New to PIX

[Javamahn]

Where can I find a good example of how to setup a VPN providing Microsoft based clients with Windows 2000 terminal services? Many of the remote users have DSL or Cable internet connections and want to be able to dialin with those broadband connections to a terminal services system. We are currently using dedicated PCanywhere workstations over a modem so anything is an improvement. Should I use the built-in PPTP VPN connection that comes with MS 9x systems or the Cisco client? I want something that a non technical end user can install and not call me up at 3:00 am asking how to do it..

Thank you in Advance

 

[Javamahn]

I forgot to state that we are using a PIX 506 with 6.1 software.

 

[netwrkr]

Hello,

This web page

http://www.cisco.com/warp/public/110/top_issues/pix/pix_index.shtml

-- available without a CCO login will be of great use to you. Specifically the answer to your question lies at

http://www.cisco.com/warp/public/110/pptppix.html

Have never had much use for the Cisco VPN client. My experience with it is that the Windows built in VPN connector works much easier and is a 15 second setup.

Tom

 

[Javamahn]

Thank you netwrkr.

 

[Javamahn]

I setup the config as per the example in the above URL. I am having trouble getting a WindowsXP Pro client to connect using the builtin PPTP client. The client is on a Cox@home cable modem with no ICS or any firewalling on the PPP connection. Using debug vpdn packets I can see the tunnel being established but then at the last moment it collapses.
Here is the last packet.

Tnl 74 PPTP: CC I 001000011a2b3c4d000300000100000047291f800200000000000000000000
000040000002000000010000000000000064bb358154bb3581010000000200...
Tnl 74 PPTP: Recvd STOPCCRQ
Tnl 74 PPTP: reason 1
Tnl 74 PPTP: CC O StopCCRP
PPTP: cc snddata, socket fd=1, len=16, data: 001000011a2b3c4d0004000001000000

I have not tried any other clients at this time. Is this XP shutting down the tunnel or is it the Pix?

The authentication is done locally right now. here is some of the PIX 506 config file. The internal network is 10.1.1.0

access-list 101 permit ip 0.0.0.0 255.255.255.0 192.168.1.0 255.255.255.0
ip local pool vpdn-pool 192.168.1.1-192.168.1.50
nat (inside) 0 access-list 101
sysopt connection permit-pptp
vpdn group 1 accept dialin pptp
vpdn group 1 ppp authentication pap
vpdn group 1 ppp authentication chap
vpdn group 1 ppp authentication mschap
vpdn group 1 ppp encryption mppe 40
vpdn group 1 client configuration address local vpdn-pool
vpdn group 1 client configuration wins 10.1.1.1
vpdn group 1 pptp echo 60
vpdn group 1 client authentication local
vpdn username cisco password *********
vpdn enable outside

I setup the WinXP system using the network wizard and chose the VPN option I left everything as default in that setup. Any help would be appreciated.

Steve Anderson (newguy)