Networknet archive Blog

Cisco PIX: Publish a Windows Server 2003 PPTP VPN server

Originally published Last updated 3 comments

I installed a Windows Server 2003 PPTP/L2TP VPN server and tested it by creating a VPN connection. The first connection attempt returned "Disconnected. Error 721: The remote computer did not respond". The Windows XP client runs as a VMware virtual machine, and the VPN server is published behind a Cisco PIX 501 firewall.

clip_image001

I checked the VPN server and found the warning below. I also checked NAT: a static rule translated between private and public IP addresses. An ACL allowed 'any' TCP communication, and I added a second ACL for IP protocol 47 (GRE).

Event Type:        Warning
Event Source:        Rasman
Event Category:        None
Event ID:        20209
Date:                1/18/2008
Time:                4:59:22 PM
User:                N/A
Computer:        VPN-01
Description: A connection between the VPN server and the VPN client 0.0.0.0 has been established, but the VPN connection cannot be completed. The most common cause for this is that a firewall or router between the VPN server and the VPN client is not configured to allow Generic Routing Encapsulation (GRE) packets (protocol 47). Verify that the firewalls and routers between your VPN server and the Internet allow GRE packets. Make sure the firewalls and routers on the user's network are also configured to allow GRE packets. If the problem persists, have the user contact the Internet service provider (ISP) to determine whether the ISP might be blocking GRE packets.

I signed in to my Windows Vista Enterprise client and recreated the same VPN connection. The Vista client connected wirelessly to my ADSL modem and had a direct connection to the VPN server. The Windows XP virtual machine was behind the Cisco PIX. I realised something was missing from my firewall configuration.

Allow PPTP through the Cisco PIX firewall

Shell3 lines
1
2
3

pixfirewall# conf t
pixfirewall(config)#fixup protocol pptp 1723
pixfirewall# wr mem

clip_image002

Adding "fixup protocol pptp 1723" to the configuration allowed the Cisco PIX firewall to establish the PPTP connection successfully.

clip_image003

References

2 comments

Comments from the original WordPress site, kept read-only.

  1. Uira Cocha

    Thank You very much for your note, it was very useful for me in fixing a similar problem.

1 mention

  • to domain name