help me get my pix to allow pptp vpn through it

Unanswered Question
Feb 27th, 2007

Hello,

I have a problem with a 501 firmware 6.3

I need to allow my internal users to access a vpn in the US we are in the UK. Everytime my users try to access the US VPN it failes on reply from the US.

I have read the cisco docs which tell me to do a fixup protocol pptp 1723 which I have I have also tried opening the gre on the accesslist but I still cannot get it working. If I dont use the pix it works fine. Any ideas I have posted the config below.

Thanks

PIX Version 6.3(5)

interface ethernet0 auto

interface ethernet1 100full

nameif ethernet0 outside security0

nameif ethernet1 inside security100

enable password

passwd

hostname internetfirewall

domain-name foobar.co.uk

fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol pptp 1723

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

no fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69

names

access-list acl_out permit tcp any host 1.1.1.1 eq smtp

access-list acl_out permit tcp any host 1.1.1.1 eq https

access-list acl_out permit gre any any

access-list acl_out permit icmp any any echo-reply

access-list acl_out permit icmp any any echo

access-list 101 permit ip 10.0.0.0 255.255.255.0 192.168.50.0 255.255.255.0

pager lines 24

mtu outside 1500

mtu inside 1500

ip address outside 1.1.1.1 255.255.255.248

ip address inside 10.0.0.254 255.255.255.0

ip audit info action alarm

ip audit attack action alarm

ip local pool pptp-pool 192.168.50.200-192.168.50.250

pdm logging informational 100

pdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 access-list 101

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

static (inside,outside) tcp 1.1.1.1 smtp 10.0.0.1 smtp netmask 255.255.255

.255 0 0

static (inside,outside) tcp 1.1.1.1 https 10.0.0.1 https netmask 255.255.2

55.255 0 0

access-group acl_out in interface outside

route outside 0.0.0.0 0.0.0.0 212.85.249.49 1

timeout xlate 0:05:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout sip-disconnect 0:02:00 sip-invite 0:03:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server TACACS+ max-failed-attempts 3

aaa-server TACACS+ deadtime 10

aaa-server RADIUS protocol radius

aaa-server RADIUS max-failed-attempts 3

aaa-server RADIUS deadtime 10

aaa-server LOCAL protocol local

aaa authentication ssh console LOCAL

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

sysopt connection permit-pptp

telnet 10.0.0.0 255.255.255.0 inside

telnet timeout 5

ssh x.x.x.x 255.255.255.240 outside

ssh x.x.x.x 255.255.255.248 outside

ssh x.x.x.x 255.255.255.248 outside

ssh x.x.x.x 255.255.255.248 outside

ssh x.x.x.x 255.255.255.248 outside

ssh x.x.x.x 255.255.255.252 outside

ssh x.x.x.x 255.255.255.255 outside

ssh x.x.x.x 255.255.255.252 outside

ssh timeout 60

console timeout 0

vpdn group 1 ppp authentication pap

vpdn group 1 ppp authentication chap

vpdn group 1 ppp authentication mschap

vpdn group 1 ppp encryption mppe auto

vpdn group 1 client configuration address local pptp-pool

vpdn group 1 pptp echo 60

vpdn group 1 client authentication local

vpdn username xperience password *********

vpdn enable outside

username **** password *** encrypted privilege 2

terminal width 80

Cryptochecksum:****

: end

[OK]

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
suschoud Fri, 03/02/2007 - 12:02

hi,

if you have only one client on the inside and fixup is there,then i believe you should connect.

now,if that does n't happen: do u have free public ip addresses.

let's say you have 3 clients on the inside.

7.7.7.7

8.8.8.8

9.9.9.9

and you have three public ip addresses:

4.4.4.4

5.5.5.5

6.6.6.6

you need to statically map these public ip's to the corresponding private ip addresses

static (inside,outside)

also,please add access-list on the outside permitting 1723 from any source to these three public ip's as destination.

put in " cl xlate " and then try to connect.with nat confiugured,i m sure it'll work.

pptp had inherent issues with pat ,but with fixup,it should work.

cheers!!

Actions

This Discussion