PPTP Tunnel attacked

[avalentin]

Hi everybody

I have a PIX 506E at console these messages appears

outside PPTP: Recvd xGRE pak from 69.0.0.108, len 51231
outside PPTP: Recvd xGRE pak from 69.0.0.84, len 51235, ack 813795339
outside PPTP: Recvd xGRE pak from 69.0.0.84, len 51231
outside PPTP: Recvd xGRE pak from 69.0.0.156, len 51231
outside PPTP: Recvd xGRE pak from 69.0.0.96, len 51235, ack 813795339
Interface outside - PPTP xGRE: Out paket, PPP len 1428

the ip addresses not are permitted, I using PPTP to make a VPN tunnels from Windows Clients, but I can not denied...I think this is and dos or ddos attack ...because eventually a client can not connect to VPN I need to reload the pix...

Any tip to resolve this problem?

Thanks

 

[dopehead]

Diable PPTP an use a proper implemented protocol like IPSEC / nat-traversal.

Otherwise an upgrade might be in its place, i seem to recall some pptp issues in earlier than 6.3 code.

Jan

Network Systems Engineer
CCNA/CQS/CCSP

 

[KipBond]

I just noticed the same thing on our PIX. I've had the "debug" options on before and after the RADIUS (IAS on W2k3) server change. Now that it's on W2k3, I notice the GRE packets going to remote IP addresses 69.0.x.x.

Did you ever find out why that was happening to you?

These packets only start when a PPTP connection is established -- and it doesn't even matter if the connection is from an internal IP to the internal interface of the PIX -- which tells me that this probably isn't some sort of attack, unless we've already be infiltrated.

Anybody else ever heard of this?!?

Thanks!
--Kip