PIX 501 and inside VPN server

[chripa]

I'd like to access an internal VPN (PPTP) server, which is behind the PIX 501 (on the "inside" location).

So I created translation- und filter rules for the VPN server on the PIX for port 1723 and IP protocol GRE (47). I also unchecked "VPN passthrough for PPTP".

BUT the PIX does not allow to access the VPN server in the inside network. Connections to the Web- and Mailserver works fine; portscan too but NOT the connection to the VPN server! (???)

Is there a possibility to get this running? Maybe did I forget to make some additional changes?


Please help me - it's urgent. ;o)

Thanks in advance!
Regards, Chris

 

[brianinms]

Why in the world would you want to use PPTP when you can use IPSEC vpns on the Pix? Post your configuration.

 

[chripa]

I know that theres a security risc using PPTP; but I only want to try out how to connect to a VPN (PPTP) server BEHIND the PIX... Which things do I have to do?

As already said - I opened port 1723 and protocol 47 (gre) on the PIX. This should work, but it doesn't... Just see my first thread.

If really neccessary, I can post my configuration...


Regards, Chris

 

[Supergrrover]

You should allow the PPTP through the pix. I am not sure if it adds this line but it should be in there
fixup prot pptp

http://www.cisco.com/en/US/products...s_configuration_example09186a0080094a5a.shtml

Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[chripa]

Thanks for the tip and the weblink! But on this website, they assume that the VPN client outside has a static ip address; but my inside PPTP server uses dynamic address assigning to any host anywhere in the internet which is connected to the server (DHCP).

So - do I need to open some DHCP Ports?!?

I'm really confused... :s(


Thanks in advance -
Chris

 

[Supergrrover]

Go ahead and post your scrubbed config and a description of the topology.


Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[chripa]

Thanks for your tips - it works fine after entering a few terminal commands.

So this topic is solved for me; thanks again to all people who gave suggestions!!!


Best regards
Chris ;o)