Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations gkittelson on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

PPTP clients unable to connect to outside world 1

Status
Not open for further replies.

hannes42

ISP
Oct 16, 2001
1
DE
Hi forum,

we have a setup where a Cisco 4500 connects us to our upstream provider. Some servers, Portmasters and the outside interface of a PIX 506 5.2(6) are sitting on the ethernet connected to the Cisco.

On the inside of the 506 is our office LAN. I have PPTP clients connecting from the outside (using the Portmasters or coming from somewhere else on the 'net). This works fine so far, they can reach the office LAN.

Unfortunately, the PPTP clients (W2K Prof SP2) are unable to connect to everything besides the office LAN due to the default route the PIX sets. The PIX denies outgoing traffic because the traffic would be going out of the same interface it comes in: the outside interface. This is considered a security breach, according to the documentation. The PIX logs a "Packet denied (no xlate) something" message to the syslog.

Is there any way of letting the PPTP clients connect to the office LAN and the rest of the 'net at the same time?

Any clues appreciated...

Thanks,
Martin
 
HI!

There is a solution for this called "split-tunnel".
However, It works with IPSec VPNs, and I don't think that there is PPTP support for it.
I also don't know if for W2K clients you should use the built in IPSec VPN client or the VPN3000 software client.
Anyway, I guess you need to implement IPSec VPN client support in the PIX
(It might need upgrade to version 6.0 if some commands are not available),
using the vpngroup commands.

Check out CISCO documentation in the web site.

You may also find this utility also helpful for creating sample config, and for the links in the last tab:

Bye
Yizhar Hurwitz
 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top