Problems with pptp passthru with PIX 501

[matha]

Hi,

We recently got 3 PIX- 501's. I am trying to set it up in 3 locations all having a DSL or Cable internet facility. The pix came with 6.3(1) version. I am trying to pass thru VPN (PPTP) to the corp. office. It sometimes connects and many times it fails. I added these commands to the basic factory settings. I am not using Site-to-Site topology.

fixup protocol pptp 1723

access-list nonat permit ip 10.x.x.0 255.255.0.0 10.x.x.0 255.255.0.0

nat (inside) 0 access-list nonat
sysopt connection permit-pptp

If i remove the PIX and connect the pc to Cable modem, PPTP works fine every time. With PIX in-between there is a problem and it is not consistent.It doesn't seems to be logical. It is the same case in other locations as well. Am I missing some thing?

We have Cisco 3005 VPN concentrator in the corp office, and we never had any VPN problems.

Any help will be greatly appreciated.

Thanks
guna

 

[yizhar]

HI.

> We recently got 3 PIX- 501's. I am trying to set it up in 3 locations all having a DSL or Cable internet facility
The cable/ADSL device might be also doing PAT which may add complexity and problems (2 NAT devices in a row: the pix and then the DSL router).


All of the following commands should be removed from your configuration. These are not needed for pass-through:
> access-list nonat permit ip 10.x.x.0 255.255.0.0 10.x.x.0 255.255.0.0
> nat (inside) 0 access-list nonat
> sysopt connection permit-pptp


Anyway, since you already have a Cisco 3005 VPN concentrator at the corp office, my suggestion is to start using Cisco IPSec VPN instead of PPTP.
This will probably eliminate the problems you have now, and can also improve security.

You setup the corp VPN server to accept Cisco VPN connection, and then choose either of the following:

Install latest version of Cisco VPN client on remote workstations.
OR:
Set up the branch pix 501 devices as "Easy VPN remote" clients that will connect to the corp server.
OR:
Set up traditioanl "site to site" VPN between branch pix 501 devices and the corp VPN server.

Bye


Yizhar Hurwitz

http://teachers.sivan.co.il/yizhar