Pix w/PPTP pass through 1

[DKMOORE]

We have a pix515 that I am trying to setup to allow a couple of users on the inside to establish VPN connections to a MS RAS server on the outside using PPTP.

I have NAT & PAT setup on the PIX -
Currently all inside host are getting NAT/PAT to outside address pool - see following config data

global (outside) 1 xxx.158.224.108-xxx.158.224.109
global (outside) 1 xxx.158.224.110
nat (inside) 1 172.16.10.0 255.255.255.0 0 0

My question is - if I setup a static translation for these clients, do they then get translated again due to the global translation?

Do I have to exclude them from the other nat statement?
If so how?

Any Ideas or info would be greatly appreciated!

Don

 

[dopehead]

No, a static translation always overrides a global.

Beware though you might get an issue with PPTP...really not a nice protocol
You might need to upgrade to 6.3 for PPTP to work through NAT of any kind.

If you have any kind of filters outbound you should open IP Protocol 47 (GRE) and TCP 1723 outbound.

Jan

 

[bwilliam13]

Upgrade to PIXOS 6.3.x and you can use PPTP through your NAT...you won't need static translations.

 

[EddieVenus]

I would like to know the answer to this question as well, as it is something I am doing too.

How to I enable PPTP through NAT?

 

[EddieVenus]

Never mind I found it. (text below pulled from CCO)


Commands to Add for Version 6.3
The following procedure explains which commands to add for version 6.3.

Enable the fixup protocol pptp 1723 using the following command.

pixfirewall(config)#fixup protocol pptp 1723

You do not need to define a static mapping if the PPTP fixup protocol is enabled; you can use PAT.

pixfirewall(config)#nat (inside) 1 0.0.0.0 0.0.0.0 0 0

pixfirewall(config)#global (outside) 1 interface

 

[dopehead]

This is true, but isn't it only one session you can do through PAT ? i think i saw something about that in the rel notes.

 

[bwilliam13]

No. It's one session per host to the same destination. If you start another PPTP session to another server from the same host, it connects just fine.