Networknet.nl

In the following example I am configuring port forwarding to a Windows Server 2003 Standard Edition PPTP VPN server. My configuration has been configured as shown in the diagram. I have a /28 network registered on the Internet and 14 public IP Addresses are available though the SDSL ISP modem. The SDSL modem is providing these IP addresses by the internal DHCP server. For the Cisco PIX 501 firewall I am using manual assigned Public IP Address.

In the CLI command lines below I am configuring static NAT on a public IP Address for tcp port 1723 (pptp) and assign the private IP Address/hostname to VPN-02 which has been defined in the line “name”.

fixup protocol pptp 1723

name 192.168.5.35 VPN-02

access-list outside_access_in permit tcp any host 194.0.0.2

access-list outside_access_in permit gre any host 194.0.0.2

pdm location VPN-02 255.255.255.255 inside

static (inside,outside) tcp 194.0.0.2 pptp VPN-02 pptp netmask 255.255.255.255 0 0

What did I achieve with this configuration? After I applied this configuration I was able to connect from my Windows XP & Windows Vista clients with built-in VPN client and connect using the PPTP protocol. I also used static port forwarding on tcp 1723 port and enabled the GRE IP protocol fix by using the “fixup protocol pptp 1723″ command. Without the fixup for pptp protocol I was forced to translate complete internal host (VPN-02) and using all TCP ports. If you don’t apply to fixup than you probably will get eventlog message like one below.

I am setting up a Windows 2003 PPTP/L2TP VPN server and after the configuration I started the testing phase. The first error I got was 721 on my Windows XP XP2 client. Windows XP is running as VMWare virtual guest and host is sitting behind a Cisco PIX 501 firewall.

I than went back to the lab server and saw the error message below. I verified the NAT configuration and a static NAT rule was configured based on a private and public ip address translation. ACL was there for  ‘any’ tcp communication and I added second ACL for IP Protocol 47 (GRE).

Event Type:        Warning

Event Source:        Rasman

Event Category:        None

Event ID:        20209

Date:                1/18/2008

Time:                4:59:22 PM

User:                N/A

Computer:        VPN-01

Description:

A connection between the VPN server and the VPN client 0.0.0.0 has been established, but the VPN connection cannot be completed. The most common cause for this is that a firewall or router between the VPN server and the VPN client is not configured to allow Generic Routing Encapsulation (GRE) packets (protocol 47). Verify that the firewalls and routers between your VPN server and the Internet allow GRE packets. Make sure the firewalls and routers on the user’s network are also configured to allow GRE packets. If the problem persists, have the user contact the Internet service provider (ISP) to determine whether the ISP might be blocking GRE packets.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

I start to troubleshoot from my Windows Vista Enterprise client and recreated the VPN connection. I tried to connect and Yes I was prompt for my domain password. The Vista client was connected to my ADSL model with 11G connection. The host with Windows XP was sitting behind the Cisco PIX and the Vista client was directly connected to my ISP.

Search on google directed me to this link and fixed my problem.

pixfirewall# conf t

pixfirewall(config)#fixup protocol pptp 1723

pixfirewall(config)#

pixfirewall# wr mem

Adding the “fixup protocol pptp 1723″ to my configuration let the Cisco PIX firewall know how successfully setup a PPTP connection.