PPTP VPN on a Cisco 877 router - ZBPF

Unanswered Question
Jul 13th, 2010

Hi there,

I'm trying to configure a PPTP tunnel for remote users to access inside network resources, before enabling the firewall (ZBPF) all worked perfectly, tunnel comes up and worked perfectly.

Once I've tried to define zone-pair/policy-maps the VPN connection never came up again. Here is my firewall configuration:

class-map type inspect match-all PPTP-Pass-Through-Traffic
match access-group name PPTP-PASS-THROUGH
class-map type inspect match-any All-Traffic
match protocol tcp
match protocol udp
match protocol icmp
class-map type inspect match-all Router-Access-Traffic
match access-group name Router-Access
class-map type inspect match-all PPTP-Terminated-Traffic
match access-group name PPTP-TERMINATED
policy-map type inspect PPTP-In-Policy
class type inspect All-Traffic
class class-default
  drop log
policy-map type inspect Out-In-Policy
class type inspect PPTP-Pass-Through-Traffic
class class-default
policy-map type inspect In-Out-Policy
class type inspect All-Traffic
class class-default
  drop log
policy-map type inspect Out-Self-Policy
class type inspect Router-Access-Traffic
class type inspect PPTP-Terminated-Traffic
class class-default
  drop log
zone security outside
zone security inside
zone security pptp
zone-pair security outside-self source outside destination self
service-policy type inspect Out-Self-Policy
zone-pair security pptp-in source pptp destination inside
service-policy type inspect PPTP-In-Policy
zone-pair security inside-outside source inside destination outside
service-policy type inspect In-Out-Policy

ip access-list extended PPTP-PASS-THROUGH
permit gre any any
ip access-list extended PPTP-TERMINATED
permit gre any any
permit tcp any any eq 1723
ip access-list extended Router-Access
permit tcp any any eq telnet
permit tcp any any eq 22
permit tcp any any eq 443

pptp zone is associated with the Virtual-Template used for the pptp connections.

Here is the error log message:

Jul 13 17:46:47: %FW-6-DROP_PKT: Dropping Unknown-l4 session X.X.X.X:0 Y.Y.Y.Y.14:0 on zone-pair outside-self class class-default due to  DROP action found in policy-map with ip ident 0

where XXXX is the remote IP (for the user who's trying to connect)

and YYYY is the router IP address.

Router version:

Version 12.4(24)T3, RELEASE SOFTWARE (fc2)

The remote client (windows software) give the following error after a while (freeze on authenticating user and password):

Error 734: The PPP link control protocol was terminated

I've no idea how to solve this... I've followed exactly this tutorial from Cisco: https://www.cisco.com/en/US/products/ps5855/products_configuration_example09186a0080ab7073.shtml

Thanks for your help!


I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)


This Discussion