Solved

ASA5510 and ISA 2006

Posted on 2011-03-10
5
628 Views
Last Modified: 2012-05-11
Hi all,

Currently we have a PIX515 as our Internet Edge FW connecting to an ISA 2006 server.  We also have remote VPN users who use Windows Dial-Up networking (PPTP)  terminating on the PIX.  Now we need to replace the PIX with an ASA5510.  As this cutover needs to be transparent to the VPN users we will need to terminate the VPN connections on the ISA as the ASA does not support PPTP.

Any suggestions on the best way to allow the passthrough to the ISA server and is there any other stumbling blocks that would be in my way when I replace the PIX with the ASA?
0
Comment
Question by:MadMenSA
  • 3
  • 2
5 Comments
 
LVL 35

Accepted Solution

by:
Ernie Beek earned 500 total points
Comment Utility
For PPTP passthrough you would need to allow the GRE protocol and tcp port 1723 to the ISA server:

access-list acl_outside permit gre any host vpn_external
access-list acl_outside permit tcp any host vpn_external eq 1723

And apply it of course:
access-group acl_outside in interface outside

And you will need a 1-1 static:
static (inside,outside) vpn_external vpn_internal netmask 255.255.255.255

That should do it.
0
 

Author Comment

by:MadMenSA
Comment Utility
Thanks erniebeek.

Would I need to include an inspect PPTP command?  

Also, any ideas on the VPN server config on the ISA?
0
 
LVL 35

Expert Comment

by:Ernie Beek
Comment Utility
If I remember correctly that should only be necessary for outgoing connections. On the other hand, it wouldn't hurt to try.

I'm not an ISA guru, but this might help you, though it's for 2004: http://technet.microsoft.com/nl-nl/library/cc713329(en-us).aspx

If we're lucky, keith_alabaster might drop by (that's the man from I.S.A.  :)
0
 

Author Comment

by:MadMenSA
Comment Utility
Thanks erniebeek.
0
 
LVL 35

Expert Comment

by:Ernie Beek
Comment Utility
Thank you (for the points as well), glad I could help.
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Have you experienced traffic destined through a Cisco ASA firewall disappears and you do not know if the traffic stops in the firewall or somewhere else? The solution is the capture feature. This feature was released in 6.2(1) and works in all firew…
From Cisco ASA version 8.3, the Network Address Translation (NAT) configuration has been completely redesigned and it may be helpful to have the syntax configuration for both at a glance. You may as well want to read official Cisco published AS…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now