Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Problem with PPTP VPN on PIX-501

I configured a simple VPN using PPTP with my PIX-501.

I'm able to establish the VPN connection with Windows XP PPTP client. After the connection, I'm able to ping inside hosts but I'm not able to establish any TCP/IP connection from PPTP client to them.

After the connection, I'm able to establish any kind of TCP/IP connection from inside hosts to remote PPTP client.

Any suggestions ?

Thanks a lot !

Here my configuration:

Cisco PIX 6.3(4):

interface ethernet0 auto

interface ethernet1 100full

nameif ethernet0 outside security0

nameif ethernet1 inside security100

hostname pixfw

names

ip address outside **DELETED** 255.255.255.248

ip address inside 192.168.33.1 255.255.255.0

route outside 0.0.0.0 0.0.0.0 **DELETED** 1

telnet 192.168.33.0 255.255.255.0 inside

global (outside) 1 **DELETED**

nat (inside) 1 192.168.33.0 255.255.255.0 0 0

access-list inbound permit icmp any any

access-group inbound in interface outside

access−list no-nat permit ip 192.168.33.0 255.255.255.128 192.168.33.128 255.255.255.128

nat (inside) 0 access−list no-nat

ip local pool vpn-pool 192.168.33.129−192.168.33.254 mask 255.255.255.128

sysopt connection permit−pptp

vpdn group 1 accept dialin pptp

vpdn group 1 ppp authentication mschap

vpdn group 1 ppp encryption mppe auto required

vpdn group 1 client configuration address local vpn-pool

vpdn group 1 client authentication local

vpdn username cisco password cisco

vpdn enable outside

4 REPLIES
Cisco Employee

Re: Problem with PPTP VPN on PIX-501

It could be the routing on th ePIX, seeing as your PPTP pool of addresses is in the same subnet as your inside interface, the PIX may be sending traffic to your PPTP clients back out the inside interface.

Either change the following:

ip address inside 192.168.33.1 255.255.255.128

or add the following:

route outside 192.168.133.128 255.255.255.128

or both.

New Member

Re: Problem with PPTP VPN on PIX-501

Thank you for your reply.

I tried to create a new vpn-pool for PPTP clients.

Now inside hosts are on network 192.168.33.0/24

PPTP clients are on network 192.168.30.0/24

But it still doesn't work !

Do I need to create any route entry ?

Thank you.

Best regards

My new configuration 6.3(4):

interface ethernet0 auto

interface ethernet1 100full

nameif ethernet0 outside security0

nameif ethernet1 inside security100

hostname pixfw

names

ip address outside **DELETED** 255.255.255.248

ip address inside 192.168.33.1 255.255.255.0

route outside 0.0.0.0 0.0.0.0 **DELETED** 1

telnet 192.168.33.0 255.255.255.0 inside

global (outside) 1 interface

nat (inside) 1 192.168.33.0 255.255.255.0 0 0

access-list inbound permit icmp any any

access-group inbound in interface outside

access−list no-nat permit ip 192.168.33.0 255.255.255.0 192.168.30.0 255.255.255.0

nat (inside) 0 access−list no-nat

ip local pool vpn-pool 192.168.30.1−192.168.30.254

sysopt connection permit−pptp

vpdn group 1 accept dialin pptp

vpdn group 1 ppp authentication mschap

vpdn group 1 ppp encryption mppe auto required

vpdn group 1 client configuration address local vpn-pool

vpdn group 1 client authentication local

vpdn username cisco password cisco

vpdn enable outside

New Member

Re: Problem with PPTP VPN on PIX-501

You shouldn't need the route. What happens when you attempt to connect? Are you sure your settings are correct on your pc? Are you taking the default settings with the included pptp vpn connection in Windows XP/2000?

By the way, using the 192.x.x.x networks for your internal and your pptp pool, causes issues when you start trying to surf the internet while connected to the vpn. If everything is new and not hard to change, I would do an internal network of 10.x.x.x and a pptp pool of 192.x.x.x.

P.S., before someone suggests, using split tunnel, that really doesn't work so well without using the Cisco VPN client and IPSEC.

New Member

Re: Problem with PPTP VPN on PIX-501

I guess there is no problems if u have both ur inside interface 2 b in d same subnet as d VPN pool. Till date I had a perfectly working config 4 past 4-5 mths. I have recently migrated 2 192.168.x.x n/w 4 VPN & my inside n/w is 172.16.x.x. Also if I am not wrong d concept of split tunneling only works with Cisco VPN client. But inspite of making d IP addressing scheme change in my n/w I face d exact problem as mentioned in this post. Even I have put up a similar post but I have not found any successful replies. If I chk my f/w logs it shows a msg saying tht d traffic on d outside interface is not IPSec. Thus I get correctly authenticated using windows xp inbuilt PPTP VPN but no data xfer happens. But when I connect using d Cisco VPN client it works perfectly (with Split tunneling enabled). Even I wud appreciate sum help on this.

299
Views
0
Helpful
4
Replies