Hello all,
When moving outbound pptp rules from Pix to 2821 ISR IOS 12.4.
Config is as follows:
ip inspect myfw pptp
int g0/0
ip access-group Acl_Inside in
ip inspect Cbac_Dmz out
ip nat inside
interface Vlan1
description ** Outside **
ip address x.x.x.x 255.255.255.240
ip access-group Acl_Outside in
ip verify unicast reverse-path
ip inspect myfw out
ip nat outside
ip virtual-reassembly
ip nat inside source list Acl_Nat_Outside interface Vlan1 overload
ip access-list extended Acl_Nat_Outside
permit ip any any
ip access-list extended Acl_Inside
permit tcp host <inside IP> host <outside pptp server ip> eq 1723
permit gre host <inside IP> host <outside pptp server ip>
ip access-list extended Acl_Outside
....
If I don't have this in Acl_Outside
permit gre host <outside pptp server ip> host <router outside ip>
returning gre session from outside pptp server can't be established.
On pix, it is not necessary, gre returning session is automatically created.
Furthermore, pptp keyword is not recognized, I must give 1723 instead.
Is it another bug ?
