Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

PPTP through Cisco 1841

Hi All


Setup is as follows

c1841-advsecurityk9-mz.124-16.bin

Clients PC on Win 7 PPTP connection to a Public IP -----> Cisco 1841 onsite---->Internet

Client gets error 619. Now, client does have a site to site vpn configured on router to connect to a different customer and thats working fine.

When we dial pptp connection using windows 7, on cisco router I get

     %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet.

    (ip) vrf/dest_addr= /<Router's Wan IP>, src_addr= <Public IP of destination>, prot= 47

Destination in question is not cisco and doesnt use ipsec. It works if i use my wifi 3g card so destination is not an issue

Win7 Firewall is disabled (FYI)

interface Dialer0
description SHDSL Primary Dialer
ip address negotiated
ip nat outside
ip nat enable
ip virtual-reassembly
encapsulation ppp
dialer pool 1
dialer idle-timeout 2147483
dialer-group 1
no cdp enable
ppp authentication chap pap callin
ppp chap hostname ...
ppp chap password ...
crypto map VPN

ip nat source list 100 interface Dialer0 overload

access-list 100 deny   ip 192.168.0.0 0.0.0.255 host <Wan IP of different customer>
access-list 100 permit ip 192.168.0.0 0.0.0.255 any
access-list 100 permit gre any any

access-list 100 permit tcp any any eq 1723

access-list 120 permit ip 192.168.0.0 0.0.0.255 host <Wan IP of different customer>

crypto isakmp policy 1
encr aes
authentication pre-share
group 2
!
crypto isakmp policy 10
encr 3des
authentication pre-share
lifetime 86000
!
crypto isakmp policy 20
encr 3des
authentication pre-share
group 2
lifetime 28800

crypto isakmp key  sharedkey address <Wan IP of different customer>

crypto ipsec transform-set Pactolus-cc esp-3des esp-sha-hmac

crypto map VPN 20 ipsec-isakmp
set peer <Wan IP of different customer>
set transform-set Pactolus-cc
set pfs group2
match address 120

Since acl 120 is precisely for a source destination, I should be able to receive non ipsec packets on device.

Any clue/suggestions appreciated.

19 REPLIES
Community Member

Re: PPTP through Cisco 1841

anyone?

Cisco Employee

Re: PPTP through Cisco 1841

i am not sure if i understand your requirement or setup correctly

please clarify to which interface of 1811 your r connecting win 7 clients

and what is its relevance to site to site

just too confused, please clarify

Community Member

Re: PPTP through Cisco 1841

ok lets make it as easy as following.

client pc using windows 7 PPTP VPN ---->Through Clients onsite 1841------>Destination Public IP

FAILS. Message logged on router being

%CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet.

    (ip) vrf/dest_addr= /, src_addr= , prot= 47

Or in simple words, pptp doesnt work THROUGH cisco 1841.

I hope i have made it simple?

Thanks

Aman

Cisco Employee

Re: PPTP through Cisco 1841

again this is what confuses me

FAILS. Message logged on router being

%CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet.

    (ip) vrf/dest_addr= /, src_addr= , prot= 47

tells me pptp is terminating on router

Or in simple words, pptp doesnt work THROUGH cisco 1841.


this gives me a feeling that you are configuring router as pass through

please clarify which is true

or is it that these win 7 boxes are behind a router 1811 and are trying to conenct to pptp server on the outside

sorry but i am still confused

Community Member

Re: PPTP through Cisco 1841

yes mate you are right

win 7 boxes are behind a router 1811 and are trying to conenct to pptp server on the outside

and is pptp server

Cisco Employee

Re: PPTP through Cisco 1841

do you have any firewall on the route, if so then use inspect pptp

also try doing static one to one nat to this client PC and then try pptp

Community Member

Re: PPTP through Cisco 1841

There is no ip inspection present on the router. I will do static nat
and reply back

Community Member

Re: PPTP through Cisco 1841

hello Aman

I'm having this same problem. Could you fix it? If so

could you share the solution.

Thanks

Pat

Community Member

Re: PPTP through Cisco 1841

Hi pat

Apparently the other end was not setup correctly in my case. They did setup the other end for ipsec. I ended up setting up a site to site vpn with them. Also, I was having an ACL  that was matching all gre packets and was passing it to another site to site vpn. i made it more precise. So make sure you have precise ACLs to isolate the issue. Make sure other end is configured correctly. Do you see any messages logged at other end? debugs?

Community Member

Re: PPTP through Cisco 1841

Thanks for answering Aman seems to me that my case is different from yours, I dont have deployed site to site

we establish VPNs to different customers from our office, the issue we have is when we try to connect to the network customers through PPTP, we have no problems against IPSEC clients, you had something similar?

Any recommendation,

I stay aware of your comments

PD: English is not my native language

Community Member

Re: PPTP through Cisco 1841

In first instance I was trying to setup pptp through 1841. THen I ended up deploying a site to site vpn.

I am not sure but based upon your response it sounds like PPTP works for you. it looks more of a windows client settings issue. if you check the security tab there is an option to enter preshared key for an ipsec conenction. try that if that is the issue

Community Member

Re: PPTP through Cisco 1841

Indeed passtrhough PPTP is the problem we have. Let me give you a picture of ourporblem for clarification.

user lan> 1811 router> dsl> customer IPSEC vpn OK

user lan> 1811 router> dsl> customer PPTP vpn  Fail

I stay aware of your comments

Thanks

Community Member

Re: PPTP through Cisco 1841

Has it ever worked? You might be encrypting entire traffic. Error messages, debug, config might help

Community Member

Re: PPTP through Cisco 1841

Thanks for responding Aman

PPTP has never worked, I see no logs listed in the CLI, sent the configuration that is operating on the router.

Community Member

Re: PPTP through Cisco 1841

I havent seen your config yet but you should remove it asap from here. you have provided all the password information in there

and please change all your passwords as well

Community Member

Re: PPTP through Cisco 1841

as i mentioned earlier you config has an acl to match all gre traffic and then tunnel it.

Windows pptp vpn using tcp/1723 and the gre (ip/47).

so make your acls precise as per reqquirement.

Community Member

Re: PPTP through Cisco 1841

Ok Aman but we have set these ACLs that allow this traffic.

Community Member

Re: PPTP through Cisco 1841

please make it specific. as in specify based on destination may be.

Community Member

Re: PPTP through Cisco 1841

Hello Aman

Perform the configuration that tells me, and did not get good results.

access lists to enter were:

access-list 101 permit tcp host and Stock [Server-IP] eq 1723log
access-list 101 permit gre host and Stock [Server-IP] log
access-list 101 permit tcp host and Stock [Server-IP] eq 47 log
access-list 101 permit tcp host and Stock [Server-IP] eq 1701 log
access-list 101 permit udp host and Stock [Server-IP] eq isakmp log
access-list 101 permit esp host and Stock [Server-IP]
access-list 101 permit ahp host and Stock [Server-IP]
access-list 101 permit ip any any

Also remove all ACL that is permitted all the traffic and I still have the same problem, I suggest something? another deployment eg

Greetings

3469
Views
0
Helpful
19
Replies
CreatePlease to create content