?
Solved

PIX 501 PPTP VPN Config

Posted on 2005-03-09
13
Medium Priority
?
635 Views
Last Modified: 2010-04-12
Would someone mind checking over my config?  I can't seem to get a PPTP VPN session running.  This is my home/test PIX and I'm trying to connect from work.  Here's what I've got:

6.3(3)
nat (inside) 0 access-list 109
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-list 109 permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list outside_access_in permit tcp any any eq pptp
access-list outside_access_in permit gre any any
vpdn group VPN-PPTP accept dialin pptp
vpdn group VPN-PPTP ppp authentication mschap
vpdn group VPN-PPTP ppp encryption mppe auto
vpdn group VPN-PPTP client configuration address local IPPOOL
vpdn group VPN-PPTP client configuration dns Morpheus Mail
vpdn group VPN-PPTP pptp echo 120
vpdn group VPN-PPTP client authentication local
vpdn username cspence password *********
vpdn enable outside

I get a 721 'no response from remote server'.  You can find a jpg of a an Ethereal capture I ran from my work PC while trying to connect here:  http://matrix-domain.net/capture.jpg

Thanks everyone!

Cory
0
Comment
Question by:cory_spence
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
  • 4
  • 2
13 Comments
 
LVL 7

Expert Comment

by:minmei
ID: 13508230
Try adding:

vpdn group VPN-PPTP ppp authentication pap
vpdn group VPN-PPTP ppp authentication chap

0
 
LVL 7

Expert Comment

by:minmei
ID: 13508258
Forget that.  Is your work allowing GRE and PPTP (TCP 1723) outbound and back in (more important)?
0
 

Author Comment

by:cory_spence
ID: 13509230
Should be.  I'm in a NAT pool on a PIX 525 here at work, so it should be statefully opening GRE and PPTP to come back in when I initially send the traffic out.  Do I specifically need a conduit on my work PIX to permit GRE traffic from any host?

C
0
Connect further...control easier

With the ATEN CE624, you can now enjoy a high-quality visual experience powered by HDBaseT technology and the convenience of a single Cat6 cable to transmit uncompressed video with zero latency and multi-streaming for dual-view applications where remote access is required.

 
LVL 7

Expert Comment

by:minmei
ID: 13514247
Yes. The GRE traffic can start on the outside, requiring the conduit/ACL, whichever you are using.

access-list outside_int permit gre host <homeserver> host <static translation for PC>

static (inide,outside) <outsideaddr> <insideaddr of pc> netmask 255.255.255.255 0 0

If your pix is 6.3 or later, just add

fixup protocol pptp 1723

See this link: http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a0080094a5a.shtml
0
 

Author Comment

by:cory_spence
ID: 13514378
We're running an old version at work with conduits.  Entered 'conduit permit gre any any' and it still couldn't connect.

Any ideas?

C
0
 
LVL 19

Expert Comment

by:nodisco
ID: 13515198
Cory

Add
sysopt connection permit-pptp

i take it you have the vpdn pool IPPOOL configured?  Its just that you didn't post it in your config

ip local pool IPPOOL x.x.x.x-y.y.y.y

cheers

Steve


0
 

Author Comment

by:cory_spence
ID: 13515367
Sorry, I actually do have both those in my config.  Just forgot to post it.

Thanks though!

C
0
 
LVL 7

Expert Comment

by:minmei
ID: 13515872
What about the static translation? If you are runnign an old version of PIX software, you neeed to have a one-to-one translation for your pc. No Port-address-translation.

You need to have the below:

static (inside,outside) <outsideaddr> <insideaddr of pc> netmask 255.255.255.255 0 0

to make this work, unles you are running 6.3 or greater.

Just having your pc translated at the port level with a global command won't work.
0
 
LVL 19

Expert Comment

by:nodisco
ID: 13517052
What specific error are you getting when trying to connect?

I noticed in your packet capture that your problems are at LCP level.  This could well be authentication - can you try using pap as the auth and configuring your pptp connection accordingly.  This will at least help to isolate where the problem is occurring

0
 
LVL 7

Expert Comment

by:minmei
ID: 13517978
good call - if I remember correctly PIX (old) only worked with pap ppp authentication, thus my first post.
0
 

Author Comment

by:cory_spence
ID: 13570123
Sorry for the delay - been pretty busy.

I ran the connection from a laptop using dial-up and was able to connect.  Must be something with the work PIX.  Not too concerned with that at the moment.

However, on the laptop, I can't do anything when the PPTP VPN connection is up.  I'm assigned an address from my pool, and I'm getting the DNS server I configured, but no pings to my internal home network and no Internet.

Does the PIX pool of addresses have to be on a different subnet to work - seems like I read this somewhere?  Currently the inside interface of my 501 lies in the 192.168.1.x network, which is the same network I'm handing out addresses from in my pool.

Thanks,
C
0
 
LVL 7

Accepted Solution

by:
minmei earned 750 total points
ID: 13570452
That would be a problem. Change the range.

You also have to specify to _not_ NAT packets from the inside to the external range you give out.
0

Featured Post

Enroll in August's Course of the Month

August's CompTIA IT Fundamentals course includes 19 hours of basic computer principle modules and prepares you for the certification exam. It's free for Premium Members, Team Accounts, and Qualified Experts!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Preface Having the need * to contact many different companies with different infrastructures * do remote maintenance in their network required us to implement a more flexible routing solution. As RAS, PPTP, L2TP and VPN Client connections are no…
Do you have an old router lying around the house that you don’t know what to do with? Check the make and model, then refer to either of these links to see if its compatible. http://www.dd-wrt.com/site/support/router-database http://www.dd-wrt.c…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…
Suggested Courses
Course of the Month10 days, 2 hours left to enroll

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question