New to ASA: Need some feedback

[thecoffeeguy]

I have been asked to setup a VPN connection, using PPTP from the vendors location (public IP addresses have been given) to servers within our network.

I went out and grabbed some ASA books (Hucaby Handbook) and will be going over it.

In the meantime, does anyone have suggestions on how to get started?

In a nutshell, I need a crash course to get up to speed.

Here is what I have so far:

20.10.5.2 -- remote host making connection

32.16.8.4 -- public IP statically assigned to internal authentication server

access-list inbound_pptp_traffic permit gre host 20.10.5.2 host 32.16.8.4
access-list inbound_pptp_traffic permit tcp host 20.10.5.2 host 32.16.8.4 eq 1723
static (inside,outside) 32.16.8.4 172.15.5.1 255.255.255.255
access-group inbound_pptp_traffic in interface outside

That look right?
do I need to setup a rule to make sure the return traffic would get through?

thanks.

 

[Supergrrover]

This is for PIX 6.3.x code but the process is similar.

http://www.cisco.com/en/US/products...s_configuration_example09186a0080143a5d.shtml

Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[thecoffeeguy]

Thanks. I should have been more specific.
We have a authentication server internally (RRAS I believe...first week, so I am learning.)

So, I was thinking I could use sort of what I had in the ACL's above. That way, the incoming connections get forwarded to the authentication server which is where authentication happens. That way, the ASA just forwards port 1723 to the correct server.

I was using a 1-to-1 mapping for the internal server.

I found this:

http://www.cisco.com/en/US/products...ration_example09186a0080094a5a.shtml#pptpwith

I was just curious on a few things:
Since I have 7 public IP addresses given to me, I need to setup rules for each IP address? essentially, 14 new ACL's?

Secondly, what about return traffic? I am new to ASA, so I didn't know if their are any caveats about making sure the VPN traffic will return properly to the originating machine.

Thanks Brent. Appreciate your help.

Jason

 

[Supergrrover]

You can have the pix terminate the tunnel but have it authenticate to the 2003 server - IAS. That takes a bit more to configure. I would have the pix terminate the PPTP vpns, but you can do it the other way. The 2003 server would need 2 NICs.

Here is more what you are looking for

http://www.cisco.com/en/US/products...s_configuration_example09186a0080094a5a.shtml

The pix/asa is adaptive and understands the connection back out once it is established. No worries.


Brent
Systems Engineer / Consultant
CCNP, CCSP