`0330de30 fffff880`01858c24 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0xb2
    fffff880`08758000 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tdx!TdxSendConnection+0x4
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    tdx!TdxSendConnection+4
    fffff880`01858c24 4154            push    r12
    
    SYMBOL_STACK_INDEX:  3
    
    SYMBOL_NAME:  tdx!TdxSendConnection+4
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: tdx
    
    IMAGE_NAME:  tdx.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  4ce79332
    
    FAILURE_BUCKET_ID:  X64_0x7f_8_tdx!TdxSendConnection+4
    
    BUCKET_ID:  X64_0x7f_8_tdx!TdxSendConnection+4
    
    Followup: MachineOwner
     
  3. happykid

    happykid New Member

    Joined:
    Jun 10, 2011
    Messages:
    4
    Likes Received:
    0
    Ok, thanks for taking a look.

    I've currently got the latest software, and if I use the web interface to open a vpn tunnel then it should check if the driver is older than the one on the vpn box. And that one was updated not that long ago. There is also "urvpndrv F5 Networks VPN Adapter 05.01.2011 00:22:20" which is fairly new.

    There are no third party Firewall / Internet Security installed on the laptop at the moment since its just a clean install to find out what could be the problem. Less clutter is always better :p

    Ive attached the Msinfo file.
     

    Attached Files:

  4. Captain Jack

    Captain Jack Extraordinary Member

    Joined:
    Mar 6, 2010
    Messages:
    1,952
    Likes Received:
    139
    Did you check with the VPN vendor about this issue. because when it comes to specific software vendor i'm not sure how it fix it. You might wanna contact their support.
     
  5. gfuchs

    gfuchs New Member

    Joined:
    Jul 13, 2011
    Messages:
    4
    Likes Received:
    0
    Having the same problem. Seems to be .ppt files.
    Both Thinkpads and Dell systems.
    Have you opened a case with F5?

    I'm going to tomorrow.

    Greg
     
    #5 gfuchs, Jul 13, 2011
    Last edited: Jul 13, 2011
  6. Pssinatl

    Pssinatl New Member

    Joined:
    Aug 4, 2011
    Messages:
    4
    Likes Received:
    0
    Same issue on an HP desktop. I find that it is big files, which is often (but not always) ppt files. my issue started the day my employer changed VPN toF5. If you her anything from f5 ticket please post, thanks.
     
  7. gfuchs

    gfuchs New Member

    Joined:
    Jul 13, 2011
    Messages:
    4
    Likes Received:
    0
    This is a Microsoft issue that was introduced in SP1 according to F5 support.
    KB 2519736

    F5 does have a hotfix that fixed the problem for us for 7.0
    HF-361049

    Greg
     
    #7 gfuchs, Aug 5, 2011
    Last edited: Aug 5, 2011
  8. Pssinatl

    Pssinatl New Member

    Joined:
    Aug 4, 2011
    Messages:
    4
    Likes Received:
    0
    Many thanks.
     

Share This Page

Loading...