PPTP VPN Connection HOW?

[tpcolson]

How to set up a PPTP VPN Connection from a W2K client, thru a Pix 6.1(1) box, using VPDN groups? I've tried every example on Cisco web site, nothing works! User can authenticate, but can't access any resoureses inside network! What of the many hundreds of settings do you have to configure on the clien in the DUN settings? and how do you encrypt the session? Thanks!

 

[yizhar]

HI.

First, you'll need the DES activation key enabled at the pix.
Issue "show version" to verify if you have.

The encription at the pix should be set to 40 bit unless you have purchased and enabled 3des at the pix.

Try pixcript to generate a sample config, and compare it to yours to see if you missed anything:

http://teachers.sivan.co.il/yizhar#pixcript

Did you configure nat 0 properly?
Did you permit the VPN traffic using either access-list or
sysopt connection permit-pptp?

Did you use an ip local pool range which does not overlap with the existing one? like:
ip address inside 192.168.1.254 ....
ip local pool ... 192.168.15.1-192.168.15.99

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[tpcolson]

access-list 90 permit ip US_LAN 255.255.255.0 UK_LAN 255.255.255.0
access-list 90 permit ip UK_LAN 255.255.255.0 US_LAN 255.255.255.0
access-list 191 permit ip US_VPN_CLIENT 255.255.255.0 US_LAN 255.255.255.0
access-list 191 permit ip US_LAN 255.255.255.0 US_VPN_CLIENT 255.255.255.0
access-list 191 permit udp US_VPN_CLIENT 255.255.255.0 US_LAN 255.255.255.0
access-list 191 permit udp US_LAN 255.255.255.0 US_VPN_CLIENT 255.255.255.0
access-list 191 permit tcp US_LAN 255.255.255.0 US_VPN_CLIENT 255.255.255.0
access-list 191 permit tcp US_VPN_CLIENT 255.255.255.0 US_LAN 255.255.255.0

nat (inside) 0 access-list 191
nat (inside) 1 US_LAN 255.255.255.0 0 0
nat (dmz) 1 172.16.16.0 255.255.255.0 0 0

ip local pool pptp-pool 192.168.6.1-192.168.6.50

vpdn group 1 accept dialin pptp
vpdn group 1 ppp authentication mschap
vpdn group 1 client configuration address local pptp-pool
vpdn group 1 client configuration dns 192.168.1.4 198.6.1.2
vpdn group 1 client configuration wins 192.168.1.4
vpdn group 1 client authentication aaa AuthInbound
vpdn group 1 pptp echo 60
vpdn enable outside
terminal width 80

 

[yizhar]

HI.

If you dont use sysopt connection permit-pptp, then you need to allow VPN traffic with an access-list bound to the outside interface.

Look at your syslog messages (use "logging buffer 4&quot - Do you get messages about blocking traffic from 192.168.6.1 ???

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar