Group,
I'm relatively new to Cisco having come from the sysadmin world. I have a small remote site with 5 clients that sits behind a 851w router. No clients behind the router can intiate a pptp session with a remote VPN server over the internet from that site. But, another remote client site is accessed from behind the 851 using IPsec and the clients can connect with no problems. When monitoring syslog messages, I did notice that the following messages are logged when trying to connect to the remote pptp server:
Jun 19 16:02:56 192.168.1.1 47: 000042: *May 16 19:35:04.811 UTC: %IP_VFR-3-SYST
EM_ERROR: : IP VFR System failure - A fragment packet with out pak-subblock
Jun 19 16:03:00 192.168.1.1 48: 000043: *May 16 19:35:08.795 UTC: %IP_VFR-3-SYST
EM_ERROR: : IP VFR System failure - A fragment packet with out pak-subblock
Jun 19 16:03:06 192.168.1.1 49: 000044: *May 16 19:35:14.771 UTC: %IP_VFR-3-SYST
EM_ERROR: : IP VFR System failure - A fragment packet with out pak-subblock
Any ideas? I've included my config for reference:
Current configuration : 4087 bytes
!
version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname xxxxxx
!
boot-start-marker
boot-end-marker
!
logging buffered 51200 debugging
logging console critical
enable secret 5 xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
!
aaa new-model
!
!
aaa authentication login default local
aaa authorization exec default local
!
aaa session-id common
!
resource policy
!
ip subnet-zero
no ip source-route
no ip dhcp use vrf connected
no ip dhcp conflict logging
ip dhcp excluded-address 192.168.1.1 192.168.1.99
!
ip dhcp pool Internal-Net
import all
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1
!
!
ip cef
ip inspect log drop-pkt
ip inspect name MYFW tcp
ip inspect name MYFW udp
ip inspect name MYFW pptp
ip tcp synwait-time 10
no ip bootp server
no ip domain lookup
ip domain name xxxxxxxxxxxxxxx
ip name-server 208.67.220.220
ip name-server 208.67.222.222
ip ssh version 2
!
!
!
username xxxxxxxxxxxxx privilege 15 password 7 xxxxxxxxxxxxxxxxxxxxx
!
!
bridge irb
!
!
interface FastEthernet0
description Windows 7
spanning-tree portfast
!
interface FastEthernet1
description Linux Server
spanning-tree portfast
!
interface FastEthernet2
description Vonage
spanning-tree portfast
!
interface FastEthernet3
description Uplink to Desktop Switch
spanning-tree portfast
!
interface FastEthernet4
description xxxxxxxxxxxxxxxxxxxx
ip address dhcp
ip access-group Internet-inbound-ACL in
no ip redirects
no ip unreachables
no ip proxy-arp
ip inspect MYFW out
ip nat outside
ip virtual-reassembly
ip route-cache flow
ip tcp adjust-mss 1460
duplex auto
speed auto
no cdp enable
!
interface Dot11Radio0
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip route-cache flow
!
encryption vlan 1 key 1 size 128bit 7 xxxxxxxxxxxxxxxxxxxxxx transmit-key
encryption vlan 1 mode wep mandatory
!
ssid xxxxx
vlan 1
authentication open
wpa-psk ascii 7 xxxxxxxxxxxxxxxxxxxxxxxxxx
!
speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0
54.0
channel 2412
station-role root
no dot11 extension aironet
no cdp enable
!
interface Dot11Radio0.1
encapsulation dot1Q 1 native
no snmp trap link-status
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
!
interface Vlan1
description Internal Network
no ip address
ip nat inside
ip virtual-reassembly
bridge-group 1
bridge-group 1 spanning-disabled
!
interface BVI1
description Bridge to Internal Network $FW_INSIDE$
ip address 192.168.1.1 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip virtual-reassembly
ip route-cache flow
!
ip classless
ip route 0.0.0.0 0.0.0.0 dhcp
!
ip https server
ip http secure-server
ip nat inside source list 1 interface FastEthernet4 overload
!
ip access-list extended Internet-inbound-ACL
permit udp any eq bootps any eq bootpc
permit icmp any any echo
permit icmp any any echo-reply
permit icmp any any traceroute
permit gre any any
permit esp any any
permit tcp any any eq 3389
permit tcp any any eq 1723
!
logging trap debugging
logging 192.168.1.3
access-list 1 permit 192.168.1.0 0.0.0.255
no cdp run
!
control-plane
!
bridge 1 route ip
banner motd ^C
*******************************************
*
*
* This is a private device and unauthorized
* access is prohibited. All activity both
* authorized and unathorized is logged and
* monitored.
*
*
********************************************
^C
!
line con 0
exec-timeout 0 0
password 7 xxxxxxxxxxxxxx
logging synchronous
no modem enable
line aux 0
line vty 0 4
session-timeout 45
password 7xxxxxxxxxxxxxxxxxxxxxxxxxxxx
logging synchronous
transport input telnet ssh
!
scheduler max-task-time 5000
scheduler allocate 4000 1000
scheduler interval 500
end
