Hi Kev

Thanks for your response. I guess I am making a mistake here. Actually I am just using my domain name and password to get authenticated which is through the Win 2003 SBS server. So I dont think I need

vpdn group 1 client authentication local

vpdn username cisco password cisco

(But again I tried this as well and didnt work)

But do I have to use any command for windows based authentication?

I have created a VPN connection and on properties, I have tabs as below

General - public IP of office Internet

Options - all are checked on dialing options

(display progress, prompt for name & pwd, include windows logon domain)

Security - typical

required secured password under validate my identity

automatically use my windows logon name, pwd - unchecked

require data encryption - unchecked

networking - PPTP VPN (type of VPN)

Advanced - win firewall is off

internet connection sharing - unchecked

Please advise

Hi

Having re-read your original post, I have a few further thoughts as to why it will not work. You do not need to open 1723 and 500 on the pix, your vpdn configuration allows pptp to bypass conduit/acl checks when it is enabled (the sysopt connection permit-pptp command). However, I think you do need to ensure you have permitted 1723 outbound (likely) and GRE (protocol 47) inbound (unlikely), and that you are using a 1-to-1 static NAT translation between your inside private address on your 172.16.0.0 network and (one of) your public address on your outside block.

If you only have PAT and are not able to configure a static NAT entry then I don't think it will work. The alternative would be to configure an NAT-T aware IPSEC VPN tunnel to the Pix using the Cisco VPN Client, which will happily work with PAT - details of how to configure this can be found here:

http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a008009442e.shtml

and nat-t here:

http://www.cisco.com/en/US/docs/security/pix/pix63/configuration/guide/ipsecint.html#wp1057446

Regards

Kev

Hi Kev

I did not expect that this is so critical or may be just critical for me. I have attached the config here. It worked pretty well when Linksys router was in place and just these issues after replacing with PIX. Unfortunately I dont have much time and I may have to revert back if this doesnt work in next few hours.

I am not sure if I am doing some basic mistakes here about the user authentication etc. When I enable logging, I am getting this message. PPTP: Call id 32975, no session

Can you please check the config and advise. I am looking at other solutions now. Right now I am not using any Cisco VPN client. I guess these are not free right?

Thanks for all your time

Hi Kev

I have removed the static translations for PPTP and authentication is done locally by PIX and that worked.

Thanks for your time and help